Writing
51 articles on backend engineering, payments, DevOps and security, written from real projects.
51 articles
System Design for Backend Engineers: From One Server to Millions of Users
Learn system design by scaling one server step by step: estimates, caching, queues, replicas, sharding, failure handling and a worked URL shortener.
System DesignArchitectureAug 26, 2026Config Malware in ESLint & PostCSS: How It Spreads, How We Scanned It, and How to Stop Reinfection
A full incident walkthrough of obfuscated JavaScript malware in ESLint/PostCSS configs — plus public NestJS and Next.js golden templates with CI scanners and PR-only main.
SecurityMalwareAug 24, 2026Instant Failover Between Two Servers: Cloudflare Tunnel + a Real-IP Backup
A practical high-availability setup where a main server hides behind Cloudflare Tunnel with nothing else in front of the app, and a secondary server on a real public IP runs Caddy or Nginx — with Cloudflare Load Balancing doing edge-side, near-instant failover between the two.
CloudflareHigh AvailabilityAug 24, 2026The Payment Redirect That Landed on a Dead Server
The user paid. The gateway redirected back. Your server was mid-deploy and returned a 502. Now what? A practical pattern for surviving crashes at the exact moment of a payment redirect — client-side persistence, gateway as source of truth, and reconciliation that doesn't lose the sale.
PaymentsReliabilityAug 9, 2026The New HTTP Method: QUERY
RFC 10008 adds QUERY to HTTP — a safe, idempotent method with a request body. Why GET and POST were never enough for complex searches, how QUERY differs from both, caching and Accept-Query, and when you should actually use it.
HTTPAPI DesignAug 1, 2026DPRK-Attributed Malware Hidden in tailwind.config.js: What I Found and How to Detect It
How a single obfuscated block appended to a routine tailwind.config.js became a credential stealer beaconing to a public TRON RPC — indicators, triage steps, and a defense checklist for the config files you never read.
SecurityMalwareJul 27, 2026Which Rendering Method Is Better for SEO? The Honest Answer
SSG, SSR, ISR, RSC, streaming, or CSR — an engineer's breakdown of which rendering strategy actually wins for SEO in 2026, why Googlebot's two-wave indexing matters, and how to pick the right one per route.
SEOWebJul 27, 2026Server-Sent Events in Production: A Complete Guide with NestJS
A practical, deep dive on SSE — how it actually works on the wire, the protocol details most tutorials skip (Last-Event-ID, retry intervals, named events), how to build it in NestJS with proper auth, scaling, and reconnection handling, and when SSE beats WebSockets for your real-time app.
SSEReal-timeJul 25, 2026The Complete Guide to Web Rendering: SSR, CSR, SSG, ISR, RSC, and Streaming Explained
Every rendering strategy that matters in 2026, side by side — what each one does, when the HTML is generated, where JavaScript runs, what the trade-offs are, and which one to pick for marketing sites, apps, dashboards, e-commerce, and AI products.
WebPerformanceJul 24, 2026What Is Convex? The Reactive Backend Platform Explained
A practical guide to Convex — the TypeScript-first reactive backend with built-in database, functions, real-time sync, and ACID transactions. How it works, when to use it, how it compares to Supabase and Firebase, and what its function primitives (queries, mutations, actions) actually do.
ConvexBackendJul 24, 2026How to Install and Use Convex Locally: A Step-by-Step Guide
A practical, copy-pasteable walkthrough for setting up Convex on your machine — from the first `npx convex dev` to writing schemas, queries, mutations, and wiring a React client. Includes troubleshooting tips and the dev loop that actually works.
ConvexTutorialJul 23, 2026Building a Highly Secure NestJS REST API: A Hacker-Resistant Blueprint
A practical, opinionated guide to hardening a NestJS REST API against cookie hijacking, XSS, CSRF, SQL injection, brute force, and the rest of the OWASP Top 10 — with the exact middleware, guards, headers, and code to make hacking genuinely hard.
NestJSSecurityJul 21, 2026AI-Powered Search with OpenAI & Gemini Embeddings: A Practical Guide to Vector Databases (Without Converting Your Existing One)
A working guide to semantic search using OpenAI and Gemini embedding models, why a sidecar vector database beats forcing your Postgres into being one, how Qdrant fits into a real backend, and the production details that turn a clever demo into a reliable feature.
AIVector DatabaseJul 21, 2026Getting Started with BullMQ: A Beginner's Guide to Job Queues in Node.js
A ground-up introduction to BullMQ — what job queues actually solve, how to install Redis, build your first queue/producer/worker, configure retries, delays, priorities, and avoid the beginner mistakes that bite everyone once.
BullMQNode.jsJul 19, 2026API Versioning Strategies That Don't Break Clients
URI, header, media-type, and query-param versioning compared with their real trade-offs, NestJS's built-in versioning support, what actually counts as a breaking change, and how to deprecate a version without burning your clients.
