014 parts · 86 min read
Systems & architecture
From a streaming chat UI and RAG that answers correctly to MCP servers for agents and LLM app security — what a web developer needs to ship AI features to production.
- 1Building a Streaming AI Chat UI That Stays Smooth: SSE, ReadableStream, Incremental Markdown and a Stop Button
- 2RAG That Actually Answers Correctly: Chunking, Hybrid Search with pgvector, Reranking and Evaluation
- 3Model Context Protocol in Practice: Building a Production MCP Server in TypeScript
- +1 more part
View series023 parts · 67 min read
Systems & architecture
One NestJS modular monolith, from the request lifecycle and module boundaries, through background jobs that never lose work, to passkeys and sessions done right.
- 1NestJS in production: the request lifecycle, dependency injection and module boundaries that scale
- 2Reliable background jobs in NestJS with BullMQ: retries, idempotency and the transactional outbox
- 3NestJS Auth Done Right: Passkeys, Sessions vs JWT, and Refresh Token Rotation
View series038 parts · 74 min read
Performance
Measure first with Core Web Vitals, then work through images, fonts, caching, bundles, React rendering and the event loop — each stop removes one reason pages are slow.
- 1Core Web Vitals: Understanding LCP, INP and CLS — and How to Fix Them
- 2Image Optimization End to End: Formats, srcset, Lazy Loading and next/image
- 3Web Fonts Done Right: Fast, Stable and Correct for Vietnamese
- +5 more parts
View series045 parts · 46 min read
Frontend & UI
A mental model for layout, container queries and design tokens, then letting the Popover API, anchor positioning and native dialogs replace a lot of JavaScript.
- 1A Mental Model for CSS Layout: From Normal Flow to Flexbox and Grid
- 2Container Queries and Modern Responsive Design: Components That Know Their Own Width
- 3Design Tokens and Theming with CSS Custom Properties: From Raw Colors to Dark Mode
- +2 more parts
View series055 parts · 30 min read
Systems & architecture
Treat the app as a system: state machines, an error-handling strategy, offline-first sync and feature flags — the decisions that keep a codebase healthy as it grows.
- 1Think in Systems, Not Screens
- 2State Machines for UI: Making Impossible States Impossible
- 3A Frontend Error-Handling Strategy: From Error Boundaries to Retries and Reporting
- +2 more parts
View series064 parts · 21 min read
Learning & career
Skills no framework teaches: taking notes, reviewing code, estimating honestly and what actually changes on the way from mid-level to senior.
- 1Writing Notes as an Engineer
- 2Code Review Is a Skill: How to Give It and How to Take It
- 3Estimating Frontend Work Honestly
- +1 more part
View series077 parts · 129 min read
Frontend & UI
A correct mental model for React Server Components, server state with TanStack Query, type-level TypeScript, proper ARIA widgets, Web Workers, real-user observability and micro-frontends — the hard parts under the framework surface.
- 1A Correct Mental Model for React Server Components: Two Module Graphs, One Boundary
- 2Server State Is a Cache, Not State: TanStack Query v5 in Depth
- 3Type-Level TypeScript for API Contracts You Can't Misuse
- +4 more parts
View series086 parts · 147 min read
Learning & career
Eliciting the real requirements, writing testable user stories and acceptance criteria, modeling processes with BPMN, Event Storming, PRDs with measurable non-functional requirements and product metrics in SQL.
- 1Requirements Elicitation for Engineers: A Business Analyst's Toolbox, from Interviews to Assumption Logs
- 2User Stories and Acceptance Criteria: Write Them So Developers Can Build and Testers Can Verify
- 3Business Process Modeling with BPMN 2.0: From As-Is Diagrams to Running Software
- +3 more parts
View series099 parts · 168 min read
Systems & architecture
Start with threat modeling, then work through XSS and CSP, CORS and cross-origin isolation, OAuth/OIDC, JWT, the OWASP API Top 10, SSRF and file uploads, secrets management and the npm supply chain — each layer of defense for a real app.
- 1Threat Modeling for Product Teams: STRIDE, Data Flow Diagrams and Trust Boundaries, from a 60-Minute Session to Tickets
- 2Practical Frontend Security: XSS in React, Nonce-Based CSP, Trusted Types, CSRF and Clickjacking
- 3CORS and cross-origin isolation in depth: origin vs site, preflights, credentials, CORP, COEP, COOP and Fetch Metadata
- +6 more parts
View series