Engineering explainers and deep dives on building systems that hold up in production: API design, databases, authentication, multi-tenancy and performance.
A practical technical SEO checklist for 2026: the crawlability, indexing, speed, structured data and sitemap work that lets content rank at all, with exact Core Web Vitals thresholds and a JSON-LD example you can copy.
Read articleA practical guide to local and geo SEO for service businesses: how search decides who ranks for a place, the location pages and LocalBusiness markup that help, why consistent details matter, and how to scale across cities and countries organically.
Read articleSaaS entitlements are the rules that say what each customer may use: features, numeric limits and add-ons. Store them in your own database, write them from billing webhooks, check them in one server-side function, and count usage atomically. Here is the data model, the TypeScript check and the SQL.
Read articleA public SaaS API is a contract you cannot easily take back. Issue prefixed API keys and store only their hash, scope every key to one tenant, version so old clients never break, paginate with cursors, accept idempotency keys and publish rate limits. Here is the design, with TypeScript and SQL.
Read articleOutgoing webhooks let your customers react to events in your SaaS without polling. Write each event to an outbox in the same transaction, deliver from a queue, sign with HMAC-SHA256 following the Standard Webhooks spec, retry with backoff for about a day, block internal addresses, and give customers delivery logs and replay.
Read articleCustom domains let each SaaS customer serve your product at their own address. The customer adds a CNAME or A record, you verify ownership, a platform issues TLS automatically, and your app maps the Host header to a tenant. Here is how on Vercel, Cloudflare for SaaS or self-hosted Caddy, with code and the security traps.
Read articleThe rules for changing a live SaaS database without taking customers offline: why migrations cause downtime, the expand-migrate-contract release order, PostgreSQL-safe forms of risky statements, batched backfills, multi-tenant schema concerns and the CI checks that enforce it all. SQL examples throughout.
Read articleHow to choose an uptime commitment for a SaaS without over-promising: SLI, SLO and SLA in plain terms, how much downtime each percentage allows, why your SLA cannot beat your dependencies, what an SLA document should define, how to measure uptime with a health check, and how to run an honest status page.
Read articleA practical backup and disaster recovery plan for a SaaS: what RPO and RTO mean and how to choose them, what managed Postgres providers give you, why you still need an independent logical copy, how to restore a single tenant, and a restore-drill script that proves your backups work. Sources from PostgreSQL, AWS and Neon documentation.
Read articleBuild customer-facing analytics yourself when you need a few fixed charts that match your product. Embed a BI tool when customers want to explore, filter and build their own reports. Either way, lock every query to the tenant on the server and serve it from rollups, not your live tables. Costs, code and a decision table.
Read articleSaaS technical due diligence checks whether the product can scale, whether the code and IP are clean, and what fixing the gaps will cost. Reviewers look at architecture, code quality and tests, security, open-source licences, IP ownership, delivery metrics, infrastructure cost and key-person risk. What each area involves, the evidence to prepare, and how to fix gaps first.
Read articleA working guide to PostgreSQL row-level security for multi-tenant apps: the roles, policies and FORCE setting, passing the tenant with set_config and SET LOCAL through a connection pool, the pitfalls that silently bypass RLS, and the CI tests that prove one tenant cannot reach another.
Read articleWhy hand edits to a production Supabase database break things, how Lovable records its own migrations, and a seven-step workflow to fix it: measure drift, pull a baseline, rebuild from files, write each change as a migration with its RLS policies, test it with pgTAP, deploy from CI, and decide where Lovable fits.
Read articleThe implementation behind the rate limits on this site, which run on serverless hosting with no Redis: the Postgres table and atomic upsert, which store each endpoint uses and why, cleanup without a cron job, failing open during a database outage, and why analytics beacons use a memory-only limiter so they do not wake the database on every page view.