API DesignRESTJul 19, 2026Background Jobs in NestJS with BullMQ: Queues, Retries, and Dead Letters
A practical guide to moving slow work out of the request path with BullMQ and NestJS — processors, exponential backoff, idempotent handlers, repeatable jobs, dead-letter patterns, and the operational details that keep queues healthy in production.
NestJSBullMQJul 19, 2026CI/CD for NestJS with GitHub Actions: Lint, Test, Build, Deploy
A complete GitHub Actions pipeline for a NestJS backend — trigger strategy, pnpm caching, lint/test/typecheck stages, building and pushing Docker images to GHCR with buildx layer caching, and deploying to a VPS over SSH.
CI/CDGitHub ActionsJul 19, 2026Docker Image Optimization: From 1.2 GB to 150 MB
The step-by-step journey of shrinking a Node.js API image by 87% — multi-stage builds, production-only deps, alpine vs distroless trade-offs, .dockerignore, layer ordering, and BuildKit cache mounts.
DockerDevOpsJul 19, 2026HTTP vs gRPC: How They Work, How They Differ, and When to Use Each
A deep dive into HTTP APIs and gRPC — what actually travels over the wire, how Protocol Buffers and HTTP/2 change the game, the four gRPC streaming modes, and a practical decision guide for choosing between them.
gRPCHTTPJul 19, 2026JWT Authentication Done Right in NestJS: Access Tokens, Refresh Rotation & Revocation
A practical guide to building JWT auth in NestJS that holds up in production — short-lived access tokens, refresh token rotation with reuse detection, cookie vs header trade-offs, and revocation strategies that actually revoke.
NestJSAuthenticationJul 19, 2026Kubernetes for People Who Know Docker Compose
A translation guide from Docker Compose to Kubernetes — how services, ports, volumes, and env files map to Deployments, Services, PVCs, and ConfigMaps, with side-by-side YAML and an honest take on when you don't need k8s at all.
KubernetesDockerJul 19, 2026Monitoring a Node.js Backend with Prometheus & Grafana
How I instrument NestJS services with prom-client, which metrics actually predict outages — p95s, event-loop lag, pool saturation — and how to build Grafana dashboards and alerts that only fire when something is truly wrong.
MonitoringPrometheusJul 19, 2026Nginx as a Reverse Proxy: The Config Nobody Explains
An annotated, production-shaped Nginx config — location matching, the proxy_pass trailing-slash trap, SSL termination with certbot, gzip and caching that actually matter, WebSockets, load balancing, rate limiting, and how to debug 502s.
NginxDevOpsJul 19, 2026N+1 Queries and Other ORM Traps in TypeORM & Prisma
The N+1 problem explained with a concrete example, how to catch it with query logging and APM, the fixes in TypeORM and Prisma — plus the other ORM traps: hydration cost, missing indexes, cartesian explosions, and offset pagination.
TypeORMPrismaJul 19, 2026Transactions & Idempotency: How Not to Double-Charge Your Users
A practical guide to building payment flows that survive retries, timeouts, and webhook redelivery — idempotency keys, database transactions, the outbox pattern, and query-before-retry, with NestJS and Postgres examples.
PaymentsPostgreSQLJul 19, 2026The Complete PayPal Guide for NestJS: Orders, Captures, Vault, Refunds, Subscriptions, Payouts, Disputes & Webhooks
Everything you need to integrate PayPal into a NestJS backend — Orders, Authorize/Capture, Refunds, Voids, Subscriptions, Vault tokenization, Payouts, Disputes, and signed webhook handling.
PayPalNestJSJul 19, 2026PostgreSQL Backups You Can Actually Restore: pg_dump, WAL, and PITR
A practical guide to PostgreSQL backup strategies — logical dumps, physical base backups, continuous WAL archiving to S3, point-in-time recovery, and why a backup you've never restored doesn't count.
PostgreSQLBackupsJul 19, 2026Rate Limiting a NestJS API: Token Buckets, Sliding Windows, and Redis
How I rate limit NestJS APIs in production — the four classic algorithms compared, where @nestjs/throttler stops being enough, atomic Redis counters, choosing between per-IP and per-key limits, and returning 429s clients can actually cooperate with.
NestJSRate LimitingJul 19, 2026RBAC vs ABAC in NestJS: Roles, Permissions, and Guards That Scale
Why plain role checks quietly rot into an unmaintainable mess, how permission-per-action and attribute-based access control fix it, and how to build the guards and decorators in NestJS.
NestJSAuthorizationJul 19, 2026Redis Caching Strategies in NestJS: Cache-Aside, Invalidation, and the Traps
A working guide to caching with Redis in NestJS — cache-aside vs write-through vs write-behind, TTL selection, invalidation strategies, stampede protection, and the situations where a cache quietly makes everything worse.
RedisNestJSJul 19, 2026REST API vs RESTful API: What's the Actual Difference?
REST API and RESTful API get used interchangeably, but there's a real distinction hiding underneath — REST's six constraints, the Richardson Maturity Model, and what it takes for an API to genuinely be RESTful.
