Notes on cloud infrastructure, AI engineering, full-stack systems, and things that surprised me in production.
No RAG, no vector database, a wiki an LLM writes and he rarely touches. It's a genuinely good pattern, and it only works because being wrong costs nothing.
One Linear integration burns ~12,800 tokens before a single call. A real tenant-isolation flaw hit 1,000 companies. The protocol isn't the problem, what you plugged into it is.
A controlled study across 35 releases of five coding agents found no quality improvement tied to harness updates, and nearly double the token cost. The model was the same the whole time.
You can't filter your way out of prompt injection, it's an open problem. What you can control is what happens after an agent gets manipulated. Most teams design for the wrong half.
Vibe coding isn't a junior-dev problem anymore, seniors are doing it too. The tests pass, the diff looks fine, and nobody actually read it. Here's what that costs you.
No breach, no exploited CVE, no unauthorized database access. Someone processed a data request from an email that looked official. That's a scarier failure mode, not a smaller one.
Every leaderboard tutorial reaches for ORDER BY. At 100K concurrent users submitting scores, that is a full table scan on every request. Redis sorted sets solve this in O(log n) with five commands.
A single Redis node rate limiter is clean and correct. Add a second node and counting breaks, atomicity breaks, and your limits become suggestions. Here's what actually happens and how to fix it.
Stateful vs stateless, implicit denies, ephemeral ports, IPv6 gaps, the real gotchas in EC2 security group rules that caused me actual production pain.
AI code editors are incredible. They're also quietly turning developers into prompt engineers who can't think through a problem anymore. That scares me.
Cache invalidation is genuinely hard. Not 'ha ha the joke problem' hard, actually hard in production. Here's a real incident, the race condition that caused it, and what actually fixed it.
IP-based limits, X-Forwarded-For spoofing, the fixed window 2x burst hole, and why most rate limiting implementations give you false confidence.
CORS is enforced by browsers, not servers. curl doesn't care. Postman doesn't care. Your attacker's script doesn't care. Here's what CORS actually does and what protects your API instead.
You fixed the N+1 query. Congratulations. Now your eager loading is doing cartesian explosions, memory bloat, and ghost queries you didn't know existed. ORMs give you more ways to shoot yourself.
You wrapped it in a transaction. The data is still inconsistent. Isolation levels, phantom reads, and why 'serializable' is theater in most database configs.
You added the index. The query is still slow. Here's why Postgres doesn't care about your feelings, or your indexes.
Not another 'SQL vs NoSQL' think piece. A real project decision from 2025, the constraints, the tradeoffs we evaluated, the choice we made, and the two cases where I'd flip it.
