Engineering notes
What we actually run into building web applications and AI automations - stack decisions, real project costs, and the bugs we keep finding in other people's code.
The hardest part of a legacy system is staffing it
The code was never the problem. Finding one senior engineer willing to own an old .NET backend was, and what fixed it was the job description, not the pay.
Adding tests to a codebase that has none
You cannot retrofit test coverage as a project. What works on a legacy system is recording what it already does, starting with the paths that carry money.
Five million emails on a stolen key
A leaked API key, five million emails, and a $2,000 invoice. What the attack looked like, why nothing alerted anyone, and the audit we now run on every project.
Everything was green and nothing worked
Four failures that reported success: a revalidation that changed nothing, a 404 served as 200, schema for content that was not there, and a tag silently dropped.
Inheriting a legacy .NET backend nobody wants to touch
What to do when a business-critical system runs on old .NET, the people who wrote it are gone, and rewriting is not an option. The order of work that holds.
RAG, fine-tuning, or just a better prompt?
Most AI projects reach for RAG before they need it. A decision tree for operations teams, and the three questions that settle it in an afternoon.
Is your API key in the browser bundle?
Secrets leak into frontend bundles constantly, and NEXT_PUBLIC_ is not the culprit people think it is. A 30-second check, and the fix that actually holds.