Engineering Notes

Code is abundant now. Architecture, maintainability, and staying true to what the application is for are still the hard part.

All AI-Assisted Development Engineering Practice Infrastructure and Operations Search and Marketing Engineering Security
AI-assisted development APIs AWS Accountability Architecture Async Authorization Automotive Background Workers Backups Code Quality Consent Content Maintenance Crawlers Data Isolation Debugging Disaster Recovery Docker Email Engineering Practice Error Handling GA4 Google Ads Grafana IMAP Image Processing JavaScript Job Queues Landing Pages Local SEO Logging Mailcow Migrations Monitoring Multi-tenant OAuth Observability Opinion Performance PostgreSQL Pre-signed URLs Production PromQL Prometheus React Releases Reliability S3 SKIP LOCKED SMS Search Console Security Staging Technical SEO Testing Tooling Triage Twilio Uploads Webhooks Clear tag
Security

Twilio Messaging With Per-Company Keys

Why each company in a multi-tenant app sends text messages with its own Twilio credentials, how webhooks find the right tenant, and how consent is enforced.

Oct 14, 2026 Read more →
Security

Private S3 Storage With Pre-Signed URLs

A private S3 bucket is not an authorization system. The application decides who may see a file, then hands out a short-lived pre-signed URL.

Oct 14, 2026 Read more →
Security

Multi-Tenant Data Boundaries in PostgreSQL

In a multi-tenant app, the company ID must never come from the request body. How I enforce company boundaries in queries and why it also makes changes easier.

Oct 14, 2026 Read more →
Infrastructure and Operations

Email Connections That Survive Auth Expiry

Email in a multi-tenant app has two readers and several providers with different login lifetimes. This is how I kept sync reliable and what happens after three failures.

Oct 14, 2026 Read more →