#casestudy

1. 
   aws

   Closing the Rate-Limit Bypass: A CloudFront + ALB Case Study

   How we closed an `X-Forwarded-For` spoofing bypass on an AWS WAF rate-limit rule — CloudFront custom secret header, ALB origin verification, and a composite-key rate-based rule that actually counts real clients.

   NH Nedim Hadzimahmutovic Sep 14, 2026 · 10 min
2. 
   express

   Replacing a Wildcard CORS Policy: An Express Allowlist Case Study

   How we replaced a permissive Express `cors` regex with a strict allowlist — escaped-dot origin matching, `Vary: Origin` on every response, and no more CWE-942 finding on the pen-test report.

   NH Nedim Hadzimahmutovic Aug 31, 2026 · 8 min
3. 
   aws

   Cutting the File-Upload Bill: A Cognito + S3 Case Study

   How we replaced a hosted upload widget with native Cognito and S3, kept the browser uploading straight to the bucket, and brought the monthly invoice down.

   NH Nedim Hadzimahmutovic Aug 24, 2026 · 10 min
4. 
   backend

   Upgrading TypeORM 0.3 to 1.0 in Production: A NestJS Case Study

   How we took TypeORM 0.3 → 1.0 to a live NestJS API without a headache.

   TF Taufan Fadhilah Aug 17, 2026 · 8 min
5. 
   aws

   How a CloudFront Custom Error Page Leaked JWTs to S3: A Case Study

   A pen-test curl found CloudFront forwarding `Authorization` headers to the S3 error-page bucket, where S3 reflected every JWT back in its XML error response. Two lines of Terraform closed it across sixteen distributions.

   NH Nedim Hadzimahmutovic Aug 13, 2026 · 12 min
6. 
   email

   Implementing a Zero Auth Unsubscribe Link on Your Email

   Nobody logs in to unsubscribe. They mark you as spam instead. Here's the small trick we used — a signed token in the URL — so users can unsubscribe with one tap without ever seeing a login screen.

   AP Aditya Purwa Aug 10, 2026 · 6 min
7. 
   backend

   Splitting a Mega-Service Into Four: The Service-Facade Refactor (Plus a Reusable Skill)

   How we split a 1,307-line `user.service.ts` into four responsibility-tagged NestJS sub-services (query, mutation, membership, stats) behind a stable facade — no caller broke, no test changed, one PR, and a reusable Claude skill file at the end.

   TF Taufan Fadhilah Aug 5, 2026 · 8 min
8. 
   jwt

   How a JWT Audience Map Saved a CORS Mistake: A Defense-in-Depth Case Study

   On a client's API, a CORS wildcard looked like a HIGH severity finding — until we tried to actually exploit it. A second, independent JWT audience check turned a trivially exploitable bug into one that required a much harder prerequisite.

   NH Nedim Hadzimahmutovic Jul 22, 2026 · 7 min
9. 
   react native

   Asking For Notification Permission: The Second Time Is the Wrong Time

   iOS gives you exactly one shot at the native permission prompt. Here's the simple screen we show first, so users see what they'll get before the OS asks the question.

   AS Amar Spahic Jul 14, 2026 · 8 min
10. 
    application development

    An Event-Driven Architecture Case Study: Lessons from a Real-World Application

    A decade of Clearview engineering for a confidential awards group, and the event-driven AWS architecture that keeps it observable.

    NH Nedim Hadzimahmutovic Apr 7, 2025 · 9 min

No essays match that search.