Life / Backend / Security / Engineering notes

Technology & security

Programming, API design, reliability, security research, AI tooling, and the experiments that make complicated systems easier to inspect.

A space for the things I want to share

Inside this collection

Backend systems

API contracts, request authorization, concurrency and retry design.

Security investigations

Trust boundaries, abuse cases, attacks, defenses, and tests.

Code & experiments

Small implementations I built to reproduce tricky behavior and failure paths.

Hands-on resources & related guides

IoT sensor authentication and replay API replay and authorization testing

Stories / Notes / Work in progress

Notes & stories

The first note belongs here.

No personal technology & security stories have been published in this collection yet. This section automatically fills with my own approved posts, notes, recipes, or build logs as I add them.

Visit the Life notebook

Photography / Original media

Photos & visual notes

A spot for the first photograph

Original photos only, with descriptive captions

Stories behind the images

Details and context, not stock or invented travel photos

Photo entries appear automatically after original pictures and captions are approved and added to the Life notebook.

Engineering / Inspectable examples

Code samples

I wrote these small examples and experiments around controlled inputs. They are separate from private customer work and are not physical hardware demonstrations. Open any sample for its checks, source references, and limitations.

TypeScript / Tested teaching helper

Separate identity from resource authorization

Code & checks

interface Decision { authenticated: boolean; authorized: boolean; integrityOk: boolean }

export function canMutateResource(input: Decision): boolean {
  return input.authenticated && input.authorized && input.integrityOk;
}

A client or attestation verdict cannot grant access to someone else's object.

SQL / Reference example

Scope an idempotency key by tenant

Code & checks

CREATE TABLE operation_requests (
  tenant_id text NOT NULL,
  operation_key text NOT NULL,
  request_fingerprint text NOT NULL,
  status text NOT NULL,
  response_json jsonb,
  created_at timestamptz NOT NULL DEFAULT now(),
  PRIMARY KEY (tenant_id, operation_key)
);

A uniqueness constraint is the foundation for atomic operation claims.

TypeScript / Tested teaching helper

Allowlist safe authentication telemetry

Code & checks

export function authEvent(input: {
  operation: string; outcome: 'allowed' | 'denied';
  token?: string; password?: string;
}) {
  return {
    event: 'auth.decision',
    operation: input.operation,
    outcome: input.outcome
  };
}

Create a structured outcome without recording the input's token or password.

Already on the site / Related material

More to explore

Break It / Fix ItTrigger three synthetic backend flaws, then apply patches.Engineering workbenchInteractive tools, technical references, and labs.Public engineering evidenceWhat can actually be inspected, tested or downloaded.