A helper that caches whatever your loader returns will happily cache an empty array you only returned because the upstream timed out.
4 min read
- caching
- postmortem
- nestjs
Writing
Short posts on what I'm shipping at work and on side projects — the bug that took two days, the choice between two tools, and the stuff I wish I'd known sooner.
Read the row, check the counter, increment it, save. Under concurrent requests every read sees the same value and the cap never fires — which makes a six-digit OTP brute-forceable.
4 min read
- security
- postgres
- concurrency
- postmortem
A double-grant race survived a test suite that covered it — because the test set up the exact state in which the bug cannot happen.
4 min read
- testing
- stripe
- concurrency
- postmortem
Why this blog exists and what to expect here.
1 min read
- meta