Implementing a Zero Auth Unsubscribe Link on Your Email
Nobody logs in to unsubscribe. They mark you as spam instead. Here's the small trick we used — a signed token in the URL — so users can unsubscribe with one tap without ever seeing a login screen.
Splitting a Mega-Service Into Four: The Service-Facade Refactor (Plus a Reusable Skill)
How we split a 1,307-line `user.service.ts` into four responsibility-tagged NestJS sub-services (query, mutation, membership, stats) behind a stable facade — no caller broke, no test changed, one PR, and a reusable Claude skill file at the end.
Iftar at Apetit: The Sarajevo Team Picks a Menu
One evening in March the Sarajevo Clearviewers sat down for a Ramadan iftar dinner. The Slack thread that got us to the table is the honest picture of how the team actually organizes itself: informal, patient, and mostly saying 'svejedno.'
How a JWT Audience Map Saved a CORS Mistake: A Defense-in-Depth Case Study
On a client's API, a CORS wildcard looked like a HIGH severity finding — until we tried to actually exploit it. A second, independent JWT audience check turned a trivially exploitable bug into one that required a much harder prerequisite.
Asking For Notification Permission: The Second Time Is the Wrong Time
iOS gives you exactly one shot at the native permission prompt. Here's the simple screen we show first, so users see what they'll get before the OS asks the question.
From DevOps to DevSecOps: How I Became Clearview's In-House Pen-Tester
How we built an in-sprint pen-tester role into every engagement — the DevSecOps handoff, the two decades of DevOps that led to it, and the OWASP Top 10 categories that show up first in real client APIs.
Trending on Remote Since Forever
-
application development
An Event-Driven Architecture Case Study: Lessons from a Real-World Application
-
software engineering
From Localhost To Production — Best Practice on Software Development and Deployment
-
technology
The most Flexible AWS Savings Plan
Case-Study Hubs
Real client engagements grouped by the shape of the work — pick a lane.
-
Case-Study Hub
Web API Security Case Studies
Case studies of Node.js Express API security findings — CORS allowlist, JWT audience map, X-Forwarded-For rate-limit, S3 IAM, CloudFront header leak.
-
Case-Study Hub
AWS Cost Optimization Case Studies
AWS cost optimization case studies — Graviton (ARM) up to 20% off compute, Compute Savings Plans up to 66% off, budget alerts before the invoice hits.
-
Case-Study Hub
AWS DevOps Case Studies: Terraform, App Runner, WAF
AWS DevOps case studies — App Runner deploys, Terraform budgets and WAF, Cognito + S3 direct uploads, and an event-driven AWS architecture.
Case studies
View all 5-
email
Implementing a Zero Auth Unsubscribe Link on Your Email
Nobody logs in to unsubscribe. They mark you as spam instead. Here's the small trick we used — a signed token in the URL — so users can unsubscribe with one tap without ever seeing a login screen.
-
backend
Splitting a Mega-Service Into Four: The Service-Facade Refactor (Plus a Reusable Skill)
How we split a 1,307-line `user.service.ts` into four responsibility-tagged NestJS sub-services (query, mutation, membership, stats) behind a stable facade — no caller broke, no test changed, one PR, and a reusable Claude skill file at the end.
-
jwt
How a JWT Audience Map Saved a CORS Mistake: A Defense-in-Depth Case Study
On a client's API, a CORS wildcard looked like a HIGH severity finding — until we tried to actually exploit it. A second, independent JWT audience check turned a trivially exploitable bug into one that required a much harder prerequisite.
Security & DevSecOps
View all 2-
jwt
How a JWT Audience Map Saved a CORS Mistake: A Defense-in-Depth Case Study
On a client's API, a CORS wildcard looked like a HIGH severity finding — until we tried to actually exploit it. A second, independent JWT audience check turned a trivially exploitable bug into one that required a much harder prerequisite.
-
devsecops
From DevOps to DevSecOps: How I Became Clearview's In-House Pen-Tester
How we built an in-sprint pen-tester role into every engagement — the DevSecOps handoff, the two decades of DevOps that led to it, and the OWASP Top 10 categories that show up first in real client APIs.
AWS & Cloud
View all 3-
devsecops
From DevOps to DevSecOps: How I Became Clearview's In-House Pen-Tester
How we built an in-sprint pen-tester role into every engagement — the DevSecOps handoff, the two decades of DevOps that led to it, and the OWASP Top 10 categories that show up first in real client APIs.
-
technology
The most Flexible AWS Savings Plan
How AWS Compute Savings Plans can cut up to 66% off the cloud bill — without locking you into an instance family.
-
aws cost optimization
Migrating EC2 to AWS Graviton (ARM): A Cost-Reduction Case Study
How we cut Clearview client EC2 bills by up to 20% by migrating x86 workloads to AWS Graviton (ARM64) — the instance-family swap (M6g, C7gd, R7g), the AMI-selection step in Terraform, and the compatibility checks we ran first.
Remote & team
View all 4-
remote
Escape From Slack Island
Working remotely doesn't have to feel like a life sentence in solitary. Here's how.
-
remote working
The Eight Virtues of Remote Bushidō: A Handbook For Digitally Nomadic Developers
A handbook for digitally nomadic developers — eight virtues that turn remote work from a perk into a discipline.
Software craft
View all 6-
gpt
Securing LLM — Retrieval Augmented Generation
Five steps to keep a RAG-powered LLM app from leaking its prompt, your data, or both.
-
software development
Power of AI in Software Development
How CVAI cut hours of JIRA grooming, PR creation, and PR review down to seconds for our engineering team.
-
business development
Clearview is now a verified member of the Pangea community
What our Pangea verification turned up about how Clearview engineers actually show up for clients.
See what else we've published
27 more-
application development
An Event-Driven Architecture Case Study: Lessons from a Real-World Application
A decade of Clearview engineering for a confidential awards group, and the event-driven AWS architecture that keeps it observable.
-
software engineering
From Localhost To Production — Best Practice on Software Development and Deployment
A walk-through for taking a Node + Postgres + Nginx stack from your laptop to a hardened production server.
-
technology
The most Flexible AWS Savings Plan
How AWS Compute Savings Plans can cut up to 66% off the cloud bill — without locking you into an instance family.
-
gpt
Securing LLM — Retrieval Augmented Generation
Five steps to keep a RAG-powered LLM app from leaking its prompt, your data, or both.
-
entrepreneurship
Scrum Is Here To Stay
Scrum still works for distributed teams — the trick is making sprint retrospectives feel human, not procedural.
-
aws cost optimization
Migrating EC2 to AWS Graviton (ARM): A Cost-Reduction Case Study
How we cut Clearview client EC2 bills by up to 20% by migrating x86 workloads to AWS Graviton (ARM64) — the instance-family swap (M6g, C7gd, R7g), the AMI-selection step in Terraform, and the compatibility checks we ran first.
No newsletter dance. Three honest ways in.
Long-form essays land here when there's something worth saying. Pick whichever channel fits.
-
For readers
Subscribe via RSS
Your reader pulls new essays as they appear. Per-author feeds live at
RSS feed/authors/<name>/feed.xml. -
For listeners
Founder Vision podcast
Brett interviews founders and operators on the messy middle of building a company.
foundervision.clearview.team -
For writers
Join Clearview Team
We add bylines when the work earns it. The careers page is the place to start — engineers, operators, designers.
View open roles
Or just email us — we read everything.