Own the Architecture, Not the Implementation
AI made code cheap to write. It did not make complexity free to own. Where I've landed on overengineering, maintenance and what an engineer is actually responsible for now.
boringtech
Engineering notes on APIs, data infrastructure, automation and the AI systems built on top of them.
recent posts
The Bot That Audited My Rate Limiter
A script sprayed junk at my scan API and got 40 requests past a 3-per-week limit in one second. Tracing why led to a race condition, four siblings of the same bug, and a brute-force limiter that had never worked at all.
Ship the Checks With the Code
After a lot of web projects, I keep doing quality checks after I push. Performance, SEO, image sizes and accessibility should be checked before a change lands, as a default part of every project, not an audit you remember to run later.
I Tested My Own SSRF Guard and [::1] Walked Straight Through
Two of my products fetch URLs that users give them. While writing about server-side request forgery, I threw a list of tricky addresses at my own guard. The URL parser was hiding the bug.
My Security Scanner Was Grading the Firewall, Not the Site
Sites behind Vercel's bot protection got failing grades for headers they had set correctly. The fix: detect when you reached a wall instead of the site, and grade only what you actually saw.
Nigeria’s AI Ambition Needs a Data Foundation
We should invest aggressively in AI. But not every problem is an AI problem, and AI can't make up for digital infrastructure we haven't built.
Fix the Page, Not the API
A homepage that needed 19 API calls loaded one section at a time. GraphQL would have meant redesigning the API. Precomputing each page at the edge fixed the speed, and then quietly survived an outage and a bot flood.
Build It Like You Might Kill It
My first prototype ran on production-grade AWS infrastructure, cost $400 a month, and Google indexed none of it. What I learned about prototyping cheaply, and why AI made the cheaper design possible to build.
Payment Webhook Handlers That Survive Retries, Duplicates and Forgeries
A webhook handler that works in a demo can lose money in production. Six rules for handling payment notifications, with code, and how to test each one without a tunnel.
Make Your AI Tools Say What They Don't Know
Lessons from building an MCP server over Nigerian news and data: an empty result is an answer, and a model will believe whatever your tool implies.
A Green Checkmark Is Not Evidence
My scrapers reported 100% success for weeks while inserting nothing. Here is how I changed monitoring to check what a pipeline produced, not whether it exited cleanly.