2026
8 essays filed in 2026, from 4 writers. Most-covered topic: #case study.
- Essays
- 8
- Writers
- 4
- First filed
- Jul 11
- Latest
- Aug 17
- Words published
- 13580
- Top topic
- #case study
-
backend
Upgrading TypeORM 0.3 to 1.0 in Production: A NestJS Case Study
How we took TypeORM 0.3 → 1.0 to a live NestJS API without a headache.
-
aws
How a CloudFront Custom Error Page Leaked JWTs to S3: A Case Study
A pen-test curl found CloudFront forwarding `Authorization` headers to the S3 error-page bucket, where S3 reflected every JWT back in its XML error response. Two lines of Terraform closed it across sixteen distributions.
-
email
Implementing a Zero Auth Unsubscribe Link on Your Email
Nobody logs in to unsubscribe. They mark you as spam instead. Here's the small trick we used — a signed token in the URL — so users can unsubscribe with one tap without ever seeing a login screen.
-
backend
Splitting a Mega-Service Into Four: The Service-Facade Refactor (Plus a Reusable Skill)
How we split a 1,307-line `user.service.ts` into four responsibility-tagged NestJS sub-services (query, mutation, membership, stats) behind a stable facade — no caller broke, no test changed, one PR, and a reusable Claude skill file at the end.
-
remote
Iftar at Apetit: The Sarajevo Team Picks a Menu
One evening in March the Sarajevo Clearviewers sat down for a Ramadan iftar dinner. The Slack thread that got us to the table is the honest picture of how the team actually organizes itself: informal, patient, and mostly saying 'svejedno.'
-
jwt
How a JWT Audience Map Saved a CORS Mistake: A Defense-in-Depth Case Study
On a client's API, a CORS wildcard looked like a HIGH severity finding — until we tried to actually exploit it. A second, independent JWT audience check turned a trivially exploitable bug into one that required a much harder prerequisite.
-
react native
Asking For Notification Permission: The Second Time Is the Wrong Time
iOS gives you exactly one shot at the native permission prompt. Here's the simple screen we show first, so users see what they'll get before the OS asks the question.
-
devsecops
From DevOps to DevSecOps: How I Became Clearview's In-House Pen-Tester
How we built an in-sprint pen-tester role into every engagement — the DevSecOps handoff, the two decades of DevOps that led to it, and the OWASP Top 10 categories that show up first in real client APIs.