Read articleMulti-tenant is the default for SaaS; single-tenant is a paid exception for customers whose contracts demand it. A decision table, cost at 10, 100 and 1,000 tenants, noisy neighbours, per-tenant restores, compliance-driven isolation, and how to move a customer between the two models.
Read articleA shared schema with row-level security scales to thousands of tenants on one set of migrations; a database per tenant scales isolation, not tenant count. Connection arithmetic, migration fan-out, per-tenant restore SQL, noisy-neighbour controls and how to move one tenant out of the pool.
Read articleHow Stripe Connect works for a marketplace in 2026: Standard, Express and Custom accounts and the controller properties replacing them, direct, destination and separate charges, what Connect costs, how payouts and refunds move, and who verifies sellers, with TypeScript examples.
Read articleYou can make a single-tenant app multi-tenant without rewriting it: add a tenants table and a tenant_id column, backfill it in batches, enforce it with constraints added NOT VALID, scope every query, switch on PostgreSQL row-level security, then move customers over one at a time. The phases, the SQL, the risks and how long each step usually takes.
Read articleFor a new B2B SaaS in 2026, Better Auth is the self-hosted default, Clerk is the fastest hosted option if its per-user pricing fits, and NextAuth (Auth.js) is right for existing apps that already run on it. What each one gives you for organizations, roles and enterprise SSO, what it costs, and why this site still runs NextAuth.
Read articleHow a marketplace splits one payment between itself and its sellers: the three money-flow models, why holding seller funds is not escrow, the ledger that makes commission, refunds and payouts correct, SQL for releasing and paying out balances, and how TheSkinProof records commission per order line.
Read articleHow to run bKash, Nagad, SSLCommerz and cash on delivery behind one checkout: a shared payment interface, bKash token reuse and create/execute calls, SSLCommerz sessions, IPN and the validation API, marking orders paid safely, and what TheSkinProof runs in production.
Read articleWhy two customers can buy the last unit, and how to stop it in PostgreSQL: the conditional UPDATE, SELECT ... FOR UPDATE, a CHECK constraint as a floor, locking lines in a fixed order to avoid deadlocks, when to reserve stock during payment, and a concurrency test that proves the fix.
Read articleAn engineering guide to running buy now, pay later and card payments through one checkout in Saudi Arabia and the UAE: how Tabby, Tamara and Checkout.com differ on amounts, statuses, capture, webhooks and refunds, a TypeScript provider interface that hides those differences, and how to handle webhooks that arrive out of order or twice.
Read articleAn engineering guide to M-Pesa Express (STK Push) on Safaricom Daraja for teams in Kenya: how the flow works, why the callback is untrusted, the six failure cases to test before production, an idempotent TypeScript callback handler keyed on CheckoutRequestID that confirms through the STK Push query, and a reconciliation job for callbacks that never arrive.
Read articleAn engineering comparison of Paystack and Flutterwave for teams building a Next.js checkout in Nigeria and across Africa: published fees and settlement, countries, amount units, split payments, webhook verification and test mode, plus an App Router route handler that verifies signatures on the raw body with a constant-time compare and confirms each payment exactly once.
Read articleA practical guide to FHIR API integration for health startups: the R4 resources you will use, SMART on FHIR launch flows, the Epic and Oracle Health (Cerner) sandboxes, bulk data export, a TypeScript sample, and where the time really goes.
Read articleA working double-entry ledger schema for PostgreSQL: accounts, journal entries and postings, a deferred trigger that rejects unbalanced entries, bigint minor units, idempotency keys, reversal-only corrections, balance strategies and multi-currency, plus a TypeScript posting function.
Read articleA payment orchestration layer routes each payment to the right processor, retries and fails over without charging twice, keeps saved cards portable and normalises webhooks. Routing rules, a TypeScript router, buy-or-build options, and how RAITHub would build a thin layer.
Read articleStart with Postgres full-text search and pg_trgm, move to Meilisearch or Typesense when you need facets and instant results, and pay for Algolia when merchandising tools matter more than cost. Pricing, relevance, typo tolerance, multilingual text and zero-result analytics, with working samples.
