Pagination looks like the least interesting problem in backend engineering — until the page that took 30 ms at depth
Continue readingPagination at Depth: Why OFFSET Falls Over and How to Build Cursors That Don’t
Every API that survives long enough faces the same moment: a requirement lands that cannot be expressed as an additive
Continue readingAPI Versioning: How to Change a Live API Without Breaking Every Client
Authentication has become a solved-enough problem that most teams barely think about it: OIDC, SSO, a middleware that verifies the
Continue readingBroken Access Control: The Vulnerability Class That Hides Behind Working Tests
Ask a chat model to check the weather and it will happily invent a forecast — it has no way
Continue readingFunction Calling: How LLMs Actually Call Your Tools
Almost every API starts its pagination life with LIMIT 20 OFFSET 40. It’s the pattern every ORM hands you, it
Continue readingPagination That Doesn’t Fall Apart at Page 50,000: Keyset Cursors Done Right
Sooner or later every API team hits the wall: a client depends on behavior you need to change. The field
If you shipped a CLI tool or a single-page app in the last few years, you have probably implemented “OAuth”
Offset pagination is the first thing everyone learns and the first thing that falls over in production. The product manager
Continue readingBeyond OFFSET: Keyset Pagination in PostgreSQL That Actually Scales
One Tuesday your API’s most popular endpoint works fine. Two Tuesdays later, a mobile app that has been calling it
Every production rate limiter has two layers. The first layer is the algorithm: token bucket, leaky bucket, fixed window, sliding