Writing

Notes from production software work.

Practical write-ups on software performance, architecture, and the trade-offs behind interfaces that hold up under real usage.

Level: Advanced12 min read

JWT rotation, IDOR, and the security decisions behind NovaShop

Auth in NovaShop spans three layers: NestJS issues tokens, Next.js holds the cookies, middleware quietly refreshes. Most of the small decisions here are the ones skipped when you build auth 'quickly' - and the ones attacked most often in practice.

SecurityAuthNestJS
Level: Intermediate9 min read

NovaShop and the Next.js App Router caching problem: a real case study

Most Next.js tutorials stop at revalidate = 60. NovaShop draws the App Router's three cache layers explicitly and handles each one on purpose - including the parts Next.js documents poorly across the 15 → 16 shift.

Next.jsCachingApp Router