Engineering notes
Notes from a lead engineer on what changed in AI tooling, security and the web stack, and what I would actually do about it.
87 postssince 2024
LatestFeatured
Anthropic and OpenAI launched Opus 5.5 and GPT-6 Sol on the same day, both pitched on cost per task, which makes cache hit rate the number to check before switching defaults.
4 min read
4 min read
Plugin4Shell showed Claude Code, Codex, Copilot and Gemini CLI pinned plugins by commit but never checked what Git actually checked out. What to update, audit and fix.
4 min read
Node.js 26.9.0 turns node:ffi on by default while node:bench, Web Workers and VFS module loading stay behind flags, which matters for code review, version pinning and production.
4 min read
A mass-scanning campaign is probing exposed Vite dev servers via CVE-2026-39364 for .env files, cloud credentials and Terraform state. Here's what I'd check across a team's repos and hosts.
5 posts
React 19.3 makes View Transitions and Fragment refs stable, but browser() and Trusted Types support are the changes I would put on a team's list this week.
4 min readReactSecurityFrontend
.NET 11 RC1 ships with a go-live license and stable C# 15 unions. What go-live really means, why reproducible container images matter, and what I would check first.
4 min read.NETC#Containers
Claude agents wrote a 13-million-line Lean proof of Fermat's Last Theorem in 11 days; its shared task graph, separate statements and strict checker carry over to multi-agent coding.
4 min readAIAI AgentsLean
GPT-6 Astra reached GitHub Copilot a day after launch. What shipped, why Copilot's default model enablement matters, and how to test it on your own repo before switching.
4 min readAILLMGitHub Copilot
Fable 5.1 cuts cache reads 75% to $0.25 per million tokens. For coding agents, hit rate now matters more than list price, and the way you structure prompts decides the bill.
4 min readAIAnthropicPrompt Caching
12 posts
htmx 4.0 makes inheritance explicit and swaps error responses, but the real lesson is the rollout: latest stays on 2.x, a checker ships, and key behaviors get revert flags.
4 min readhtmxFrontendJavaScript
Kubernetes v1.37 turns on HPA scale to zero, Memory QoS and etcd streaming by default. What platform teams should pilot now, and what to check in the upgrade notes first.
4 min readKubernetesDevOpsPlatform Engineering
Next.js 16.3.3 and 15.5.24 fix two critical unauthenticated RCEs: an AVIF bug via sharp and libheif, and a Windows-only router bug. Here is what I would check first.
4 min readNext.jsSecuritySupply Chain
Bun 1.4 is the first release written in Rust after an 11-day port from Zig; here is what made that safe and how to read its Node.js compatibility numbers.
4 min readBunRustNode.js
Stripe agreed to acquire OpenRouter, a sign that token routing is becoming a money problem and a reason to keep your own seam over any model router.
4 min readAILLMPayments
Linux 7.2 shipped on schedule after a heavy final week. Torvalds's answer to AI-driven patch volume is a fixed date and routine reverts, and product teams should copy both.
4 min readLinuxOpen SourceAI
Gemini 3.7 Flash landed three weeks after 3.6 Flash with an introductory price that doubles in 2027, so the real work is an eval harness and routing layer that can absorb new models fast.
4 min readAIGeminiAI Agents
PostgreSQL 18.6, 17.11, 16.15, 15.19 and 14.24 fix 28 vulnerabilities, several in psql and pg_dump, so patching servers is not enough if CI and backup images still ship old clients.
4 min readPostgreSQLSecurityDatabases
Meta's Muse Glimmer is a 30B Apache 2.0 agent model whose 4-bit build targets 24 GB; here is what its numbers say about a private, local tool-calling loop.
4 min readAIOpen ModelsLocal AI
Claude Code makes auto mode the default on Pro, Max and Team from August 14 and adds cross-session messaging and self-hosted runners. What a team should decide first.
4 min readAIClaude CodeAI Agents
A Mini Shai-Hulud variant spread through 400+ npm packages as ordinary-looking patch bumps. The baseline I want now: npm 12 script approvals, a release-age soak and lockfile-only CI.
4 min readSecuritySupply Chainnpm
Next.js 16.3 splits into gains you get just by upgrading and an opt-in Instant Navigations migration; here is how I would plan both, and what the new AGENTS.md block means for teams.
4 min readNext.jsReactPerformance
13 posts
Node.js v26.5.1, v24.18.1 and v22.23.2 fix 11 CVEs, three of them in the Permission Model. Why --permission is not a sandbox for agent code, plus an HTTP/2 and mTLS upgrade checklist.
