Blog
Notes on system design, performance, AI pipelines, and shipping production software.
Why Multi-Tenant APIs Should Scope Ownership Through Headers, Not Request Bodies
Trusting tenantId or workspaceId from a POST body is an IDOR waiting to happen. When header-based tenancy scoping is the right call — and how to implement it cleanly.
7 min read
architecturesecuritysaas
Eliminating Cache Stampedes on Match Day
How single-flight deduplication and stale-while-revalidate caching fixed MySQL connection-pool exhaustion during peak fantasy sports traffic.
2 min read
performancenodejscaching
Building a Resilient AI Audit Pipeline
How we designed a multi-stage NestJS pipeline with deterministic LLM fallbacks, contract validation, and reproducible audit cycles for a local SEO SaaS.
3 min read
architecturenestjsai