/Blog

Blog

Content about design, technology, and the weird stuff in between.

July 22, 20267 min read

Prompt Injection Is a Code Execution Primitive Now

Microsoft's CVE-2026-25592 showed a single injected prompt driving host-level RCE. Your threat model still treats it like a content problem. That's the bug.

July 20, 20268 min read

Johnny Unar

Stop Constraining Agents With Prompts, Constrain Them With Infrastructure

Stripe's Minions ship 1,300 zero-human PRs a week against a trillion-dollar codebase. The trick isn't a smarter model, it's making the sandbox the permission system.

July 15, 20266 min read

Johnny Unar

The Axios Postinstall Hook Was the Whole Attack

Sapphire Sleet published axios@1.14.1 with a RAT in a postinstall hook. OIDC Trusted Publishing didn't save anyone. Here's the misconfiguration that actually let it happen.

July 8, 20267 min read

Johnny Unar

AI Is Rewriting Your IAM Layer and Nobody Reviews the Diff

A hands-on audit playbook for the overly broad permissions that LLM-generated backend code quietly bakes into your codebase on every PR.

July 1, 20269 min read

Johnny Unar

Server Actions Are Public Endpoints, Treat Them Like It

Every exported Server Action is a callable HTTP endpoint with no auth, no rate limiting, no validation. Here's the hardening checklist we run on every Next.js project.

June 29, 20266 min read

Johnny Unar

The Homogenization Trap: Why Every AI-Designed UI Looks Identical

72% of designers now use generative AI, and the result is a sea of interchangeable SaaS dashboards. Tactile brutalism is the engineering answer.

June 24, 20268 min read

Johnny Unar

AI Code Passes CI and Breaks Production Anyway

Your CI was built for deterministic human code. AI output is probabilistic and context-sensitive, and your validation pipeline has no primitives for catching where it fails.

June 22, 20266 min read

Johnny Unar

You Are Paying for AI to Write the Bugs It Will Charge You to Fix

Velocity numbers measuring code written instead of value delivered are how engineering leaders are quietly fooling their own boards in 2026.

June 17, 20267 min read

Johnny Unar

Your Tests Passed and Production Still Broke: The AI Verification Gap Nobody Wants to Name

81% of tech leaders report more production failures from AI code even with 92% pre-deploy confidence. The gap isn't volume, it's the pipeline itself.

June 15, 20269 min read

Johnny Unar

The Vercel Breach Is a Template for How OAuth Sprawl Kills You

A hands-on audit guide for finding the silent OAuth grants, stale tokens, and unencrypted env vars that turn one phished laptop into a full breach.

June 10, 20267 min read

Johnny Unar

Your AI Dev Toolchain Is the Attack Surface

The June 2026 Microsoft GitHub compromise targeted developers running Claude Code and Gemini CLI. Your AppSec posture was never built for this.

June 8, 20268 min read

Johnny Unar

Your AI Coding Budget Is Buying the Illusion of Speed

84% of developers use AI tools, but org-wide productivity is stuck at 10-30%. Here's where the ROI actually disappears and what to do about it.

June 3, 20268 min read

Johnny Unar

SLSA Provenance Did Not Save TanStack

84 malicious package versions shipped with valid SLSA Build Level 3 attestations. The attacker hijacked the pipeline, not the credentials. Provenance signed the malware.

June 1, 20266 min read

Johnny Unar

The METR Productivity Illusion in Real Engineering Work

METR found senior devs were 19% slower with AI but felt 20% faster. That 39-point gap should change how you measure AI tooling.

May 13, 20269 min read

Johnny Unar

Structured Outputs Guarantee Syntax, Not Sanity

GPT-4o's JSON mode gives you valid JSON. It doesn't give you correct data. Here's why that distinction is destroying pipelines.

May 11, 202610 min read

Johnny Unar

Postgres + pgvector 0.8 Is Probably Enough for Your Embeddings

Before you spin up Pinecone or Qdrant, read this. We benchmarked pgvector 0.8 HNSW against Qdrant 1.13 and the results will bore you in the best way.

