Engineering Blog
Deep dives into security, full-stack architecture, AI/ML, infrastructure, and the decisions behind every Noddev project.
62 articles across 7 categories.
Featured
Full-StackNext.js Edge Middleware: Auth, Redirects, and A/B Testing
What runs in middleware, auth without a database hit, country-based redirects, feature flags, and debugging at the edge.
Archive
61 articlesStripe Checkout and Webhooks in Next.js
Creating checkout sessions, handling webhook events, idempotency, and syncing subscription state to your database.
Neon's Database Branching for Fearless Development
Creating database branches for PRs, running migrations safely, restoring from branch history, and integrating with CI.
Service Communication: REST, gRPC, and Message Queues
When to use each inter-service communication pattern, what it costs you, and the developer ergonomics trade-offs nobody talks about.
Streaming AI Responses in Next.js with the AI SDK
Vercel AI SDK setup, streaming text with useChat, structured output with streamObject, error boundaries, and token budgeting.
Schema Design with Drizzle ORM: Relations, JSONB, and Migration Strategy
Practical schema design decisions using Drizzle: composite indexes, enum types, JSONB vs separate tables, and when to use push vs generate+migrate.
Building Full-Text Search Without Elasticsearch
PostgreSQL's tsvector and GIN indexes, ranked search, multi-column indexing, and fuzzy matching with pg_trgm.
Feature Flags in Production: Rollouts, Targeting, and Flag Hygiene
Boolean flags, percentage rollouts, user targeting, how to avoid flag debt, and why removing dead flags is as important as adding them.
Rate Limiting API Routes in Next.js
Sliding window rate limiting with Upstash Redis, IP extraction behind proxies, custom headers, and per-user limits.
Event-Driven vs Request-Response: Choosing the Right Communication Model
When async event-driven patterns are worth the complexity, when request-response is the right call, idempotency keys, and SSE as the pragmatic middle ground.
Building a Design System on Tailwind CSS v4
CSS custom properties instead of config, dark mode strategy, component variants with cva, and responsive design patterns.
API Versioning: How to Evolve an API Without Breaking Clients
URL path versioning, header versioning, query params, semantic versioning, and the Sunset header — what each approach costs and when to use it.
Managing Multiple Open Source Projects as a Solo Developer
Practical strategies for context-switching, documentation, versioning, and avoiding burnout when maintaining several active open source projects simultaneously.
Integrating the TMDB API: Type-Safe Wrappers and Caching
Rate limiting, type-safe fetch wrappers, image URL construction, ISR caching, and handling TMDB's pagination.
Database Indexing: Why Queries Slow Down and How to Fix Them
B-tree vs hash indexes, composite index column order, partial indexes, covering indexes, and the cases where indexes make things worse.
Reading Technical Errors Like a Senior Engineer
A framework for diagnosing stack traces, TypeScript errors, and runtime panics — and the mental models that let experienced engineers fix bugs faster.
Multi-Layer Caching: CDN to Database and Back
How caching works at every layer of the stack, cache invalidation strategies, and why Cloudflare KV works well for per-user recommendation caches.
Static vs Dynamic Rendering in Next.js 15
When to use force-static, force-dynamic, or no directive at all — and how Next.js decides which strategy to use for App Router pages.
Expo Router: File-Based Navigation for React Native
Layout routes, tab navigation, deep links, authentication guards, and shared transitions in Expo Router v3.
Building an MDX Content Pipeline in Next.js 15
Gray-matter frontmatter parsing, next-mdx-remote/rsc for App Router, rehype-pretty-code syntax highlighting, and TOC generation with rehype-slug.
Designing for Failure: Resilience Patterns in Production APIs
Circuit breakers, retries with exponential backoff, timeouts, and graceful degradation — the patterns that prevent one bad dependency from taking down everything else.
Scheduled Workers with Cloudflare Cron Triggers
Setting up Cron Triggers in Workers, handling long-running tasks within the 30-second CPU limit, and patterns for cache warming and periodic data refresh.
Sharing Code Between Next.js and Expo React Native
Monorepo setup, shared packages, universal components, platform-specific code, and keeping API clients in sync.
Monorepo vs Polyrepo: The Real Trade-offs
Turborepo makes monorepos tractable but doesn't make them free. When shared packages make sense, when they don't, and what you're signing up for.
SQLite for Operational State in Python Services
Using SQLite as the operational backbone of a background service: job queues, health checks, configuration storage, and why it outperforms Redis for single-process apps.
Cloudflare R2 for Media Storage
Storing and serving HLS segments, implementing multipart uploads for large files, and integrating R2 with Workers for access-controlled media delivery.
Building an HLS Download Pipeline for Offline Video
M3U8 parsing, segment URL rewriting, concurrent downloads, reassembly, OPFS storage, and offline playback.
The Future of OSINT
Why automated reconnaissance is shifting from passive collection to active analysis with AI.
The Pipe and Filter Pattern: How ApiShield Processes API Specs
Decoupling ingestion, normalization, scanning, and reporting with a pipeline architecture — why it works and where it breaks down.
ChromaDB for Vector Search in Local Apps
Setting up ChromaDB, embedding documents, querying with metadata filters, and integrating with a hybrid BM25 + vector retrieval pipeline.
Neon PostgreSQL for Serverless Apps
Branching, autoscaling, connection pooling with Hyperdrive, and the schema setup patterns that make Neon work well with Drizzle ORM on Cloudflare Workers.
