Software engineering, AI systems and technical paper reviews.
MobiShare's Razor Pages, SignalR hub, and MQTT handler all call the app's own Web API over loopback HTTP instead of in-process — forcing a cookie-forwarding handler and an AsyncLocal hack. An accidental distributed monolith, and what it cost.
app.UseAuthentication() was never called and no API controller had [Authorize]. The whole JSON API was open to anyone. Here's how I found it, and what it actually took to fix it without breaking the app.
Mobishare's chatbot picks which technician gets a repair ticket by feeding a local LLM a small JSON summary and asking for a GUID back. It's a legitimate pattern — undone for months by an Italian/English string mismatch.
Mobishare's vehicle-reservation timer was a singleton service holding one connection ID for the entire app, with expiry driven by client-side JavaScript. Here's why that's a concurrency bug, not a UI detail.
I built a FastAPI service that turns a two-step, rate-limited carrier API into one internal endpoint — token caching, retry logic, order mapping, and an undocumented limit found the hard way.
Mobishare splits every operation into a MediatR command or query, one file each, thin controllers throughout. Here's what that buys you — and the swallowed-exception bug it let slip through.
I write about the backend×AI wedge — wins and failures included. Follow along, or say hi.