Engineering guides
Backend systems, Node.js, TypeScript, AI coding, fintech infrastructure, and engineering career proof. The core library stays focused on work we can explain and inspect.
These guides are organized around backend engineering, fintech systems, AI coding, and portfolio proof. Start with a path, then use the related links inside each article to keep building context.
Browse all 27 topics395 guides
Latest posts
Page 1 of 14GitHub OAuth token rotation: how to migrate without logging everyone out
A practical GitHub OAuth token rotation guide: handle expiring access and refresh tokens, rotate safely, preserve sessions, and recover when users return with old credentials.
Node.js 26.8.1 upgrade checklist: what to test before moving a backend
A practical Node.js 26.8.1 upgrade checklist for backend teams, covering runtime compatibility, native dependencies, tests, observability, and rollback planning.
GitHub code scanning's Mitigated reason: when a vulnerability is not fixed
Use GitHub code scanning's Mitigated dismissal reason honestly when external controls reduce risk, while preserving remediation ownership and review evidence.
MCP allowlists in GitHub Copilot: a practical least-privilege setup
Use GitHub Copilot MCP allowlists to control remote and local servers, fail closed on bad settings, and review tool access before enterprise rollout.
GitHub Code Quality Actions path changed: update reports and cost tracking
Update GitHub Actions reports for the dedicated Code Quality workflow path and actor without losing code-scanning history, billing data, or audit visibility.
GitHub OAuth apps with multiple redirect URIs: secure migration guide
Configure GitHub OAuth apps with multiple callback URLs safely, preserve state validation, prevent redirect confusion, and migrate tokens without breaking users.
CodeQL 2.26.3 for JavaScript and GitHub Actions: what teams must retest
Review CodeQL 2.26.3 changes for JavaScript, TypeScript, Vue and GitHub Actions, including a breaking custom-query removal and updated taint models.
PostgreSQL 18.6 security update: a safe production upgrade guide
Patch PostgreSQL 18.6 safely, check GIN statistics, btree_gist and ltree indexes, and verify Node.js services after the August 2026 security release.
Prepare a backend portfolio for a 15-minute recruiter screen
The first screen should reveal role fit, two strong projects, ownership, proof, and contact details before asking the recruiter to explore deeply.
Write engineering project updates that show judgment
A useful update separates completed work, evidence, unresolved risk, and the next decision instead of reporting a list of files changed.
Build one deep backend project instead of five tutorial clones
Depth comes from handling changing requirements, failures, migrations, and operations in one system rather than repeating setup across clones.
Add production evidence to a student resume without exaggerating
Production evidence should say what you owned, the operating environment, and the measurable or inspectable proof without inventing scale.
Create a project demo that survives unreliable Wi-Fi
A professional demo has a short live path plus recorded evidence and screenshots for dependencies that may fail outside your control.
Explain technical tradeoffs in interviews without pretending certainty
A credible tradeoff answer states the constraint, alternatives considered, chosen risk, and evidence that would trigger a change.
Use architecture diagrams without making your portfolio vague
A useful diagram names responsibilities and data movement, then links each important arrow to code, a decision, or an observed failure.
Show failure handling in a junior developer portfolio
Retries, idempotency, timeouts, and recovery often reveal more engineering judgment than another happy-path feature.
Write a README that proves your backend actually runs
A portfolio README should let a reviewer understand, run, and inspect the system without guessing hidden setup steps.
Turn a backend project into a portfolio case study recruiters can scan
A strong case study explains the user problem, constraints, architecture decision, evidence, and what changed after testing instead of listing technologies.
Measure Kafka consumer processing age, not only offset lag
Offset count lacks business time, while processing age reveals whether the oldest unhandled event is already missing its deadline.
Choose a Kafka message key from the ordering requirement
The message key should express the smallest business entity that requires ordering, balancing correctness against partition distribution.
Kafka replay without sending duplicate customer notifications
Replay is safe only when projections can rebuild and irreversible side effects can recognize historical duplicates.
Pause and resume Kafka consumers for downstream backpressure
Pausing fetches can protect a slow dependency while heartbeats continue, but long processing must still respect poll and rebalance settings.
Detect Kafka partition skew before adding consumers
Average lag can hide one hot partition whose key distribution limits throughput no matter how many idle consumers are added.
Transactional outbox with Kafka: publish database changes reliably
An outbox writes business state and an event record in one database transaction, then a relay publishes and marks it safely.
Kafka schema evolution: compatible changes without wishful thinking
Schema compatibility rules help, but consumers also need defaults and behavior that make old and new messages meaningful.
Design a Kafka dead-letter topic that supports recovery
A dead-letter topic needs original payload, source coordinates, failure category, attempt history, and a controlled replay path.
Exactly-once Kafka does not make external APIs exactly once
Kafka transactions can coordinate Kafka reads and writes, but they cannot atomically include an unrelated payment, email, or database API.
Kafka cooperative rebalancing: reduce stop-the-world pauses
Cooperative rebalancing lets consumers move partitions incrementally, but handlers still need safe revoke and assignment behavior.
Redis cluster hash tags: colocate only the keys that transact
Hash tags place related keys in one cluster slot for multi-key operations, but an overly broad tag creates a hot shard.
Redis keyspace notifications are hints, not a durable queue
Keyspace notifications can trigger lightweight reactions but disconnected subscribers miss events, making them unsuitable as the only audit or workflow channel.