Backend
APIs, auth, jobs and the server-side decisions that are expensive to reverse.
When to Automate With n8n and When to Write the Code
Workflow tools are excellent glue and poor application logic. The line between the two, and how to keep automations from becoming untested production code.
Rate Limiting at the Edge, Before It Reaches Your Server
Why the limit belongs in front of your origin, which algorithm to pick, and the identity question that decides whether it works at all.
Running Background Workers and Cron Jobs on Render
Background workers, cron jobs and the free-tier spin-down that quietly stops them — the practical setup for the always-on half of a serverless stack.
Background Jobs: Which Queue, and When You Need One
Postgres table, Redis queue or hosted service — and the four properties that decide which one, starting with whether you need a queue at all.
Idempotency Keys: Making Retries Safe on Your Own API
A timeout tells the client nothing about whether the work happened. Idempotency keys are how a retry becomes safe instead of a second order.
Direct File Uploads With Signed URLs, Done Safely
The browser uploads straight to storage and your server never holds the bytes — plus the four checks that stop a signed URL being an open write endpoint.
MongoDB Schema and Index Decisions That Do Not Age Badly
Embed or reference, the compound index rule that decides whether a query is fast, and the unbounded array that eventually breaks a document.
REST API Design Decisions That Age Well
Pagination, errors, versioning and partial updates — the four choices that are trivial before launch and permanent afterwards.
Cloudflare R2 vs S3: Where the Bill Actually Comes From
Zero egress fees is the headline. The decision is really about egress volume, ecosystem depth and how much of your architecture assumes AWS is nearby.
Schema Migrations That Do Not Take the Site Down
The expand-and-contract pattern, which ALTER statements take an exclusive lock, and why the dangerous part of a rename is the deploy rather than the SQL.
Database Branching in Neon, and What It Actually Fixes
A branch per pull request with production-shaped data, why it makes migration review possible, and the two ways it quietly leaks customer records.
Why Your Password Reset Email Lands in Spam
SPF, DKIM and DMARC in the order they actually have to be set up, plus the subdomain decision that keeps a marketing blast from killing your login emails.
Supabase Row Level Security Without the Foot-Guns
The policies that actually hold, the service role key that quietly bypasses all of them, and why an unindexed policy turns a fast query into a slow one.
Stripe Webhooks That Do Not Double-Charge
Stripe sends the same event twice, out of order, and to an endpoint that timed out. The handler shape that survives all three without granting twice.
Role-Based Access Control in Next.js and Express
Where the permission check belongs, why hiding a button is not access control, and the one file that stops roles becoming a nest of if statements.