4 min readNode.jsSecurityHTTP/2
The new MCP spec drops the handshake and sessions, adds routable headers and cache hints, hardens auth, and puts Roots, Sampling and Logging on a deprecation clock.
4 min readAIMCPArchitecture
Redis shipped seven security releases after authenticated RESTORE exploits went public, so here is why "authenticated" is not a mitigation and which ACL change to make now.
4 min readRedisSecurityDatabases
Claude Opus 5 keeps Opus 4.8 pricing, but thinking is now on by default and disabling it at xhigh or max effort returns a 400, so check both before swapping the model ID.
4 min readAIAnthropicClaude Code
Next.js 16.2.11 and 15.5.21 fix four high and five medium CVEs in the first scheduled security release. Here's how I'd triage them and plan around the roughly monthly cadence.
4 min readNext.jsSecurityReact
Vue 3.6 RC completes Vapor Mode, Nuxt 4.5 moves to Vite 8 with experimental SSR streaming, and Nuxt 3 reaches end-of-life on July 31. Here is what I would check first.
4 min readVueNuxtFrontend
Poisoned @asyncapi packages shipped through a legitimate trusted-publishing pipeline with valid provenance, and ran at import time, past --ignore-scripts. What to check this week.
4 min readSecuritySupply Chainnpm
C# unions now compile without boilerplate and flow through System.Text.Json, ASP.NET Core and OpenAPI, while automatic CSRF protection changes which cross-origin requests apps reject.
4 min read.NETC#ASP.NET Core
TypeScript 7.0 brings the Go-native compiler and typically 8-12x faster full builds, but the new defaults and the missing API, expected in 7.1, are where the real migration work is.
4 min readTypeScriptDeveloper ToolsBuild Performance
OpenAI's GPT-5.6 Sol, Terra and Luna are generally available, built for multi-agent fan-out and billing cache writes at 1.25x the input rate, so check your agent harness.
4 min readAIOpenAICoding Agents
OpenSSH 10.4 fixes sftp and scp bugs a malicious server could exploit, tightens re-keying, and adds experimental ML-DSA 44 + Ed25519 signatures. Patch the clients first.
4 min readSecurityOpenSSHDevOps
GitHub Models shuts down on July 30, with brownouts on July 16 and 23, while Copilot CLI now runs in Actions on GITHUB_TOKEN. What to audit, migrate and cap.
4 min readGitHubAICI/CD
Claude Sonnet 5 lands close to Opus 4.8 at a lower price, so the real work is deciding which tasks still need Opus and measuring what the new tokenizer does to your bill.
5 min readAIClaudeCoding Agents
11 posts
Superteam Talent Portal is not just another Solana job board. It is a routing layer where profiles, proof of work, ecosystem signals, active roles, spotlights and hiring workflows connect builders with the right teams faster.
8 min readSolanaWeb3Hiring
Concrete usage notes for Docker, Kubernetes, Kafka, Redis, and Elasticsearch: confirmed Redis use in B2B systems, plus Docker/K8s/Kafka/Elasticsearch platform tooling in Re-Shell.
5 min readDockerKubernetesKafka
What I mean by v0.10 roadmap gates for Quorate: installability, understandable command surface, provider failure handling, and more evidence-backed AI review output.
4 min readQuorateAI ReviewCLI
The Re-Shell VS Code extension now exposes project, command, and template views over the CLI, making microservice and microfrontend workspaces easier to navigate.
4 min readRe-ShellVS CodeCLI
The June Orkhon updates published the project as a model family: a from-scratch PyTorch LLM stack with CI, demo, prompt-routing, and public-site wiring.
4 min readOrkhonLLMPyTorch
How the Jun 13 portfolio arcade update turned the site into a living system with Now Building, Ship Log, Skill Tree, Lab embeds, and real project evidence.
4 min readPortfolioFrontendArcade
My portfolio's projects section had grown into a sixteen-card wall. I ran five terminal coding agents in parallel in isolated scratch directories to redesign it. Three converged on the same answer, two fell over on billing and auth, and the convergence turned out to be the whole point.
7 min readAI AgentsDesignPortfolio
Lessons from shipping a developer CLI fast as a solo maintainer: what pre-1.0 versioning really lets you do, keeping breaking changes honest, the discipline of small frequent releases, dogfooding, and using AI agents without letting quality slip.
