Journal
Atomic observations on software engineering, systems, and the craft of building — documentation of lessons learned in production.
Six Misconfigurations, One Night: Bringing Up a Dev Environment Before a Client Demo
Moncton CRM's dev environment went down at 11pm, the night before its first client demo, with the engineer who owns cloud configuration unavailable. Six independent misconfigurations were hiding behind each other — fixing one only revealed the next.
Don't Trust the Redirect: Verifying Payments Server-Side
A successful client-side redirect after checkout isn't proof a payment cleared — why payment status should only ever change after a verified webhook.
One NGINX Config, Two Apps, One Failure Domain
Routing a frontend and backend through a single NGINX config under one domain simplifies deployment — and turns that config into a single point where one bad rule takes down both.
The Endpoint That Doesn't Exist Can't Be Misused
Auth-checking every REST endpoint is weaker than not exposing one at all — replacing a client-facing REST layer with Next.js Server Actions closed off a class of misuse by removing the surface, not by guarding it.