Engineering guides
Backend systems, Node.js, TypeScript, AI coding, fintech infrastructure, and engineering career proof.
Latest posts
Page 13 of 18Prompt injection in coding agents: why repo access changes the risk
A practical explanation of prompt injection risks in coding agents that can read repos, edit files, call tools, or open external pages.
AI-generated tests explained: useful safety net or fake confidence?
How to use AI-generated tests without fooling yourself, including assertions, edge cases, fixtures, and reviewer judgment.
AI coding tool rules: what every repo should tell Copilot or ChatGPT
A practical repo rules checklist for AI coding tools: architecture boundaries, tests, security, style, dependencies, and review expectations.
Login rate limiting explained: protect the boring endpoint first
How to rate limit login endpoints, password reset flows, OTP checks, and account creation without punishing normal users.
Webhook replay attacks explained for backend developers
A simple guide to webhook replay attacks, timestamps, signatures, idempotency, and safe event processing in Node.js APIs.
Idempotency keys for APIs: how to stop duplicate payments and actions
How idempotency keys work in APIs, why retries create duplicates, and how backend developers can design safer mutation endpoints.
Object-level authorization explained: the API bug behind many leaks
A practical guide to object-level authorization, why login is not enough, and how backend developers can test cross-user access.
TypeScript monorepo tsconfig setup without confusing everyone
How to structure tsconfig files in a TypeScript monorepo with base config, package configs, build configs, and fewer editor surprises.
TypeScript project references explained for growing codebases
A plain-English guide to TypeScript project references, faster builds, boundaries, monorepos, and when the extra config is worth it.
Next.js Route Handlers vs Server Actions: which should you use?
Choose between Next.js Route Handlers and Server Actions for forms, APIs, webhooks, mobile clients, caching, and authentication, with working examples.
Next.js Server Actions security checklist for real apps
Secure Next.js Server Actions with in-action authorization, strict validation, safe return values, abuse limits, idempotency, logging, and negative tests.
Node.js test runner explained: when you can skip Jest or Vitest
A simple guide to the built-in Node.js test runner, where it fits, and when a project still benefits from Jest, Vitest, or Playwright.
Node.js Permission Model explained: what it protects and what it does not
A practical guide to the Node.js Permission Model, filesystem access, child process restrictions, and realistic backend security expectations.
npm provenance explained: how to know where a package came from
What npm provenance means, how it helps supply-chain security, and how developers should think before trusting a dependency.
npm trusted publishing explained for JavaScript developers
A simple explanation of npm trusted publishing, OIDC, package publishing without long-lived tokens, and why maintainers should care.
Pin GitHub Actions by SHA: the supply-chain habit most teams skip
Why pinning GitHub Actions to full commit SHAs reduces supply-chain risk, and how to do it without making workflows impossible to maintain.
GitHub Actions OIDC explained: stop storing long-lived cloud secrets
Replace long-lived deployment keys with GitHub Actions OIDC, narrow cloud trust by repository and environment, and test denial before deleting old secrets.
PostgreSQL 19 beta explained: should normal developers care yet?
A practical guide to PostgreSQL beta releases, why PostgreSQL 19 beta matters, and how teams can evaluate features safely.
PostgreSQL security update checklist for backend teams
How backend teams should respond to PostgreSQL security and bug-fix releases without breaking production databases.
OWASP API Security Top 10 explained for Node.js backend developers
Apply the OWASP API Security risks to Node.js routes with object-level authorization, schema validation, rate limits, inventory, logging, and abuse tests.
Copilot cloud agent explained: what developers should review before merging
How GitHub Copilot cloud agent changes the development workflow, what to inspect in generated branches, and how to keep ownership clear.
Copilot custom instructions: how to make AI coding tools follow your project rules
A practical guide to GitHub Copilot custom instructions, repository guidance, coding standards, and avoiding repetitive AI mistakes.
GitHub Copilot code review explained: how to use it without trusting it blindly
How to use GitHub Copilot code review as a helpful second reviewer while still keeping human judgment, tests, and security checks in control.
React Compiler v1.0 explained: what it means for everyday React code
A practical explanation of React Compiler v1.0, how it changes memoization thinking, and what code patterns teams should clean up first.
TypeScript module node20 explained: when should you use it?
A practical guide to TypeScript module node20, Node.js module resolution, ESM/CommonJS interop, and backend tsconfig choices.
TypeScript erasableSyntaxOnly explained for Node.js type stripping
Understand TypeScript erasableSyntaxOnly, which syntax it rejects, and the tsconfig needed when Node.js runs TypeScript by stripping types without compiling.
TypeScript 6.0 explained: what changes matter before TypeScript 7
A practical explanation of TypeScript 6.0 as a transition release, what to check before upgrading, and how to prepare for TypeScript 7.
require(esm) in Node.js: what CommonJS teams should understand
A practical guide to Node.js ESM and CommonJS interop, why require(esm) matters, and how teams should migrate without chaos.
Node.js security releases explained: what backend developers should actually do
How to respond to Node.js security releases, including LTS updates, dependency checks, CI testing, and production rollout.
Node.js Temporal API explained: why dates may finally get less painful
A practical explanation of the Temporal API in Node.js 26, how it differs from Date, and what developers should know about time zones.