// writing
What we learn from running production.
Notes from the systems we build and keep running, written up as they happen.
Content modeling, not custom post types
When a full CMS earns its place, when content collections in a static site are the better call, and how to actually decide
Sentiment analysis on social media, then and now
The classical bag-of-words classifier this article originally described is obsolete. Here's how the same task is done with language models, and where a classical model still wins
Motivating a distributed team of senior engineers
Autonomy, ownership, written communication and fair on-call replace the office-culture advice that doesn't survive a remote, senior team
Should designers code?
The question is still live, but design tokens, design systems, and AI tooling have moved where the real boundary sits
Safe connections for apps
TLS by default, why certificate pinning can backfire, and what changed about keeping secrets out of a mobile client
Token authentication, done the way it should be in 2026
Short-lived access tokens, rotating refresh tokens, and why you should almost never write this yourself
How to make a perfect responsive website, in 2026
Breakpoint-era advice is obsolete. Fluid type, container queries, and Core Web Vitals are what responsive design actually means now
Migrating data between systems without losing it
What a bbPress forum migration taught us about idempotency, reversibility, and verification — the parts that generalize to any system cutover
Background message interception using Windows hooks, a practical example
What input hooking actually does, why endpoint protection treats it as a red flag, and where it's still a legitimate technique
Keeping a payments API online through a DDoS attack
How we detected, contained and mitigated an attack on a live payments API — and what we hardened afterward
Testing money systems
What deserves a test, what does not, and why integration tests run inside a rolled-back transaction
Taking over a stalled codebase
What the first two weeks look like, and what we refuse to do
Minting NFTs without charging users gas
Layer-2 minting, IPFS metadata, and an event-driven mint pipeline
Stablecoin payments in production
Confirmations, reorg risk, and why non-custodial design simplifies compliance
Observability for event-driven systems
The four dashboards to build before you need them
Daily reconciliation
The boring job that catches what monitoring misses
Idempotency in payments
Why every money-moving endpoint needs an idempotency key, and how to implement one correctly
Making LLM features testable
Structured outputs, evaluation sets, regression tests, and cost ceilings for an LLM feature you actually trust in production
Running an LLM on your own hardware
When self-hosting beats an API call — data residency, cost at volume, latency — and the operational price you pay for it
Human-in-the-loop AML
Where an LLM genuinely helps in compliance review, and where it must never be the decision-maker
What PCI DSS actually asks of your architecture
Tokenization, scope reduction, and never storing raw card data — the architectural questions, not the audit theater
One API, many processors
Designing the adapter boundary so adding the eighteenth processor changes no caller
The transactional outbox
How to stop losing events when a process dies between the database commit and the message publish
Enforcing compliance in CI
Why a build should fail when a money-movement command skips its identity gate, and how to write that check
No articles match that tag.
30 minutes with a senior engineer.
Tell us what you're building. You'll leave with an honest opinion, even if it's "you don't need us."
Reference calls with past clients are available under NDA during evaluation.