Writing
Articles
Technical writing on architecture, testing, security, and product delivery. Grounded in systems I have shipped.
Themes
What I write about
Short, practical pieces. Less tutorial noise, more decisions from production.
Architecture
Boundaries, rendering strategy, and cloud-native product shapes that survive real traffic.
Quality and security
Testing strategy, OWASP practice, and the checks that belong in CI before users notice.
Product delivery
Standards and habits that keep multi-team products coherent without process theatre.
Product systems
Analytics, feature flags, and observability as part of the platform, not bolted on later.
Published
Latest
- PublishedMonorepoArchitectureFira.NET Aspire
Monorepos on Fira
Why Fira lives in a backend monorepo: Keycloak, Kafka, Redis, Docker, and .NET Aspire as one coherent spine, with shared contracts and clear service boundaries. Still in progress.
Read → - PublishedNext.jsCache ComponentsPPR
Migrating to Next.js Cache Components
Notes from migrating an App Router product onto Cache Components: use cache, Suspense shells, remote vs in-memory cache, and the gotchas that show up in production.
Read → - PublishedPKCEOAuthSPASecurity
PKCE for SPA authentication
Why single-page apps need Proof Key for Code Exchange, how the verifier and challenge work, and when a BFF is the better place for tokens.
Read → - PublishedCacheSecurityCDN
Web cache deception
How CDNs can cache private HTML under public URL shapes, and what frontend plus platform teams should set on authenticated pages.
Read → - PublishedAzure FunctionsServerlessRhema.NET
Going fully serverless on Rhema Bible
How cost pushed Rhema from ASP.NET controllers to Azure Functions, how the 1M free monthly executions funded early growth, and why HTTP, queue, and timer triggers fit a mobile event-driven backend.
Read → - PublishedPrototype pollutionSecurityJavaScript
Prototype pollution in JavaScript apps
Unsafe deep merges of untrusted JSON, __proto__ payloads, and safer patterns for frontend state and config merging.
Read → - PublishedSSRFSecurityNext.js
SSRF from frontend features
When URL inputs, previews, and proxies turn your server into an internal scanner, and how to allowlist safely in Next.js actions.
Read → - PublishedTestingTesting LibraryAccessibility
Testing the experience, not the DOM
A practical Testing Library strategy: toBeVisible, userEvent, role queries, and getBy versus findBy versus queryBy. Built for product teams writing new tests.
Read → - PublishedNext.jsSSRArchitecture
Rendering strategies in real product apps
SSG, ISR, SSR, streaming, and client islands with examples from content platforms, compliance products, and AI SaaS. Benefits and trade-offs per route.
Read → - PublishedClickjackingSecurityCSP
Clickjacking and frame defences
Framing attacks against sensitive UI actions, and how frame-ancestors plus confirmation flows protect frontend apps.
Read → - PublishedSecurityOWASPNext.js
OWASP Top 10 for Next.js apps
OWASP Top 10 mapped to Next.js: Server Actions, Route Handlers, middleware, RSC, cookies, and the footguns that show up in real App Router products.
Read → - PublishedCORSSecuritySPA
CORS for frontend engineers
What CORS actually controls in the browser, why wildcard origins with credentials are dangerous, and why same-origin BFFs stay simpler.
Read → - PublishedJWTBFFAuthNext.js
Handling JWT tokens in a modern BFF architecture
How I keep JWTs out of the browser’s reach: BFF-issued sessions, httpOnly cookies, short-lived access tokens, and same-origin rewrites.
Read → - PublishedCSRFSecurityCookies
Cross-site request forgery for cookie sessions
CSRF against cookie-authenticated frontend apps and BFFs: SameSite, anti-forgery tokens, and why GET must stay read-only.
Read → - PublishedXSSSecurityFrontend
Cross-site scripting in frontend apps
How XSS shows up in React and Next.js products, why dangerouslySetInnerHTML keeps biting teams, and practical hardening with sanitisation and CSP.
Read →
Pipeline
Planned pieces
- PlannedAzure.NETArchitecture
Cloud-native product architecture
Service boundaries, serverless functions, messaging, and cost controls drawn from a production SaaS codebase.
- PlannedFull-stack.NETNode
Choosing .NET or Node for a product backend
Decision criteria from shipping both stacks on separate production products.
- PlannedWCAGProductHealthcare
Building UIs for regulated domains
Accessibility, clinical and consumer constraints, and keeping requirements explicit in the interface.
More pieces in progress. Contact for roles or technical discussion.
Availability
Open to opportunities
Open to senior product engineer roles with real ownership across the stack. Security-minded by default.
UK-based · Remote / hybrid · Permanent or contract