7 min readCLIOpen SourceVersioning
How I deploy Next.js standalone output to my own Ubuntu VPS with a systemd unit and nginx, why I rsync artifacts instead of re-provisioning, and what a managed platform buys you that you give up.
7 min readNext.jsDevOpsnginx
For Eşlik Et I run my own Expo Updates server instead of a hosted service. How over-the-air updates work, why I self-host for control and dependency risk, the burden of signing and rollouts, and when hosted is simply the smarter choice.
7 min readExpoReact NativeOTA
KAPiTaN OS is an open-source Linux distribution with a Turkish-language command layer. Why I built it to lower the language barrier for new developers, and why I kept it a thin, honest layer instead of a walled garden.
6 min readLinuxOpen SourceAccessibility
5 posts
Eşlik Et is an events companion app that helps people attend events together. A look at the Expo and Socket.io architecture, real-time matching, and why trust and moderation turned out to be the actual product.
7 min readReact NativeExpoSocket.io
I stopped defaulting to one model and started routing tasks across GLM, Claude, and MiniMax based on cost versus capability. Cheap and fast for high-frequency work, the strongest reasoning for architecture, and a model-agnostic harness to make switching cheap.
7 min readLLMAICost Optimization
For the hard design and refactor questions, I run codex, droid, cline, goose, and kilo in parallel, each in an isolated scratch directory, then synthesize the best ideas. When they converge it is signal; sometimes one outlier has the sharpest take.
7 min readAI AgentsWorkflowCLI
I built Quorate, an open-source CLI that runs several AI models over the same diff as independent reviewers, then synthesizes their verdicts. A council catches what one model misses and punctures false confidence.
7 min readAICode ReviewOpen Source
Why Re-Shell's CLI generates backends across .NET, Java, Rust, Python, and Node.js, and how shared conventions keep five very different ecosystems consistent.
7 min readBackendCode GenerationRust
5 posts
The invisible engineering behind Re-Shell: a pnpm workspace that publishes an npm org cleanly, with shared contracts as the type boundary that keeps packages from drifting.
7 min readpnpmMonoreponpm
Re-Shell is my open-source full-stack platform that unites microservices and microfrontends under one CLI, so I stop re-stitching the same wiring on every project.
7 min readRe-ShellMicroservicesMicrofrontends
Production patterns for MCP server design: transport choices, scoped tool surface, recoverable error messages, auth that does not leak, observability, and knowing when not to build one.
8 min readAIMCPAnthropic
Releasing Meridian, a compact .NET library with a CQRS mediator and object mapper: small public surface, strong test discipline, and a release workflow that ships reliably.
7 min readAIMeridian.NET
A five-axis rubric for evaluating coding agents that survives model releases: correctness, minimality, adherence, verification, and cost, measured across a stratified sample of real tasks.
8 min readAICoding AgentsEvaluation
3 posts
Prompt caching in the Anthropic API pays off when your workload matches its shape: stable system prompts, deterministic retrieval contexts, and batched evaluation — measured, not assumed.
8 min readAIClaude APIPerformance
Designing CodePulse, a privacy-first VS Code time tracker: local SQLite storage, heartbeat-based idle detection, productivity scoring, and how Claude shortened the design loop.
7 min readAICodePulseVS Code
Claude Code vs Codex for real software engineering workflows: when to use each for repository exploration, debugging, implementation, verification, and review.
8 min readAIClaude CodeCodex
1 post
AI-generated code review checklist with diff analysis, verification commands, rollback criteria, and practical examples for shipping safer patches.
7 min readAICode ReviewWorkflow
1 post
AI coding agent guardrails that improve reliability: task briefs, scoped context, permissions, verification commands, and code-level examples for real engineering workflows.
7 min readAIDeveloper ToolsAutomation
1 post
How I led the migration of a decade-old ASP.NET 3.5 WebForms application to React 19 + .NET 10 with Clean Architecture, using the strangler fig pattern to achieve zero downtime.
12 min readReact.NETMigration
1 post
How I architected DigiPort, a React Native 0.82.1 app with Azure AD authentication, SignalR real-time updates, and a custom token manager with circuit breaker, serving 500+ daily active users.
10 min readReact NativeMobileEnterprise
2 posts
A deep dive into how I structure Clean Architecture with CQRS and MediatR 12.4.1 in a production .NET 10 application with 35 controllers and ~200 endpoints.
14 min read.NETClean ArchitectureCQRS
How I built a hybrid authentication system supporting Windows Auth, Azure AD JWT, and session cookies simultaneously, with 16 security middlewares and PII sanitization.
