Product
A PUT that must not erase your note
Notes on habit days exposed a classic API trap: an idempotent PUT that sets a day's amount would also wipe its note. Pydantic's model_fields_set tells 'not sent' apart from 'sent empty'.
1 min
fastapi
3 posts.
Security & PrivacyBuilding auth for an app that holds health data
RS256 access tokens held only in memory, rotating refresh tokens with reuse detection, CSRF on cookie transport, TOTP with replay protection, and the gaps we have written down rather than hidden.
4 min
InfrastructureFour things that only break inside a container
Setting up the PaceStreak backend on uv, Ruff and ty, then wrapping it in Docker. Every real bug came from running it, not from reading it.
5 min