Engineering guides
Backend systems, Node.js, TypeScript, AI coding, fintech infrastructure, and engineering career proof.
Latest posts
Page 12 of 18How to fix npm 12 blocked git dependencies with allow-git
Fix npm 12 installs that block Git dependencies, find transitive Git URLs, and decide whether to allow or replace them safely.
npm 12 allowScripts explained: why install scripts no longer run by default
Understand npm 12 allowScripts, approve trusted lifecycle scripts, and fix installs that stop building native modules or generated clients.
Designing a fraud detection event pipeline in Node.js
A practical Node.js fraud event pipeline with stable event contracts, idempotent consumers, rules, risk scores, review queues, audit logs, and replay safety.
How to scope a backend portfolio project recruiters can evaluate
Choose a backend portfolio project with one serious workflow, visible engineering decisions, realistic failure cases, and proof recruiters can review quickly.
How to fix ERR_MODULE_NOT_FOUND in Node.js ESM
Fix Node.js ERR_MODULE_NOT_FOUND errors by checking file extensions, package exports, aliases, build output, and ESM resolution in the right order.
Local vs cloud AI coding tools: privacy and speed tradeoffs
A balanced guide to local and cloud AI coding tools, including privacy, context size, speed, model quality, setup, and team governance.
Using AI on legacy code safely: understand before changing
A practical guide to using AI with legacy codebases: map behavior, add tests, avoid blind rewrites, and preserve business rules.
When AI refactors too much: how to keep changes reviewable
How to keep AI coding changes small, reviewable, and safe by limiting scope, separating refactors, and protecting behavior.
AI code diff review checklist before you merge
A practical review checklist for AI-generated code diffs: scope, tests, security, dependencies, error handling, and hidden behavior changes.
Feature flag cleanup: how temporary switches become permanent bugs
How to manage feature flag debt, ownership, rollout states, cleanup dates, and tests for enabled and disabled paths.
Database restore tests: the backup step teams forget
Turn database backups into a tested recovery process with clear RPO and RTO targets, isolated restore drills, integrity checks, application tests, and evidence.
Background job idempotency: why workers repeat work in production
How to design idempotent background jobs so retries, crashes, and duplicate messages do not double-charge or double-send.
Audit logs for product apps: what should you record?
A practical audit logging guide for SaaS and backend apps: admin actions, auth events, data changes, exports, and privacy balance.
Password reset token design: small mistakes that create big risk
A practical guide to password reset tokens, expiration, single-use links, account enumeration, logging, and safe reset flows.
SameSite cookies explained: the setting that prevents many surprises
How SameSite cookie settings work, why they matter for login sessions, and where Strict, Lax, and None fit.
CORS misconceptions: why disabling it is not an API security plan
Understand what CORS actually controls, configure credentialed origins safely, debug preflights, and keep authentication and authorization as separate API boundaries.
Content Security Policy explained for normal web developers
A practical CSP guide with report-only rollout, strict policies, nonces, hashes, third-party scripts, reporting, and production checks.
GitHub secret scanning and push protection explained
A practical guide to secret scanning, push protection, token leaks, alert handling, and what to do after accidentally committing a key.
API keys in frontend code: why this mistake keeps happening
Why API keys exposed in frontend bundles are not secret, what attackers can do, and safer patterns for browser apps.
Portfolio project README: what recruiters and engineers look for
A practical README structure for portfolio projects: problem, demo, tech stack, architecture, setup, tradeoffs, and proof of quality.
LinkedIn profile SEO for students: how recruiters actually find you
How students and freshers can optimize LinkedIn headlines, skills, projects, keywords, and experience for recruiter search.
Freelance contract basics beginners should not skip
A practical freelance contract checklist covering scope, payment, revisions, deadlines, ownership, cancellation, and communication.
Salary counteroffer email for freshers: simple template and examples
How freshers can write a polite salary counteroffer email with market context, gratitude, flexibility, and confidence.
WhatsApp and Telegram investment groups: why the profits look so real
How fake investment groups build trust, show fake profit screenshots, use friendly moderators, and push people into crypto or stock scams.
Software Bill of Materials (SBOM): what it is and how to use one
A plain-English SBOM guide: what an SBOM contains, how it differs from a vulnerability scan, and a practical workflow for using one during security incidents.
Secure by Design explained for small software teams
A practical explanation of Secure by Design for small teams: safer defaults, fewer risky choices, transparency, and ownership.
Slopsquatting explained: when AI suggests packages that do not really exist
A simple explanation of slopsquatting, hallucinated package names, and why AI-generated install commands need verification.
Package typosquatting explained: one wrong install can hurt a project
How package typosquatting works, why npm install mistakes are risky, and how developers can reduce dependency confusion.
If someone insists on crypto payment, treat it as a warning sign
A practical guide to crypto payment red flags in job scams, romance scams, fake fees, government impersonation, and recovery scams.
MCP server permissions explained: what to check before connecting one
A practical guide to MCP server permissions, tool access, OAuth, data exposure, and what developers should review before connecting AI tools.