Huỳnh Tiến Dĩ, Software engineer in Ho Chi Minh CityIn-depth articles on React, Next.js, performance, architecture and LLM integration. Every post comes with working code, the trade-offs and the mistakes I made along the way, so you can make the call faster in your own codebase.
Latest article
Tooling & workflow
What counts as a secret, how .env files and long-lived CI tokens actually leak, what to do in the first hour after a leak, secret stores compared, GitHub Actions OIDC to AWS and GCP instead of static keys, rotation without downtime, and typed env validation in a Turborepo monorepo.
19 min read
The newest articles and notes.
Link previews, webhooks, image import and file uploads look like boring features, yet they keep showing up in incident reports. Why SSRF blocklists fail, a safe fetch in Node with undici and pinned IPs, IMDSv2, and an upload pipeline: presigned S3, magic bytes, sharp, a separate domain and async scanning.
How to read a bundle analyzer in 2026 (next analyze, rollup-plugin-visualizer, source-map-explorer), how tree shaking really works with ESM, sideEffects, barrel files and CommonJS, the usual traps like moment and lodash, duplicate dependencies, polyfills, and bundle budgets in CI with size-limit.
The browser's cross-origin model from the ground up: what the Same-Origin Policy blocks, what CORS relaxes and what it never protects, preflights and credentials, Vary: Origin caching bugs, dangerous allowlists, then CORP, COEP, COOP, Fetch Metadata and SameSite — with NestJS and Next.js configs done right.
A practical threat model for applications that put an LLM between tools and private data: direct and indirect prompt injection, the lethal trifecta, and the design patterns that keep the damage contained, mapped against the OWASP Top 10 for LLM Applications.
Posts in order, from fundamentals to production.
Systems & architecture
Start with threat modeling, then work through XSS and CSP, CORS and cross-origin isolation, OAuth/OIDC, JWT, the OWASP API Top 10, SSRF and file uploads, secrets management and the npm supply chain — each layer of defense for a real app.
Systems & architecture
From a streaming chat UI and RAG that answers correctly to MCP servers for agents and LLM app security — what a web developer needs to ship AI features to production.
Learning & career
Eliciting the real requirements, writing testable user stories and acceptance criteria, modeling processes with BPMN, Event Storming, PRDs with measurable non-functional requirements and product metrics in SQL.
Learning maps for frontend, backend, mobile, QA, DevOps and AI engineering, drawn from my own journey.
Building web interfaces that stay fast, accessible and maintainable as products grow
10 stages, 51 topics, ~34 weeks
Designs, builds and runs the APIs, data and services behind every product
10 stages, 52 topics, ~37 weeks
Build iOS and Android apps that feel smooth, work offline and ship safely
10 stages, 50 topics, ~34 weeks
Find risk before users do and turn quality into something the team can measure
10 stages, 50 topics, ~36 weeks
Builds infrastructure, pipelines and platforms so teams ship fast, safely and reliably
10 stages, 56 topics, ~42 weeks
Build products on top of LLMs: APIs, RAG, agents, evals and running it all in production
10 stages, 58 topics, ~31 weeks
Long-form, chapter-by-chapter guides for the tools you ship with.
Browser-only utilities for everyday dev work.
Five lenses for everything on this blog.
State, data flow and the boundaries that keep apps sane as they grow.
Components, design systems and the craft of interfaces people enjoy.
Bundles, rendering and measuring what actually makes apps feel fast.
Runtimes, monorepos and the tools that keep the feedback loop short.
Notes on learning, writing and growing as an engineer.
Tools change. Frameworks evolve. But the principles behind good systems stay the same.
These principles guide every article on this blog — not trends, but ways of thinking that scale over time.
Speed is not an optimization — it's part of the product. Slow systems create friction, and friction kills user experience. Every layer matters.
Apps are not pages. They are systems with state, data flow, and constraints. If you only think in UI, your app will break when it scales.
Good code is not the smartest code — it's the code others can understand quickly. Maintainability beats clever tricks every time.
Requirements will always change. Systems that survive are designed to adapt, not ones that assume everything is fixed.
What works locally doesn't matter. Real understanding comes from production — edge cases, failures, and unexpected behavior.
Complexity compounds over time. Simple systems are easier to debug, scale, and evolve. Simplicity is a design decision, not a limitation.
Every article as a tile. Hover or focus a tile to peek, filter by topic to narrow down.
About the author
Hi, I’m Dĩ — a software engineer in Ho Chi Minh City, mostly working with React, Next.js and the systems behind them. This blog is where I slow down and write about how things actually work in production: the trade-offs, the mistakes and the patterns worth keeping.
More about me