DJDevy Jonesindevyjones.hashnode.dev·15h ago · 5 min readFinding Exposed APIs and Services: A Practical Guide for DevelopersAs developers, we're constantly building and deploying applications, often exposing APIs and services to the internet. While this is essential for functionality, it also introduces security risks. Uni00
QQnaydsinai-guide.hashnode.dev·1d ago · 7 min readFrom Prompt to Product: A Beginner-Friendly Way to Add AI to a Web AppAI features are becoming common in web applications. A search box can understand natural language, a support page can answer questions, and a writing tool can generate a first draft. What looks simple00
OBOliver Bloominoliver-bloom-musings.hashnode.dev·2d ago · 6 min readWhat Are Some Alternatives to Building Your Own Email Sending Infrastructure for Product Notifications?For sending product notifications — usage alerts, plan-limit warnings, single-user status updates — without building your own mail server, the main alternatives fall into three categories: managed tra00
PEPaymos Engineeringinpaymos-engineering.hashnode.dev·Aug 23 · 5 min readYour webhook sender is an SSRF gadgetMost writing about webhook security is about the receiving end. Verify the signature, compare in constant time, reject a stale timestamp. All correct, all about the wrong direction for the problem I w00
RRulestackinrulestack.hashnode.dev·Aug 23 · 4 min readCreating Bluesky starter packs from code: three AT Protocol records and one non-idempotency trapBluesky starter packs look like a single thing in the app — a shareable page that lets a new user follow a curated group in one tap. At the protocol level they are three separate records glued togethe00
DSDoogal Simpsonindoogal.dev·Aug 21 · 4 min readWhy Scaling Software Is an Organizational ProblemTL;DR: I've realized that scaling software development is fundamentally an organizational coordination problem, not a technical one. Just like multiple authors trying to write cohesive chapters of a s30
Ddafa6inframe-budget-notes.hashnode.dev·Aug 21 · 6 min readOne parameter, three contracts: the API field that changes meaning by endpointHere is an API design problem I ran into recently that I have not been able to stop thinking about, because every option for fixing it is worse than it looks. A media generation API has three creation00
DJDevy Jonesindevyjones.hashnode.dev·Aug 20 · 4 min readFinding Exposed APIs and Services: A Practical Guide for DevelopersAs developers, we're constantly building and deploying services, often exposing APIs to the wider internet. While necessary for functionality, this also introduces potential security risks. Understand00
PEPaymos Engineeringinpaymos-engineering.hashnode.dev·Aug 16 · 7 min readDuplicate webhooks are the contract, not the bugA payment webhook is not a message. It is a delivery attempt. Paymos makes 11 of them per event: one initial call and ten retries, spaced 1m, 2m, 4m, 8m, 16m, 32m, 1h, 2h, 4h, and 8h, for a window of 00
VSVibe Seekerinvibeseeker.hashnode.dev·Aug 14 · 13 min readOne Inline Button for Everyone: Parameters, Authentication, and Callbacks in a Telegram Mini AppThe code examples in this series are written in C#/.NET 10 (since that's what our production uses), but this article is about Telegram mechanics, not the language. The exact same architecture can be b00
