Writing

Notes on real problems, not tutorials.

September 24, 2026

Why a Postgres View Can Silently Bypass Row-Level Security

A real Postgres view leaked cross-tenant data by checking RLS as its owner, not the querying user. What security_invoker fixes, and why a linter missed it.

September 15, 2026

Row-Level Security for Multi-Tenant Postgres: USING vs WITH CHECK in Practice

A practical walkthrough of the RLS policies that scope every row in a multi-tenant Postgres schema to a project, with a real two-user psql session proving one tenant cannot read, update, or delete another's data.

September 12, 2026

Build a Postgres Audit Log Your Application Code Cannot Bypass

How to write an append-only audit log entirely with Postgres triggers, so no application code path can skip it, verified with a real permissions test against a live database.

September 8, 2026

Stop Using a mounted Flag to Fix Theme Flash: Use useSyncExternalStore Instead

A Next.js theme toggle crashed a production login page under Trusted Types. Why the mounted-flag fix doesn't solve hydration mismatches, and how useSyncExternalStore does.