Writing

Notes from the trenches

Zero trust by default: why perimeter security is dead

Assuming safety inside your corporate network is how breaches happen. Here is how to build applications that verify everything.

Read post →

Building resilient backends: rate limiting, circuit breakers, and graceful degradation

Uptime isn't about avoiding failure—it's about making sure one failing service doesn't take down your entire application.

Read post →

Auth done right: sessions, tokens, and the middle path

JWT vs sessions is the wrong question. Here's how I actually secure auth flows in full-stack apps.

Read post →

Why I attack my own code before shipping it

A practical walkthrough of the adversarial checklist I run against every feature before it reaches production.

Read post →