11 min readSecurityAuthenticationAzure AD
1 post
How I implemented a real-time notification system using SignalR in a React Native enterprise app, with automatic reconnection, Redis-backed connection management, and FCM fallback.
9 min readSignalRReact NativeReal-Time
2 posts
A deep dive into two of the leading Chinese LLMs: Zhipu AI's GLM-4.7 and MiniMax 2.1. We compare their reasoning capabilities, coding performance, and cost-effectiveness for enterprise applications.
8 min readAILLMGLM-4
How I structured a React 19 frontend with 18 workflow modules using a convention-based module system, three-layer state management with Zustand and React Query, and consistent patterns across the codebase.
13 min readReactArchitectureTypeScript
2 posts
How I implemented HMAC-signed media URLs to securely serve protected files in img tags, iframes, and download links without requiring Authorization headers.
8 min readSecurity.NETHMAC
A practical playbook for migrating a team from TFS to Git, covering training, repository cleanup, branch strategy, cutover planning, and lessons learned from real-world pitfalls.
7 min readGitDevOpsTeam Leadership
2 posts
A deep dive into why we chose Zustand over Redux for an enterprise mobile banking application — covering async patterns, cross-store communication, and real performance benchmarks.
10 min readZustandReduxReact
How I built a production token manager with circuit breaker pattern, request deduplication, mutex logout, and WebView grace periods for a React Native banking app.
11 min readTypeScriptSecurityDesign Patterns
2 posts
Deep dive into Oracle Database performance optimization in .NET — role-based connection pooling, Dapper vs EF Core benchmarks, array binding for bulk operations, and production tuning strategies.
9 min readOracle.NETDatabase
How TanStack React Query v5 eliminated redundant API calls, reduced server costs by 53%, and improved dashboard load times from 2.1s to 0.9s in our React Native banking app.
8 min readReact QueryTanStackAPI
3 posts
A complete walkthrough of 16 security middlewares in our .NET banking API pipeline — from request IDs to response masking, with performance benchmarks for each layer.
14 min read.NETSecurityMiddleware
A deep dive into creating an interactive 3D furniture customization experience using Babylon.js, React, and TypeScript for Kapsül Mobilya.
12 min readBabylon.jsReact3D
A complete architecture for embedding React web content in React Native with HMAC-signed communication, WebView pooling, and secure token handoff patterns.
10 min readReact NativeWebViewMobile
3 posts
The story behind Re-Shell CLI, an open-source platform for building modern distributed applications with unified microservices and microfrontends.
8 min readOpen SourceCLINode.js
How I built a custom useResponsive() hook for React Native that handles font scaling, device detection, and orientation changes in under 200 lines with zero dependencies.
8 min readReact NativeResponsiveDesign System
How I configured Serilog with 5 dedicated log files, automatic PII sanitization, and daily rolling for a .NET banking API — covering audit trails, security events, and compliance requirements.
9 min readSerilog.NETLogging
2 posts
The story behind building Turkey's developer marketplace from scratch with React, Node.js, MongoDB, and an AI matching engine that serves 40,000+ members.
11 min readNode.jsReactMongoDB
A deep dive into building high-availability infrastructure with HAProxy, Patroni, PgBouncer, etcd, and keepalived to achieve 99.9% uptime for a hosting platform.
10 min readDevOpsHAProxyPostgreSQL
3 posts
The complete story of building Makdos, a hosting platform serving 500-1,000 customers with ~$500K annual revenue, using React, Next.js, Node.js, Python, FastAPI, and PostgreSQL.
12 min readReactNode.jsPython
Essential Linux server management skills every full-stack developer should know, from Nginx configuration to security hardening.
11 min readLinuxDevOpsNginx
A decade-long journey from TV8 intern to senior engineer and team lead, covering the career decisions, technical growth, and leadership lessons along the way.
8 min readCareerLeadershipSoftware Engineering
1 post
Lessons from teaching React and .NET at GoIT and mentoring 8+ junior engineers at POMETOP, covering the gap between tutorials and real-world development.
7 min readMentoringTeachingReact
1 post
A detailed breakdown of how I use Copilot, Claude, ChatGPT, Cursor, Antigravity, and Gemini daily, covering specific workflows, productivity gains, and guardrails.
9 min readAIGitHub CopilotClaude
1 post
Practical strategies for managing freelance projects alongside a full-time senior engineering role, covering time management, context switching, and setting boundaries.
7 min readFreelancingTime ManagementCareer