Notes on backend architecture, identity, and the tools that hold a system together.
Adding a package doesn't just add functionality — it adds another maintainer, another release cycle, another transitive tree nobody fully mapped. left-pad and xz-utils are what that cost looks like when it finally comes due.
A standard offering unlimited choices without strong defaults can build weaker systems than one offering fewer, better-recommended ones. Why FAPI narrowed OAuth's options instead of adding more, and what the paradox of choice has to do with it.
Knowing who's calling an API used to be enough. Private Key JWT, mTLS, DPoP, Rich Authorization Requests, and CIBA are the mechanisms that let FAPI bind a specific transaction to a specific client and user, not just a session.
If possession of a stolen token is enough to access your API, the token has become the password. DPoP, mTLS, and why proof-of-possession asks a fundamentally different question than a bearer token ever could.
FIPS doesn't certify applications, orchestrators, or clouds — it certifies specific, versioned cryptographic modules. "We deployed to Kubernetes" was never an answer to the question FIPS is actually asking.
A public key is an identity. A private key is the proof. The math behind why an attacker who steals your public key still can't forge a signature — RSA factoring, ECDLP, and what FAPI actually gets from Private Key JWT.
A deployment call with a dozen stakeholders watching one engineer click deploy isn't engineering maturity. It's engineering anxiety, dressed up as process — and it's usually compensating for a rollback plan nobody trusts.
A salary rewards your employment. It doesn't validate your judgment. Coasting through the month without questioning anything is a choice you're entitled to make — just don't call it engineering.
Everything here is a report from where I'm standing, not an argument built to relocate you there. If you land somewhere different after actually thinking it through, that's not a miss — that's the point.
Credentials, tutorials, and AI compress the time it takes to encounter an idea. None of them shorten the years it takes to develop judgment about which ideas actually hold up once reality gets involved.
No formula outputs the correct architecture, and no checklist guarantees good software. What exists instead is a long list of trade-offs made under constraints nobody judging the decision later can fully see.
Technical depth gets an engineer into the room. What determines whether they thrive over years is how well they collaborate, absorb feedback, and own outcomes nobody assigned them.
"Other banks do it this way" answers is this common, not is this the right control. Two onboarding requirements worth interrogating on their own merits, not on precedent.
Used well, AI makes engineers faster. Used carelessly, it quietly replaces engineering judgment with statistical pattern matching — and organizations are starting to let that happen without noticing.
A team can build a specification flawlessly and still ship something insecure, if the specification itself was built on a security assumption that stopped being true years ago.
From Kerckhoffs' 1883 principle to obscured APIs and JWTs done wrong — where security-through-obscurity comes from, why it fails, and the narrow cases where it still earns a place.
Complexity rules check whether a password looks hard to guess. Attackers running credential stuffing don't care how a password is shaped — only whether it's already sitting in a breach dataset.
RSA was never dropped from FIPS or FAPI. What changed is which padding scheme is allowed, and the gap between RS256 and PS256 is exactly where the myth comes from.
Authorization Code Flow with PKCE is the default for native apps for good reason — but a bank's own first-party app has a different relationship with its identity provider, and CIBA was built for exactly that shape of problem.
Popularized by Robert C. Martin, Clean Architecture divides opinion for good reason. On the Big Ball of Mud, Vertical Slice Architecture, and why the real question is autonomy paired with pragmatism.
Copy-pasting code quietly converts a one-time saving into a compounding cost. On DRY, Sandi Metz's "Wrong Abstraction," and when duplication is actually fine.