Software engineering, AI systems and technical paper reviews.
One TOML file, read once at startup, and the backend doesn't start if a single key is wrong. Why I picked TOML, how serde does most of the validation, why the log level is an enum, and the error message that printed my whole config file.
An MVP that holds up in a demo with three users isn't an MVP that holds up in production. Plaintext data, broken permissions, a fix that broke five others — what I found opening a codebase built fast with an AI coding tool, and the rule I use now before deciding whether to patch it or rip it out and start over.
Designing a healthcare logging schema on paper is easy. Booting it exposed a hashed-user count that was quietly wrong, a device fingerprint that walked straight past redaction, and a TTL test that proved a caveat I had only written down.
MobiShare's Razor Pages, SignalR hub, and MQTT handler all call the app's own Web API over loopback HTTP instead of in-process — forcing a cookie-forwarding handler and an AsyncLocal hack. An accidental distributed monolith, and what it cost.
app.UseAuthentication() was never called and no API controller had [Authorize]. The whole JSON API was open to anyone. Here's how I found it, and what it actually took to fix it without breaking the app.
Mobishare's chatbot picks which technician gets a repair ticket by feeding a local LLM a small JSON summary and asking for a GUID back. It's a legitimate pattern — undone for months by an Italian/English string mismatch.
Mobishare's vehicle-reservation timer was a singleton service holding one connection ID for the entire app, with expiry driven by client-side JavaScript. Here's why that's a concurrency bug, not a UI detail.
I built a FastAPI service that turns a two-step, rate-limited carrier API into one internal endpoint — token caching, retry logic, order mapping, and an undocumented limit found the hard way.
Mobishare splits every operation into a MediatR command or query, one file each, thin controllers throughout. Here's what that buys you — and the swallowed-exception bug it let slip through.
I write about the backend×AI wedge — wins and failures included. Follow along, or say hi.