May 4, 202612 min read

Johnny Unar

Tool Calls Are Not Actions: Build an Approval Queue First

The gap between an LLM returning a tool-call and actually running it against live data is where AI features go wrong. Here's the concrete pattern.

April 29, 20268 min read

Johnny Unar

Structured Outputs Guarantee Shape, Not Semantics

JSON mode doesn't mean your LLM output is safe to use. Here's why you need a schema contract layer on top of it.

April 27, 20269 min read

Johnny Unar

Structured Outputs Don't Mean Your LLM Data Is Correct

Schema conformance is trivially easy. Semantic correctness is where LLM pipelines actually fall apart, and most teams never notice until production.

April 22, 20269 min read

Johnny Unar

Stop mocking your database: Postgres 17 makes it unnecessary

Mocking your DB keeps tests green and production broken. Here's how transaction savepoints and schema isolation fix that.

April 20, 20269 min read

Johnny Unar

Your AI Feature Ships Fast and Rots Faster

Shipping a GPT-4o integration takes a weekend. Maintaining it takes a policy. Here's the one-page lifecycle template we actually use.

April 13, 20269 min read

Johnny Unar

Postgres Outbox Beats RabbitMQ for Webhook Ingestion Under 5k RPM

Before you bolt on SQS for webhook reliability, read this. A Postgres outbox table and a Go worker will serve most startups better.

April 8, 20269 min read

Johnny Unar

Postgres RLS Is Your Real Tenant Isolation Layer, Not Django

Manual WHERE clauses in your ORM will eventually leak tenant data. Here's how to wire Postgres 17 RLS into Django 6.x properly.

April 6, 202612 min read

Johnny Unar

Stop warming pools: adaptive CPU-bursting that actually saves money

Warm pools feel like a win until the AWS bill arrives. Here's a concrete pattern with Go worker pools, Redis token buckets, and KEDA that gets you sub-200ms p95 without paying for idle CPUs.

April 1, 202612 min read

Johnny Unar

Edge for delivery, Go for domain

A strict partitioning recipe for Next.js 15 and Go 1.22, with auth, SSR streaming, flags, observability, and none of the hand-wavy edge hype.

March 30, 202610 min read

Johnny Unar

One npm package nearly owned our Next.js 15 app

A postinstall hook, a remote loader, and a few ugly hours in CI. The fixes were simple once we stopped pretending JavaScript supply chain risk was theoretical.

March 26, 202610 min read

Johnny Unar

Stop Paginating in the Client, Let Next.js 16 Do It

Client-side pagination burns memory, inflates TTFB, and makes UX flaky. Cursor APIs plus route-segment caching fix the mess without a rewrite.

March 25, 202610 min read

Johnny Unar

A sane monorepo needs hard boundaries

Monorepos work fine in 2026, if you treat boundaries as code and automate enforcement. Our setup is boring on purpose, and that’s why it holds.

March 24, 202610 min read

Johnny Unar

Swap Encoders Without Torching Retrieval

Embedding model upgrades break search in quiet, expensive ways. This is the rollout playbook we use to ship encoder changes without wrecking retrieval.

March 23, 202611 min read

Johnny Unar

Edge observability is mostly a telemetry problem

Next.js 15 edge functions and Go 1.22 services need different observability than long-lived servers. Trace cold starts, collect sampled flamegraphs, and tail-sample hard.

March 22, 202610 min read

Johnny Unar

Don’t ship agent chains to SMB customers

Agentic tool orchestration looks clever in demos and turns ugly in production. Use typed function calls, deterministic proxies, and explicit fallbacks instead.

March 21, 202610 min read

Johnny Unar

Stop shipping business logic in Next.js edge

Use Edge for fast decisions, keep stateful work in Go. This split fixes correctness bugs, retries, and observability holes that keep showing up in SaaS systems.

