Notes (06)
Things I've learned shipping.
Short, practical write-ups from real projects: the bugs, the patterns and the decisions behind them.
- 22 Sept 2026Idempotent payment webhooks: fulfil an order exactly oncePayment gateways retry. Your fulfilment code must not. A signature check and one atomic state change are enough to make webhooks safe.2 min read
- 5 Sept 2026Making double-booking impossible at the database levelChecking "is this slot free?" in application code races with itself. A PostgreSQL exclusion constraint makes overlapping appointments unrepresentable.2 min read
- 18 Aug 2026Giving a voice agent tools it can't misuseA conversational agent is an untrusted caller of your API. Validate every argument, keep results short, and make each tool safe to retry.2 min read
- 30 Jul 2026Page transitions in the Next.js App Router with GSAPA cover, a route change, and a reveal. How to orchestrate them reliably, and the three bugs that cost me the most time.2 min read
- 12 Jul 2026Supabase Row-Level Security: the 15-minute mental modelRLS moves "who can see what" out of your API and into the database. Here's the minimum you need to use it safely.2 min read
- 20 Jun 2026Surviving signup spikes with React QueryWhen hundreds of people hit the same page at once, caching is a feature. How stale-while-revalidate keeps your server calm and the UI instant.2 min read