Keeping API keys and database passwords safe with five people and no security budget. Where .env belongs, how to check whether a key is already in git history, and how to rotate a leaked key without downtime.

The lost update is the bug nobody reports, because both screens said Saved. How to add a version column and a 409 the interface can explain, when to use lockForUpdate instead, and how to test a race on purpose.

Three ways to generate a PDF in PHP and what each costs in memory and fidelity, why the rupee symbol comes out blank, and how to run forty invoices without a fatal error.

Password resets and invoices that land in spam are an infrastructure problem, not a copy problem. How to set up SPF, DKIM and DMARC, why sending from a subdomain matters, and what to test before launch.

Excel BOMs, four date formats in one column, rupee signs in number fields and headers that changed since last month. How to build an import that validates before it writes and never duplicates.

Knowing your application broke before the customer tells you. One exception handler, a rate-limited alert, a daily digest, and the heartbeat files that catch failures no log ever records.

A SPA updates the moment you deploy. A desktop app on a customer machine does not. How to version an API for both: additive change, honest deprecation, and when a v2 is actually worth it.

Nobody has a backup problem until they have a restore problem. The three ways backups fail, a ninety-minute quarterly drill written as a runbook, and how to prove recovery time to a client.

Why the naive one-session check fails, how a keychain-stored device id fixes it, the takeover flow — and the morning we conflated two questions in one column and locked 43 real users out.

One table, one send() helper, a terminating callback instead of a worker, and a badge that costs one cached COUNT. Why polling beats websockets at fifty users, and why every row needs an expiry.