Engineering Notes
Code is abundant now. Architecture, maintainability, and staying true to what the application is for are still the hard part.
All
AI-Assisted Development
Engineering Practice
Infrastructure and Operations
Search and Marketing Engineering
Security
AI-assisted development
APIs
AWS
Accountability
Architecture
Async
Authorization
Automotive
Background Workers
Backups
Code Quality
Consent
Content Maintenance
Crawlers
Data Isolation
Debugging
Disaster Recovery
Docker
Email
Engineering Practice
Error Handling
GA4
Google Ads
Grafana
IMAP
Image Processing
JavaScript
Job Queues
Landing Pages
Local SEO
Logging
Mailcow
Migrations
Monitoring
Multi-tenant
OAuth
Observability
Opinion
Performance
PostgreSQL
Pre-signed URLs
Production
PromQL
Prometheus
React
Releases
Reliability
S3
SKIP LOCKED
SMS
Search Console
Security
Staging
Technical SEO
Testing
Tooling
Triage
Twilio
Uploads
Webhooks
Security
Twilio Messaging With Per-Company Keys
Why each company in a multi-tenant app sends text messages with its own Twilio credentials, how webhooks find the right tenant, and how consent is enforced.
Oct 14, 2026
Read more →
Security
Private S3 Storage With Pre-Signed URLs
A private S3 bucket is not an authorization system. The application decides who may see a file, then hands out a short-lived pre-signed URL.
Oct 14, 2026
Read more →
Security
Multi-Tenant Data Boundaries in PostgreSQL
In a multi-tenant app, the company ID must never come from the request body. How I enforce company boundaries in queries and why it also makes changes easier.
Oct 14, 2026
Read more →