Software Engineering - csen2025.org

Preventing input validation and injection attacks.

Never Build a Query by Concatenating a String

I remember sitting in a windowless server room during my second year in industry, staring at a debug log that looked more like a fever dream than a sequence of commands. A junior dev had tried to solve a massive…

Secrets management basics: preventing public repository leaks.

A Secret in the Repository Is Already Public

I remember sitting in a windowless server room during my first year in industry, staring at a terminal while a senior engineer explained that we didn’t need a formal system because “everyone knows who has the keys.” That was a…

Authentication versus authorisation concept diagram.

Who You Are and What You May Do Are Separate Questions

I remember sitting in a windowless server room during my first year in industry, staring at a distributed trace that made absolutely no sense, all because a senior dev had conflated authentication versus authorisation in our service mesh. We had…

Implementing effective rate limiting approaches.

Protecting the Service From Its Most Enthusiastic User

I still remember the smell of ozone and burnt dust in the server room during my first real production outage. I was staring at a dashboard where every single metric was screaming red, all because we had implemented one of…

Principles of idempotent API design for retries.

A Retry Should Not Charge the Card Twice

I remember sitting in a windowless operations room three years ago, watching a dashboard turn a violent shade of crimson because a simple retry logic loop had just doubled every single transaction in our ledger. We weren’t facing a sophisticated…

Caching strategies and invalidation decision process.

Deciding When to Forget Is the Hard Half

I spent three months in a windowless lab during my PhD trying to prove that a specific distributed consensus model was “perfectly scalable,” only to watch it crumble the moment we introduced a real-world workload. The culprit wasn’t the consensus…

Visualizing the n plus one query problem.

One Loop, Four Hundred Round Trips

I remember sitting in a windowless server room three years ago, watching a dashboard turn a violent shade of red while a production service choked to death. We weren’t facing a massive data corruption issue or a sophisticated DDoS attack;…

The Optimiser Tells You Exactly What It Is About to Do

I remember sitting in a windowless server room during my second year in industry, staring at a terminal until my eyes burned, trying to figure out why a simple join was taking forty minutes. I had been told that the…

An Index Helps the Query You Wrote, Not the One You Meant

I remember sitting in a windowless server room three years ago, watching a dashboard turn a violent shade of red because our “state-of-the-art” indexing strategy had completely collapsed under the weight of actual user behavior. We had followed the textbook…

Schema design fundamentals: normalization and denormalization.

Normalise Until It Hurts, Denormalise Until It Works

I remember sitting in a windowless server room during my first industry research role, staring at a distributed database that was buckling under its own weight. We hadn’t failed because our hardware was weak or our code was sloppy; we…