field notes

build
log.

Notes from the keyboard on full-stack engineering and security tradecraft — what actually ships, what breaks in production, and what gets baked into every client build whether they asked for it or not.

[ 01 // POSTS ]
latest writing
2026-09-22
How to Secure a SaaS Before Launch
The practical release review for authentication, APIs, payments, secrets, dependencies, and recovery before real users arrive.
security
2026-09-22
JWT Authentication Mistakes That Ship to Production
Token lifetime, storage, refresh rotation, authorization boundaries, and the small shortcuts that become expensive incidents.
security
2026-09-22
What a Small Business Website Rebuild Should Actually Include
A rebuild is more than a new look: clarify the offer, connect the customer path, wire the operations, and make ownership easier.
business
2026-06-26
How I Scope a Project Before Writing Code
Why I never quote from a one-line brief — the discovery questions, scope boundaries, and assumptions that turn a vague idea into a buildable plan, and why that protects the client more than it protects me.
process
2026-06-26
Why I Build on Cloudflare Workers
Edge-first architecture, D1 at the data layer, and no servers to patch — why Workers is the default platform for most builds, plus the honest tradeoffs that come with it.
architecture
2026-06-26
Shipping Without a Build Step
No bundler, no CI artifact, no node_modules in production — why a deliberately build-free architecture makes small-business sites faster to ship, easier to debug, and cheaper to own.
deployment
2026-06-26
The Security Baseline Every Project Gets
Helmet, rate limiting, JWT done right, parameterized queries, secrets locked down tight — the checklist that goes into every build from the first commit, not bolted on before launch.
security
[ 02 // NEXT_ACTION ]
turn notes into momentum

If one of these notes describes the problem in front of you, jump straight to the matching path. The full services catalog is still available from the home page.

launch a product MVP, web app, mobile product, or SaaS that needs a clear path to release. harden the risk Authentication, APIs, payments, secrets, and application security before launch. improve the system A website rebuild or integration plan focused on clearer customer action and easier operations.