Engineering Notes
Code is abundant now. Architecture, maintainability, and staying true to what the application is for are still the hard part.
All
AI-Assisted Development
Engineering Practice
Infrastructure and Operations
Search and Marketing Engineering
Security
AI agent skills
AI-assisted development
APIs
AWS
Accountability
Architecture
Async
Authorization
Automotive
Background Workers
Backups
Claude
Code Quality
Consent
Content Maintenance
Content pipelines
Crawlers
Data Isolation
Debugging
Disaster Recovery
Django
Docker
Email
Engineering Practice
Error Handling
GA4
Google Ads
Grafana
IMAP
Image Processing
JSON-LD
JavaScript
Job Queues
Landing Pages
Local SEO
Logging
Mailcow
Migrations
Monitoring
Multi-tenant
OAuth
Observability
Opinion
Performance
PostgreSQL
Pre-signed URLs
Production
PromQL
Prometheus
Python
React
Releases
Reliability
S3
SKIP LOCKED
SMS
Search Console
Security
Staging
Technical SEO
Testing
Tooling
Triage
Twilio
Uploads
Validation
Webhooks
Workflow design
Security
Twilio Messaging With Per-Company Keys
Why each company in a multi-tenant app sends text messages with its own Twilio credentials, how webhooks find the right tenant, and how consent is enforced.
Oct 14, 2026
Read more →
Security
Private S3 Storage With Pre-Signed URLs
A private S3 bucket is not an authorization system. The application decides who may see a file, then hands out a short-lived pre-signed URL.
Oct 14, 2026
Read more →
Security
Multi-Tenant Data Boundaries in PostgreSQL
In a multi-tenant app, the company ID must never come from the request body. How I enforce company boundaries in queries and why it also makes changes easier.
Oct 14, 2026
Read more →