Read articleA product configurator is a rules engine with a preview on top. This guide covers option compatibility and dependencies, a server-side price rules engine, 2D layers versus 3D with three.js or model-viewer, SKU and BOM generation, B2B quotes, performance, and when an off-the-shelf customizer is enough.
Read articleUsage-based billing works when every billable event is written once to your own database, rolled into hourly totals and sent to the billing system with an idempotency key. Event design, late events, Stripe Billing meters versus Metronome, Orb and Lago, credits, invoice previews, plan limits and overage alerts, with SQL and TypeScript.
Read articleThe seven areas an ecommerce admin needs, the Next.js App Router patterns that keep it safe (server actions with permission checks, keyset pagination, optimistic UI), and when Shopify, Medusa or Payload admin is enough instead of a custom build.
Read articleFEFO (first expired, first out) ships the batch closest to expiry first. How to choose between FEFO and FIFO, allocate batches at order time or pick time, enforce a minimum remaining shelf life, split lines across partial batches, return goods to stock, print pick lists, and allocate safely in PostgreSQL with FOR UPDATE SKIP LOCKED.
Read articleFeature flags in a SaaS do four jobs: release, experiment, plan entitlement and kill switch. Target by tenant, roll out with a stable hash, delete flags on a schedule, and test both paths. Here is how, with a TypeScript evaluator and a buy-or-build comparison.
Read articleBuy an internal tool such as Retool or Appsmith when staff need simple data screens fast; build the admin into your app when it touches tenant data, money or customer accounts. Cited pricing and licences for Retool, Appsmith, Forest Admin and React-admin, and how to do RBAC, audit logs, impersonation and data export safely.
Read articleA multi-agency property platform stays safe when the agency is the tenant: agency_id on every row, PostgreSQL row-level security on every table, co-broking as an explicit agreement, public search from a separate projection, and a cross-agency IDOR suite in CI.
Read articleMost slow Next.js apps have one of six problems: pages rendering on every request by accident, uncached database reads, N+1 queries, too much client JavaScript, unoptimised images, or a server far from its database. How to tell which one you have from TTFB and LCP, and the fixes, with the ISR and cached queries this site uses to keep its database mostly asleep.
Read articleHow the three common rate limiting algorithms work, with code for each; why an in-memory counter fails on serverless; and the Postgres-backed limiter this website runs instead of Redis, including its trade-offs, its three-bucket login limit and the per-recipient cap on confirmation emails.
Read articleFrom missing error boundaries to unconfigured ISR, here is a checklist for shipping Next.js apps that actually work in production.
Read articleA practical, honest guide to Core Web Vitals in 2026: what LCP, INP and CLS mean, the thresholds Google uses, and the specific fixes that move the numbers.
Read articleA clear, honest guide to JWT vs session authentication: how each works, the real trade-offs, security pitfalls, and a practical rule for choosing.
Read articleA practical, honest guide to monolith vs microservices for startups — the real trade-offs, a side-by-side comparison, rough costs, and when splitting actually pays off.
Read articleAn honest Next.js vs React comparison for 2026 — what each really is, when to pick which, and how the decision shapes SEO, cost and hiring for your product.
Read articleA practical PostgreSQL indexing guide: what indexes do, the main types, when to use each, how to read EXPLAIN, and the mistakes that quietly slow apps down.
Read articleAn honest, practical comparison of PostgreSQL and MongoDB for SaaS products, covering data models, transactions, scaling, cost and multi-tenancy.
Read articleA plain-English guide to React Server Components: what they do, how they differ from client components, real code examples, and when they actually help your product.
Read articleA practical, honest guide to what webhooks are, how they differ from polling, and the engineering patterns (signing, retries, idempotency) that make them reliable in production.
Read articleA plain-English guide to idempotency in API design: what it means, why duplicate charges and orders happen, and how idempotency keys make retries safe.
Read article