Blog
- 2026-10-11
A Feature Flag Is Not a Security Precondition — So We Made the Build Check Its Own Version
A flag was the only thing gating a data-disclosure fix. We replaced documentation with a runtime version gate that fails closed, then spent five review rounds removing its own bypasses.
dotnetsecurityarchitecturetesting - 2026-10-10
The Exception Table That Fails Open
A crash-handling middleware that looks rigorous but silently routes every unlisted error to a 500 — and why the default branch is the whole security posture.
securitydotneterror-handlingarchitecture - 2026-10-10
Ten OpenAI Model IDs Die on October 23rd
A pile of model ids I inherited from config files stop serving on a fixed date, and the only error you get is a bare 404. How to find every model id your repo references before the date lands.
aillmoperationsdotnet - 2026-09-28
AWS vs Azure vs GCP for a .NET SaaS: The Limits That Actually Decide It
Not another pros-and-cons list. The documented numbers that decide architecture for a Postgres + containers + background-jobs stack: serverless timeouts, the 230-second Azure wall, Cloud Run's CPU billing model, and who patches your database.
awsazuregcpdotnetarchitecture - 2026-09-28
EF Core Lessons From a Multi-Tenant SaaS: Provider Drift, Migration Holes, and the Review Gate That Prevents Them
Six months of EF Core in production produced a written checklist we now enforce on every migration PR. This is the checklist, and the incidents that made each line necessary.
dotnetef-corepostgresqlarchitecture - 2026-09-28
Clean Architecture and SOLID After Five Years: What I'd Keep and What I'd Delete
The canonical .NET Clean Architecture template author now recommends a single-project version capped at 5-50 endpoints and 1-5 developers. That's an admission worth reading carefully — plus honest SOLID guidance with real C# before/after code.
dotnetclean-architecturesolidcsharp - 2026-09-28
C# 14 in Production: What the `field` Keyword and Extension Members Actually Change
C# 14 shipped with .NET 10. The two features that survived contact with my codebase are the `field` keyword and extension blocks — here's how they changed real code, and which of the other features I'm not using.
csharpdotnetlanguage - 2026-09-28
Feature Flags Are a Code-Smell Generator: Five Bugs We Actually Shipped
We maintain a required feature-flag inventory doc, and it exists because five distinct bug classes kept coming back. Each one is a case where the flag system itself — not the feature — was the defect.
dotnetarchitecturetestingfeature-flags - 2026-09-28
React Frontend Lessons: How We Consume Feature Flags Without a Feature-Flag System
The React side of a multi-portal SaaS: why we never built a client-side flag system, the i18n parity test that gates every string change, the Vite 8 manualChunks gotcha, and the auth-guard role rule that surprised me.
reacttypescriptvitei18n - 2026-09-28
Why Our Refresh Tokens Rotate on Every Use (and How We Detect a Stolen One)
A rotating refresh-token design with family-based reuse detection: what each field is for, why the hash algorithm differs from the one we use for passwords, the __Host- cookie contract, and the exact sequence that traps a replayed token.
dotnetsecurityarchitecture - 2026-09-10
When OAuth Login 500s in Prod but Not Locally: The Migration That Never Ran
A production 500 on every Google/Facebook social login, with a 42P01 'relation does not exist' error buried under classified rejection logs. Root cause: EF Core migrations were gated behind IsDevelopment() and never ran in production.
dotnetef-corepostgresqloauth - 2026-09-09
The Caddyfile That Committed Broken: File-Global Matchers Get Rejected
A security fix that never actually deployed: a Caddy request matcher defined at file-global scope is invalid Caddyfile syntax, Caddy rejects the whole config, and the bootstrap silently skipped it. Here's the snippet pattern that fixes it.
caddydevopssecurity - 2026-09-08
Virus Scanning a 2-vCPU VPS: Why ClamAV Became a Docker Sidecar
Running ClamAV for user-uploaded document scanning on a tiny VPS seemed impossible — 1GB RAM for the daemon, plus cold-start signature loads. The architecture that made it work: a ClamAV sidecar container speaking the clamd INSTREAM protocol.
dotnetdockersecurityarchitecture - 2026-09-07
EF Core NoTracking Broke 50 Repository Methods, and I Reverted It
A one-line 'performance optimization' — global AsNoTracking in EF Core — silently broke every fetch-then-mutate pattern in a 50-method repository layer. Here's the failure mode and why I rolled it back.
dotnetef-corepostgresql - 2026-09-06
The Two-Second Crash: Debugging Hangfire.PostgreSql on a Fresh VPS
Our API container kept dying ~2 seconds after boot on a freshly rebuilt VPS. Caddy 502s everywhere. The culprit was a transaction-enlistment mismatch between Hangfire.PostgreSql and Npgsql.
dotnethangfirepostgresqldocker - 2026-01-22
Postgres Killed Our Query. The Fix Was One Index — Found in 30 Seconds.
An endpoint that was fast in staging fell over in production. EXPLAIN ANALYZE showed a sequential scan on a 2M-row table. The index trade-off, and why I now check query plans before blaming the ORM.
postgresqlperformancedotnetef-core - 2025-04-11
Terraform State: The 3AM Lesson in Why You Never Edit It By Hand
A 'quick' manual fix to a terraform.tfstate file corrupted the resource graph and nearly orphaned a production database. What state actually is, and the remote-state setup that makes hand-editing unthinkable.
terraformiacdevops - 2024-02-27
The Kubernetes Pod That Was 'Running' and Serving Nothing
A pod showed green in kubectl, passed its liveness probe, and returned connection refused. The gap between 'the container is up' and 'the app is ready' — and how readiness probes are supposed to close it.
kubernetesdevopsreliability - 2023-06-19
Our Docker Images Were 1.2GB. Here's the Exact Trail Down to 90MB.
A real image-slimming exercise, step by step: base image choice, layer order, multi-stage builds, and the two surprises (apt cache and .dockerignore) that mattered more than anything fancy.
dockerdevopsperformance - 2022-03-02
CORS Is Not a Firewall: The API Lockdown That Didn't Lock Anything
We 'secured' our API with a CORS allowlist and shipped. A curl command from any laptop proved we had protected exactly nothing. What CORS actually does, and the auth changes that mattered.
securityapiweb - 2021-08-14
The Ansible Playbook That Worked Everywhere Except the One Place It Mattered
A playbook that provisioned three environments flawlessly failed on a fresh VM because of a task that silently succeeded. What I learned about idempotency the hard way.
ansibledevopsiac