Writing
Articles
Notes on full-stack development, backend, real-time systems, security and observability - drawn from real projects.
What a Software Patent Actually Covers: Claims vs. Description
Most of a patent grants you nothing - only the claims draw the legal fence line. What I learned reading my own, and how it changes the way you read every patent after it.
Polling, SSE or WebSockets: Picking a Transport for Live Updates
Two tools on this site push live updates, and only one of them warranted a socket. How to choose between polling, Server-Sent Events and WebSockets.
From WordPress to a Modern Stack: Rebuilding with Next.js & a Real API
When to migrate off WordPress, what you gain, and how to do it without a big-bang rewrite - preserving SEO along the way.
Observability 101: Lessons from a Dynatrace + Kubernetes Lab
Metrics, logs and traces - and how building a lab to break things on purpose teaches you to find root causes fast.
Broadcasting to a Crowd's Phones with Eddystone BLE Beacons
How BLE beacons push signals to thousands of phones with no network, and why broadcast beats connections at scale.
Scaling Live Video: An Intro to WebRTC SFUs
Why peer-to-peer WebRTC falls apart with an audience, and how a Selective Forwarding Unit makes low-latency one-to-many streaming possible.
A Real-Time Webhook Inspector with Fastify & WebSockets
Build a tool that gives you a unique URL and streams incoming HTTP requests to your browser live - Fastify, WebSockets, and the nginx gotcha.
How k-Anonymity Password Breach Checks Work (and Building One)
Check whether a password has been breached without ever sending it - the clever cryptographic trick behind Have I Been Pwned, and how to build on it.
Preventing SSRF in Node.js: Safe Outbound Requests from User Input
Any time your server fetches a user-supplied URL you risk SSRF. How the attack works and how to shut it down - including the redirect gotcha.
Getting an A on Security Headers: CSP, HSTS & Friends
The six response headers that close common browser-side attacks, how to add them at nginx, and how to write a CSP that does not break your site.
One Zod Schema, Three Jobs: Validation, Serialization & OpenAPI Docs
Make one schema validate requests, serialize responses, and generate your OpenAPI docs - so the docs can never drift from the code.
Deploying a Full-Stack App to DigitalOcean with Docker, nginx & HTTPS
A reproducible, one-command deploy of a full-stack app to a $6 Droplet - Docker Compose, nginx reverse proxy, free HTTPS, and the ufw/Docker trap.