← All posts
#architecture
2 posts
Why Multi-Tenant APIs Should Scope Ownership Through Headers, Not Request Bodies
Trusting tenantId or workspaceId from a POST body is an IDOR waiting to happen. When header-based tenancy scoping is the right call — and how to implement it cleanly.
7 min read
architecturesecuritysaas
Building a Resilient AI Audit Pipeline
How we designed a multi-stage NestJS pipeline with deterministic LLM fallbacks, contract validation, and reproducible audit cycles for a local SEO SaaS.
3 min read
architecturenestjsai