Case studies
Each write-up covers the original problem, the environment, the engineering decision, the fix, and how it was checked. We do not publish numbers we cannot trace.
POST-MORTEM #041
Next.js, Node.js, Python, PostgreSQL
The Next.js app, the Node.js webhook worker, and a Python reconciliation job all used a service-role credential. Twelve billing tables were readable without a tenant check, and the dashboard ran about 40 queries per page.
Read the post-mortemPOST-MORTEM #078
Next.js, Node.js, Python, PostgreSQL
The agent retrieved chunks and called the model inside the HTTP request. Long runs were killed at the function timeout, the stream died, and retrieval was not limited to the caller’s documents.
Read the post-mortemPOST-MORTEM #112
.NET, Next.js, PostgreSQL
A Next.js front end called a .NET API that trusted the role sent by the browser. Patient and clinician screens were the same session with fields hidden in the client. Appointment reminders included clinical detail.
Read the post-mortemPOST-MORTEM #126
Next.js, Strapi, Python, Node.js, PostgreSQL
Listing inquiries from the site, ads, Property Finder, Bayut, and Zillow landed in inboxes and in Bitrix24 as separate people. The same phone number opened two pipelines. Nobody recorded which listing the caller had viewed, and every new lead was treated as urgent.
Read the post-mortem