Technical ideas, architecture, development practices, tools and problem solving.
An agent that runs while nobody watches needs to leave a trail. A beginner explanation with a shop CCTV picture: what to record, what never to record, a simple JSON Lines format, how to hide secrets and how to read the trail back to rebuild a timeline. Includes a script run for real on 25 actions.
Deleting an API key from your code is not the end: it stays in git history. A real experiment with fake keys, the right order when a key leaks (rotate first, clean later), how to block leaks with a pre-commit hook and .gitignore, and habits for working with AI agents.
AI coding is increasingly billed by the token. This post explains tokens with everyday pictures, why a long conversation gets more expensive with every turn, a script you can run to see it, and three ways to keep costs down: short sessions, cheaper models for routine work, caps and monitoring.
One click travels through seven legs: address lookup, connection, security, the request, the application, the database and the reply. An explanation with a parcel picture, how to time each leg with curl, exercises with answer keys and the mix-ups to avoid when you ask AI to fix a slow page.
Reproduce, shrink, form a hypothesis, halve the search with git bisect, then verify: five steps you can do yourself, and how to hand AI a good bug report afterwards. With a real 20-commit practice repo, an answer key and a bug report template.
Why queries get slow, how to read a query plan, why column order matters in a multi-column index and when an index hurts. Every number comes from a real SQLite experiment with 100,000 rows, with a script you can rerun and exercises with an answer key.
Agents edit code very fast, and sometimes get it wrong very fast. This post explains Git with the picture of save points in a game: one branch per task, small commits, reading the diff before you accept, and safe ways to go back, with real output from a practice repository.
An AI agent does not have unlimited memory: everything it is working with sits on a desk of fixed size. An explanation with everyday pictures of why long conversations make an agent worse, when to clear, summarize or start over, with a worked calculation, a handoff template and a checklist.
Instead of re-checking everything AI does yourself, ask it to hand in evidence that is easy to check: sources you can open, a test you can run, small changes, a sort into ran, only read and assumed, and a way for someone else to rerun it. With sample prompts, a time calculation and a checklist you can use tomorrow.
AI coding tools sometimes invent library names that do not exist, and attackers can register those exact names and hide malware in them. An explanation with everyday pictures, study numbers, real cases and install habits you can use tomorrow.
AI writes the code and the tests for it, so a test easily just confirms the code it just wrote. This article explains why green tests are not enough, gives a 500-thousand boundary example, and seven ways to keep tests valuable: write from the spec, see red first, break the code yourself, mutation testing, property-based testing, boundary tables and a real run.
Many teams build AI features but few measure them. This article shows how to start by reading thirty real cases, sorting the failures, and only then writing evals, following Hamel Husain and Shreya Shankar's guide, with a logging sheet, a three-afternoon plan and common mistakes.
Spec-driven development means writing down what to build first, then letting AI work from it. This article explains the three levels, the tools Kiro, Spec Kit and Tessl as analyzed by Martin Fowler, when it pays off and when it does not, with a light five-part spec template you can use today.
The OWASP Top 10 for LLM applications (2025 edition) is hard to read for newcomers. This article explains each entry with the picture of an AI hotel receptionist, gives the mitigations from OWASP's own pages, and suggests a priority order and a ten-question checklist.
MCP is a shared standard for AI apps to plug into tools and data, like one power socket for many appliances. This article explains it with the socket picture: the problem before MCP, the three things an MCP server offers, how it runs, the security risks and a checklist before plugging in.
AGENTS.md or CLAUDE.md is a file that briefs AI about your project. This article explains what it is, two studies with opposite results, six sections worth having, good and bad examples, a template to copy and how to keep the file accurate, with a real example from this very project.
AI writes code fast, so the bottleneck moves to review. This article gives a 15-point checklist in four groups, each point with warning signs, how to check and evidence, plus a PR description template and a way to use AI as a first reviewer without trusting it blindly.
AI writes fluently but does not check facts. This article explains with everyday examples why an answer that sounds right can still be wrong, tells real cases from working with AI, and shows how to check before trusting.