Lessons learned, problems and solutions
The event-XOR-error invariant on command handlers. How to inform the caller of a business outcome without breaking the event/error separation, and why audit logging must be atomic.
tls.Config.VerifyConnection only runs at handshake. A client on keep-alive after revocation keeps serving. Double-gate pattern and CRL hot-reload with monotonic check.
A single TLS port serving three hosts via SNI with different ClientAuth levels. Plus the session cert binding pattern to block cookie replay attacks.
Synchronizer token server-side vs double-submit cookie: when the latter fails, why middleware wire-order matters, and how to handle JS non-form requests.
First N failures are silent, then exponential backoff capped at 15 min. Why the status code must never distinguish locked vs wrong creds, and how to reset properly.
If your login responds in 1ms for unknown users and 50ms for known ones, you have an oracle. The fix is 3 lines. The trap that breaks it 6 months later is just one config change.
A PKCS#12 encrypted with AES-256, imported successfully by certutil, but ECDSA unusable in Edge. The CryptoAPI vs CNG routing trap and the MS KSP attribute fix.
How I built a bilingual FR/EN brochure site in PHP 8 with no framework or CMS: 7-layer anti-spam without captcha, strict CSP with CDNs, optimized LCP and full GitHub Actions CI/CD pipeline.
How I automated email filtering, unsubscribes and cleanup across 58,000 Outlook and Gmail messages using Claude Code, MCP servers, Graph API and RFC 8058 One-Click Unsubscribe.
How I built a React SVG component kit (circuits, triangles, 3D volumes) and deterministic question generators tested by pre-commit hooks across 200 seeds per gen.