March 20, 202610 min read

Johnny Unar

Kill the GraphQL gateway at 12 services

Federation adds a governance tax most mid-stage startups can't afford. Typed OpenAPI and consumer-driven contracts bring back speed and make failures obvious.

March 19, 20269 min read

Johnny Unar

Zero-Downtime Django Postgres Migrations Need Multi-Step Plans

Safe schema changes in a Django monolith come from staged rollouts, backfills, and boring operational discipline. Squashed migrations won't save you.

March 18, 202614 min read

Johnny Unar

Multi-tenant Postgres 16: pick RLS unless proven otherwise

Most SaaS teams should default to Row Level Security in Postgres 16. The hard part isn't SQL, it's pooling, migrations, and operational discipline.

March 17, 202610 min read

Johnny Unar

Stop Forcing Analytics Through Django ORM

Reporting code packed into chained QuerySets gets slow, fragile, and unreadable. Put heavy analytics back in SQL, where Postgres can actually help you.

March 16, 20269 min read

Johnny Unar

Ship prompts like code, or expect regressions

Production LLM features rot quietly. Version prompts, test them in CI, canary against shadow traffic, and make rollback boring.

March 15, 20269 min read

Johnny Unar

Ship one correct admin workflow

Config panels feel like product progress until they turn your SMB app into a support machine. Pick one strong admin path and defend it.

March 14, 202610 min read

Johnny Unar

Treat hallucinations like system failures

Hallucinations leave fingerprints. Instrument token probabilities, track evidence provenance, and gate actions with cheap verifiers before anything touches production.

March 13, 20269 min read

Johnny Unar

GPU, API, or CPU batching for AI inference

Most startup AI infra decisions get made on vibes. Use throughput, tail latency, token volume, and ops burden to pick the least painful option.

March 12, 202611 min read

Johnny Unar

Bill compute, kill per-request pricing

Per-request billing punishes automation and rewards waste. Meter compute instead, and your SaaS economics stop behaving like a bug.

March 11, 202611 min read

Johnny Unar

API rewrites are governance failures

Most API rewrites happen because teams skipped contracts, versioning, and deprecation discipline. A small amount of governance fixes that without slowing delivery.

March 10, 202610 min read

Johnny Unar

Embedding drift will quietly wreck your retrieval

Vector search degrades slowly, then all at once. Measure drift before recall collapses and model upgrades torch production.

March 9, 20269 min read

Johnny Unar

Messy PDFs will wreck your pipeline unless you pin every step

Naive OCR and embeddings pipelines fail quietly on real PDFs. A layout-aware, deterministic ingestion stack gives you drift detection and rollback.

March 8, 202610 min read

Johnny Unar

Deterministic Tests for RAG Pipelines or Don't Ship

LLM features fail quietly. A real test suite for RAG needs frozen snapshots, adversarial prompts, and contracts around retrieval and attribution.

March 7, 202610 min read

Johnny Unar

HTMX inside Next.js cut our frontend mess

For internal tools and B2B portals, HTMX inside Next.js ships faster, ships smaller, and breaks less than a full SPA stack.

March 6, 20269 min read

Johnny Unar

Stop trusting Lighthouse for product decisions

Lighthouse is fine for smoke tests. Revenue decisions need RUM, user journeys, and performance data tied to conversion.

March 5, 202611 min read

Johnny Unar

Stop Choosing Microservices for Your ERP

Most startup ERP teams don't need microservices. Django 4.2 and PostgreSQL 15 will carry you much further, with less pain and fewer 2am surprises.

March 4, 202610 min read

Johnny Unar

pgbouncer before more workers

Postgres connection limits usually point to bad app config, not a scaling crisis. Fix pooling first, then decide if you need more compute.

March 3, 202610 min read

Johnny Unar

Next.js Edge Functions Are a Bad Place for Real Backend Logic

Edge runtimes look fast in demos, then fall apart under real backend constraints. A hybrid edge plus regional model gives you speed without wrecking correctness.