Breach Detection: Monitoring for Credential Attacks
HaveIBeenPwned integration, credential stuffing signals, login anomaly detection, and how to rate-limit by credential type without annoying legitimate users.
OPFS: The Browser's Private File System for Offline Apps
Writing and reading large files, HLS segment storage, IndexedDB for metadata, and quota management in the Origin Private File System.
Cloudflare KV as a Cache Layer
Per-user recommendation caching, TTL design, cache invalidation strategies, and when to reach for KV versus D1 versus R2 in a Cloudflare Workers app.
Building Noddev
How we built a unified portfolio and documentation hub using Next.js 15, Tailwind, and MDX.
STRIDE Threat Modeling for Web APIs
A structured approach to thinking about what can go wrong — before it does. Walking through STRIDE on a realistic streaming API.
Server-Sent Events for One-Way Real-Time Streaming in Next.js
Why SSE beats WebSockets for one-way data, implementation in Next.js API routes, client EventSource handling, and reconnection.
Building Knowledge Graphs in SQLite
Concept nodes, edge tables, recursive CTEs for multi-hop traversal, and how Cognix uses a SQLite graph to map relationships across a knowledge base.
SQL Injection Isn't Dead: Risks Even With Drizzle and Prisma
ORMs eliminate most SQL injection vectors but don't eliminate all of them. Here's where the risk survives and how to contain it.
Grounding LLM Responses in Application State
The CognitiveBridge pattern: injecting arousal, conflict, surprise, and memory state into system prompts so LLM responses are shaped by what the application knows.
Building a PWA with Serwist and Next.js
Service worker config, caching strategies, install prompt, background sync, and update handling with @serwist/next.
Secrets Management in Next.js: What Gets Exposed and What Doesn't
The .env hierarchy, the NEXT_PUBLIC_ prefix trap, Cloudflare Workers secrets, and runtime validation with Zod.
Leaky Integrate-and-Fire Spiking Neural Networks
Membrane potential dynamics, spike threshold, refractory period, and how to train LIF neurons with surrogate gradients.
TanStack Query Patterns for Next.js
Stale-while-revalidate, optimistic mutations, cache invalidation, server-side prefetching, and shared query key conventions.
Content Security Policy in Production: The Hard Parts
Getting CSP right in a real app — nonces, hash-based policies, streaming iframes, and why 'unsafe-inline' kills your whole policy.
Neuromodulatory Signals as Dynamic Hyperparameters
Dopamine, norepinephrine, serotonin, and acetylcholine implemented as runtime scalars that change network behaviour without retraining.
Better-Auth: A Practical Setup Guide
Email+password auth, session management, bearer plugin for cross-origin clients, trusted origins, middleware, and admin role gating.
API Key Design: Hashing, Scoping, and Rotation
How to design API keys that are safe to store, easy to identify in logs, scoped to least privilege, and revocable without breaking everything.
Biologically-Inspired Cognitive Architectures in AI
Working memory, episodic, semantic, procedural, and somatic memory systems — how they differ from standard attention and LSTMs, and why they matter for grounded AI.
CORS Headers: What Actually Happens and Where Developers Go Wrong
Preflight requests, credentials, wildcards, and the mistakes that silently break your API for legitimate clients while doing nothing to stop attackers.
Drizzle ORM in Practice: Schema, Migrations, and the Patterns That Stick
Schema definition, type inference, drizzle-kit migrations, upserts, transactions, and the Neon serverless adapter.
Running AI Locally Without API Keys
Ollama, sentence-transformers, deterministic embeddings, and local synthesis — a practical guide to building AI features that work offline.
Building RAG from Scratch (No LangChain, No LlamaIndex)
Chunking strategy, embedding, hybrid retrieval, synthesis, and citation — the full pipeline without a framework in the way.
Deploying Next.js to Cloudflare Workers with OpenNext
wrangler.toml, R2 for ISR cache, D1 for tag cache, KV bindings, Hyperdrive for Postgres, and cron triggers — a complete walkthrough.
JWT vs Session Auth: Picking the Right Model
Statelessness sounds appealing until you need to revoke a token. A clear-eyed look at the trade-offs between JWTs and server-side sessions.
Hybrid Retrieval with Reciprocal Rank Fusion
Combining keyword search, vector search, and filename matching into one ranked list. The RRF formula, the k parameter, and why it consistently beats single-method retrieval.
OWASP API Security Top 10 (2023): A Practical Breakdown
Each of the ten categories with a real example of the vulnerability and a concrete mitigation — not just theory.
Server Actions: Beyond the Basic Form
Progressive enhancement, optimistic updates, error handling, and integrating server actions with TanStack Query.
Embedding Backends Compared: Hash, Sentence-Transformers, OpenAI
SHA-256 hash embeddings vs sentence-transformers vs OpenAI text-embedding-3-small — speed, quality, dimensionality, and when to use each.
Next.js App Router Patterns That Actually Matter
Layouts, templates, parallel routes, intercepting routes — the patterns that separate a good App Router codebase from a messy one.
Rate Limiting Strategies for Production APIs
Token bucket, sliding window, and fixed window — when to use each, how they fail, and how to implement them without hammering your database.
Building Neural Networks from Scratch in NumPy
Forward pass, backward pass, gradient computation — no framework. A concrete XOR implementation with the full math spelled out.