Decisions,
not tutorials.
The reasoning behind the tools I build: what the problem was, what I decided, and why. Written from production code, not from theory.
Measuring learning instead of declaring it
A checkbox ticked in January can't tell forty minutes of daily practice apart from opening the topic once and never coming back. I built a tracker that measures the habit, and the three decisions that make it correct are about dates, not UI.
The clientId never comes from the URL
I built a portal where every client sees their projects, their invoices, and their documents. The number one risk wasn't someone getting in without permission: it was someone getting in with their own and seeing somebody else's.
Two logins on one site, and neither knows the other
My admin panel already had authentication solved with OAuth and JWT. When I built the client portal, the hard decision wasn't how to authenticate them: it was not reusing anything that already worked.
Escalating IP blocks without locking myself out
Detecting threats wasn't enough anymore. The portfolio's micro-SIEM gets real enforcement - a TTL that escalates with repeat offenses and honeypots that block on the request itself, not on the next cron.
More than a green scan
Wiring npm audit, CodeQL, and axe-core into a panel of my own with history and dedup - so a security and accessibility scan tells a story instead of showing a checkmark nobody looks at twice.
Mutating my code to find out if my tests actually work
Coverage tells you which lines ran. Mutation testing asks something more uncomfortable - if I break this line on purpose, does any test notice? Plus Zod contracts, so an endpoint can't change shape without anyone realizing.
Scanning any domain without putting your own at risk
Turning a diagnostics endpoint only I could use into a public tool for my classmates - and why that means solving abuse and SSRF first, not the analysis itself.
Charging for field work without the WhatsApp API
Not all my work is code. I needed to charge for on-site tech support from my phone, out in the street, without paying for the WhatsApp Business API or exposing the amount in a link anyone could edit.
E2E tests that check what actually matters
Closing the testing pyramid with Playwright without making it brittle - disposable databases, a sentinel that proves the demo's isolation, and why every test needs its own IP.
Building a micro-SIEM for my portfolio
Scanners hit any site with a public IP, this one included. Instead of ignoring the noise, I built an engine of my own that detects it, classifies it, blocks it, and shows it in public.
RAG - when it fits and how not to ruin it
Retrieval-Augmented Generation isn't magic, and it isn't a replacement for fine-tuning. It's an architectural decision with clear trade-offs - and most failures happen in retrieval, not in the model.
Revocable sessions on top of a stateless JWT
My admin panel used plain JWTs; a stolen cookie was unstoppable until it expired. Here's how I added a device list, remote revocation, and alerts without giving up the JWT.
Chaos engineering that can't hurt you
Injecting failures in production to prove the alerts work - with fail-open, a mandatory TTL, and a panic button, so the chaos can never become a real incident.
SLOs and error budgets for small projects
Uptime as a percentage is misleading. Adapting Google's SRE discipline - SLI, SLO, error budget, and burn rate - to a portfolio of small projects.
Why I built my own uptime monitor
UptimeRobot kept telling me everything was fine while production served the wrong page. So I wrote the check engine I actually needed.