Security
The CORS Wildcard That Was Not Actually Safe
The origin header echoed back whatever the request sent and the credentials flag was on, so any site could read the authenticated response on the user's…
Rohit Bhadani
I write about why software breaks and how people figure it out. Founder of Krova Cloud, building isolated microVMs on our own hypervisor. Years of Shopify theme work and shared hosting before that. If I have not reproduced it, I do not publish it.
Performance
The Four Megabyte Hero Image the CMS Never Resized
The upload was stored once at full size and served as-is to every device, so the largest element on the page was also the slowest, and it blocked the render…
DevOps
The Node That Evicted Everything Because Logs Filled the Disk
Container logs grew without rotation until the node hit disk pressure, and the kubelet evicted every pod on it, including the healthy ones, and the eviction…
Tooling
Reading EXPLAIN ANALYZE Like a Map Rather Than a Wall
The plan output looked like noise until the nested loops were read as a route and the row estimate gap pointed straight at the missing statistic, and the…
Code Review
Reviewing the Cache Key That Forgot the Locale
The cached fragment was keyed on the path only, so the first visitor's language was served to every subsequent visitor, and the mismatch looked like a…
Opinion
One-Person On-Call Is Not a Rotation
A single person carrying the pager has no backup when they are ill, asleep or wrong, and the absence of a second human turns every incident into a personal…
Deep Dive
Why the TLS Handshake Cost Three Round Trips and How to Lose Two
The first request paid for DNS, the TCP connect and a full TLS 1.2 negotiation before a single byte of the response arrived, and the round trips were the…
Bug Hunt
The Coupon That Applied Twice When the Customer Retried
The checkout request timed out but the server had already applied the discount, so the retry applied it again, and the order total went below the coupon's…
Error Autopsy
The Idle Transaction That Held the Lock for Six Hours
A connection checked out from the pool was never committed, so the transaction sat idle holding a row lock, and everything behind it queued until the pool…
Ecommerce
The Recommendations That Learned the Sale and Never Unlearned It
The model trained on the promotion window kept pushing discounted lines after the sale ended, and the margin was the difference between what it recommended…
Security
The Training Export That Included Every Tenant's Rows
The dataset query had no tenant filter, so the fine-tuning set contained other customers' records, and the model learned them, and the model answered them…
Performance
The Batch Job That Paid Full Price for One Call at a Time
The nightly job sent each record separately with the same system prompt, so the shared prefix was billed eight thousand times instead of once, and the bill…