Engineering guides
Backend systems, Node.js, TypeScript, AI coding, fintech infrastructure, and engineering career proof. The core library stays focused on work we can explain and inspect.
Find the guide that matches the decision in front of you. The core tracks stay close to backend systems, TypeScript, fintech, AI-assisted coding, and the work of getting hired.
Browse all 21 topics532 guides
Latest posts
Page 1 of 18AI search citations: how to write technical pages that can be checked
Pages are easier to trust when claims have clear scope, dates, examples, and sources. Writing for AI search should improve the human reader too: state t...
TypeScript satisfies vs as: preserve useful checking in configuration objects
TypeScript’s `satisfies` operator can validate an object without erasing its inferred property types. That is useful for route maps, feature flags, and ...
Redis distributed locks: when a lease is not enough
A Redis lock can coordinate short work, but a lease expiring while the original worker is still running can create a split-brain side effect. Use locks ...
Webhook signature verification: timestamp windows and replay protection
A valid webhook signature does not prove that the request is fresh. Verification should bind the payload to a timestamp, event ID, and a replay policy.
REST API pagination: cursor tokens that do not leak database details
Cursor pagination should help a client continue from a stable position without exposing internal IDs, timestamps, or query assumptions. Treat the token ...
AI evaluation gates for tool calls: test actions, not only answers
An agent can write a convincing final answer while calling the wrong tool or using the wrong arguments. Evaluate the action trace, permissions, and side...
AI agent background jobs: checkpoints, cancellation, and human handoff
Long-running agents need the same reliability ideas as workers: durable checkpoints, cancellation, idempotency, and an operator who can take over when t...
Agent tool schemas: make AI actions predictable before adding more tools
An agent is easier to control when every tool has a narrow schema, clear errors, and explicit side effects. Tool design is part of the safety model, not...
Docker provenance for Node.js images: what a deploy should prove
A deployment should identify the source revision, dependency inputs, image digest, and build environment. Provenance makes that chain inspectable when a...
OpenTelemetry sampling: keep rare failures without storing everything
Tracing every request can be expensive, while sampling away every rare failure makes debugging impossible. A useful policy keeps errors, slow requests, ...
PostgreSQL covering indexes: when INCLUDE helps and when it does not
A covering index can reduce table reads for a common query, but it also increases write and storage cost. Use the query plan and workload, not the featu...
Passkey recovery design: avoid turning the fallback into the weak link
Passkeys improve the normal login path, but account recovery can quietly reintroduce phishing and takeover risk. Recovery deserves the same threat model...
Node.js HTTP agent queue poisoning: what backend teams should verify
HTTP client security fixes deserve more than a version bump. Check connection reuse, proxy behavior, TLS verification, and the libraries that sit betwee...
Node.js 26 current vs 24 LTS: choosing a runtime for production
Current and LTS Node.js lines serve different release needs. The right choice depends on support policy, dependency compatibility, and whether the team ...
How to review AI-detected secrets without leaking them again
A security alert can become a second leak when developers paste the credential into tickets, chat, or an AI prompt. Review the finding with hashes, loca...
AI secret detection in GitHub: why context beats token patterns
Secret scanners used to depend heavily on recognizable token shapes. Context-aware detection can find more suspicious values, but teams still need a saf...
Chrome DevTools MCP: debug browser sessions without blind automation
A browser-debugging agent can save time when it can inspect the current page, network, and console. It can also make a wrong change quickly, so the debu...
Chrome Prompt API with Vercel AI SDK: where browser AI belongs
Built-in browser AI can reduce network trips, but it also creates device, model, and privacy differences. Start with tasks that tolerate missing capabil...
WebMCP explained: how websites may expose tools to AI agents
WebMCP points toward websites exposing structured actions for browser agents. Developers should think about tool contracts, permission boundaries, and u...
Chrome 153 two-week releases: what web teams should change
Chrome moving to a faster release rhythm changes how teams test browsers. The practical answer is not to panic at every beta; it is to make compatibilit...
AI search summaries and web traffic: what small publishers can measure
AI search changes how people discover information, but impressions, clicks, branded searches, and engaged visits still tell different stories. Measure each one
AI evaluation datasets: how to catch regressions before release
An AI feature can look better in a demo while becoming less reliable on the cases users actually care about. A small evaluation set with expected outcomes makes
Redis queues and backpressure: stop accepting work you cannot finish
A queue protects an API only when it has a capacity policy. Without backpressure, the queue simply moves overload into memory, latency, and a later incident.
GraphQL query limits: depth, cost, and timeout controls that matter
GraphQL gives clients a flexible query surface, which means the server needs explicit limits. Depth, field cost, timeouts, and persisted operations work togethe
TypeScript strict mode in a large codebase: migrate without freezing delivery
Turning on strict TypeScript checks can reveal real defects, but enabling every error across a large codebase at once can paralyze a team. A staged migration ke
Docker image supply chain: lockfiles, provenance, and runtime users
A container image is also a dependency bundle and a release artifact. Secure builds need reproducible inputs, a small runtime, useful provenance, and a process
OpenTelemetry for Node.js: the first traces a small team should collect
Observability becomes useful when it answers a specific question. A small Node.js team can start with request traces, dependency timing, and error context inste
PostgreSQL indexes for API endpoints: measure before adding one
Adding an index can fix a slow endpoint or make writes and storage more expensive. The useful habit is to connect an index to a real query plan and a measured w
WebAuthn passkeys for developers: the server-side mistakes to avoid
Passkeys reduce phishing risk, but the server still has to validate challenges, origins, credentials, and sign counters correctly. The browser prompt is not the
HTTP 429 explained: retry-after, backoff, and client behavior
A 429 response is not merely an error page. It is a conversation between a server protecting capacity and a client deciding whether, when, and how to try again.