RESTAPI DesignJul 19, 2026Secrets Management for Backend Teams: Beyond the .env File
Why .env files in production are a liability, the tiers of secrets management from platform env vars to Vault, runtime injection patterns in NestJS, rotation without redeploys, and what to actually do after a leak.
SecurityDevOpsJul 19, 2026Self-Hosting vs Managed Services: An Honest Cost Breakdown
A realistic monthly cost comparison between a VPS running Docker and the managed-services equivalent — including the hidden costs on both sides that the pricing pages never mention.
DevOpsCloudJul 19, 2026Structured Logging & Distributed Tracing with Pino and OpenTelemetry
Why console.log stops working the day you run two services, how I set up Pino for structured JSON logs with propagated request IDs, and how OpenTelemetry traces stitch one request's journey across every service it touches.
LoggingOpenTelemetryJul 19, 2026WebSockets vs Server-Sent Events vs Polling: Choosing Real-Time Transport
How polling, long polling, SSE, and WebSockets actually work over HTTP, what each one costs to scale, and a practical decision guide for picking the right real-time transport for your feature.
WebSocketsSSEJul 19, 2026Zero-Downtime Database Migrations: The Expand/Contract Pattern
How to ship schema changes to a live Postgres database without locking tables or breaking rolling deploys — the expand/contract pattern step by step, batched backfills, and the Postgres gotchas that bite in production.
PostgreSQLMigrationsJul 19, 2026Zero-Downtime Deployments: Health Checks, Graceful Shutdown, and Draining
Why deploys drop requests and how to stop it — readiness vs liveness checks with @nestjs/terminus, SIGTERM handling and graceful shutdown in Node, connection draining, and choosing between rolling, blue-green, and canary rollouts.
DevOpsDeploymentJul 18, 2026Ubuntu Shortcut Keys and Productivity Tips Every Developer Should Know
A practical cheat sheet of Ubuntu (GNOME) keyboard shortcuts, terminal tricks, and lesser-known settings that speed up daily work.
UbuntuLinuxJul 15, 2026Integrating bKash Payment Gateway in NestJS: A Practical Guide
How to wire up bKash's tokenized checkout API in a NestJS backend — grant token, create payment, execute, verify, and handle webhooks without losing money to edge cases.
bKashNestJSJul 15, 2026Building Scalable Apps with NestJS Microservices: Patterns, Transports, and Deployment
A practical guide to splitting a NestJS monolith into microservices — choosing transports, designing an API gateway, and shipping it to production.
NestJSMicroservicesJul 15, 2026Multi-Tenant SaaS Across Multiple Domains: NestJS Backend + Next.js Frontend + One Admin Panel
How I built a SaaS where every customer gets their own domain (subdomain or custom), managed entirely from a single admin panel — without forking the codebase.
SaaSNestJSJul 15, 2026The Complete Stripe Guide for NestJS: Payments, SetupIntents, Refunds, Disputes, Payouts, Subscriptions & More
Everything you need to integrate Stripe into a NestJS backend — PaymentIntents, SetupIntents, refunds, reversals, captures, subscriptions, payouts, Connect, disputes, multi-card storage, autopay, and webhook handling.
StripeNestJSJul 13, 2026Deploying a Next.js + NestJS Monorepo with Docker: A Practical Guide
How I containerize and deploy a Next.js frontend and NestJS backend from a single monorepo, with separate images and a shared Docker Compose setup.
NestJSNext.jsMay 19, 2026git-ai-pilot: Automate Your Git Workflow with AI Commit Messages & Security Scanning
An open-source CLI that writes conventional commit messages with AI and blocks secrets from being committed — one command for the whole git workflow.
GitAIMay 19, 2026nestjs-api-forge: Stop Writing API Response Wrappers by Hand
How nestjs-api-forge standardizes API responses, errors, and pagination in NestJS so you never hand-write another wrapper.
NestJSTypeScriptMay 19, 2026NestJS vs Express: Which One Should You Choose in 2025?
A practical comparison of NestJS and Express — architecture, TypeScript support, performance, ecosystem, and which one fits your project.
NestJSExpressNov 30, 2025Mastering Prisma ORM with NestJS: Installation and Connection Troubleshooting
A step-by-step guide to installing Prisma in a NestJS project and fixing the database connection issues that trip people up.
PrismaNestJSOct 12, 2024Unlocking VS Code: The Ultimate Cheatsheet for Developers
A handy cheatsheet of VS Code shortcuts, commands, and features that significantly speed up daily development work.
VS CodeProductivitySep 29, 2024Git Cheatsheet That Will Make You a Master in Git
The essential Git commands for everyday work — branching, merging, rebasing, undoing mistakes, and collaborating — in one cheatsheet.
GitGitHubAug 2, 2022Create a Personal Portfolio Using the GitHub API — with a Blog
Build a personal portfolio that stays up to date automatically by pulling your projects from the GitHub API, with a blog included.
GitHub APIPortfolio