A playground for my experiments.

Runtime

Data

Frontend

AI / LLM

Infra

Testing

AI output is text to check, not data to trust

Every app that calls an LLM treats the response as untrusted text. Parsing handles markdown fences, bare arrays, wrapper objects, and the fact that different providers don't enforce JSON schemas the same way. Calls go through OpenRouter, so I can swap models for cost or capability without touching that code.

Fix the class of the problem, not the instance

nginx strips an app's URL prefix before proxying to it. Passing that same prefix to FastAPI looks correct and quietly breaks static files. I hit that bug in eight different apps before I fixed it once, as a convention, instead of eight separate patches. Every background job also logs one ID per run now, so tracing a failure doesn't mean grepping blind.

Scaling limits are decisions, not surprises

A few apps hold state in memory: a list of open connections, a cron job, a rate limiter. Those only work with one gunicorn worker, so I pinned workers = 1 with a comment explaining why. If traffic ever needs more, the fix is Redis and a connection pool. I'd rather know that now than find it at 2am.

Every external call has a mock

The LLM, the scraper, the email service — each one has a mock built in from the start, not bolted on for tests later. Nothing in CI spends real money or waits on someone else's uptime, and each integration lives behind its own function instead of being scattered through the app.

Auth matches who's actually logging in

A public feature gets a magic link: no password, single use, expires fast. An admin page gets a real login that fails closed — if the password isn't set, nobody gets in, not the other way around. Different risk gets a different mechanism, and password checks use a constant-time comparison, not ==.

Nothing is trusted until it's checked

A URL I fetch, a page I scrape, text an LLM hands back — none of it is trusted until it's checked. I resolve hostnames before fetching so nothing can reach an internal service. I sanitize HTML before storing it. I rate-limit anything that costs money per call. All of that happens at the edge, before the data gets anywhere near the rest of the app.