Blogs

Thoughts on web development, design, and building products.

Jul 16, 2026
10 min read

Building a Production-Style Auth System: What I Shipped and What I Learned

Registration, email verification, login with lockout, refresh token rotation with theft detection, password reset, tiered rate limiting, and the recurring bug patterns that taught me more than any single feature did.

Jul 15, 2026
6 min read

Designing a Secure Email Verification Flow: Hashing, Atomicity, and the Resend Problem

How I handled token storage, race conditions, and reverse lookups while building an auth system from scratch — hashed Redis tokens, a TOCTOU bug, and the resend flow that exposed a design gap.

Jul 2, 2026
7 min read

Building MemoryTree: What I Learned Shipping a Solo Full-Stack App

Notes from building a life-journaling app from scratch — cross-domain cookies, a blocked SMTP port, and the debugging habits that actually stuck.