Writing
Long-form essays on distributed systems, blockchain architecture, security, and the craft of building reliable software. I write to think clearly.
Our admin dashboard was loading slowly. We blamed it on a complex query. The real culprit was a silent N+1 problem in Sequelize that was generating one database query per user — and we had 3,000 users. Here is how we found it, what it looked like in the ORM layer, and how a single `include` option fixed it.
One misconfigured AWS security group inbound rule. That is all it took to expose our internal admin API — with no authentication — to the public internet for 11 days. We only discovered it during a routine audit. Here is the full story and how we locked down our AWS infrastructure for good.
We had a bug that corrupted investment records silently for 3 weeks. No audit trail. No way to replay what happened. That was the day we decided to rebuild our transaction core with event sourcing. Twelve months later: here is what it looks like in production, what the migration cost us, and whether it was worth it.