Latest posts
-
Debugging Next.js Hydration Errors: The Right Way to Fix Them
Meta description: Passei horas rastreando Next.js hydration errors em produção. Veja como diagnostico e corrijo rapidamente — incluindo as armadilhas que mais me custaram tempo. Last updated: June 2026 Introduction I still remember the first time I saw this error in my Next.js app: “Error: Hydration failed because the initial UI does not match what…
-
Sign Software Artifacts with Cosign in GitLab CI/CD
Meta description: I show how to set up Cosign keyless signing in GitLab CI/CD — OIDC config, artifact signing, verification steps, and the real gotchas I hit along the way. Last updated: June 2, 2025 Last year, a vendor library we’d been pulling into production turned out to have been tampered with between the time…
-
Scan GitHub Actions for Hardcoded Secrets with TruffleHog
Meta description: Learn how I set up TruffleHog in GitHub Actions to catch hardcoded secrets before they hit production — real commands, gotchas, and a working YAML workflow included. Last updated: June 2, 2026 A few months ago, I was reviewing a routine pull request when something caught my eye: buried inside a config file…
-
How I Automated Terraform State Recovery After Corruption
Meta description: I reveal my battle-tested approach to automating Terraform state recovery. Learn backups, recovery scripts, and monitoring that prevent infrastructure disasters. Last updated: June 2026 ## Hook: The 3 AM Incident Three years into my DevOps career, I received a PagerDuty alert at 3 AM: my Terraform state file was corrupted. A botched merge…
-
Stop Next.js Hydration Errors: The Fix I Use in Production
Meta description: I reveal the exact debugging process to fix Next.js hydration mismatches. Learn which 3 mistakes cause 95% of these errors and how to prevent them. Last updated: June 2024 Hook: The Mysterious Flicker I was shipping a Next.js dashboard that looked perfect in development. Then it hit production, and something weird happened: the…
-
Migrating MongoDB to Atlas Without Downtime: A Practical Guide
Meta description: I migrated a self-hosted MongoDB cluster to Atlas with zero downtime using Live Migration. Here’s the exact process, real errors, and commands I used in production. Last updated: June 2025 Introduction Eighteen months ago, I got paged at 2 AM because our self-hosted MongoDB replica set had filled its disk. We patched it,…
-
React Multi-Step Form State Management Without Redux
Meta description: I manage multi-step form state in React without Redux — using useReducer and Context. Here’s the exact production pattern that cut my component size in half. Last updated: June 2026 Introduction I used to reach for Redux the moment a form had more than two steps. It felt safe — predictable state, dev…
-
Unit Testing AI Prompts: Reliable Tests for Non-Deterministic Outputs
Meta description: I spent months building a testing framework for AI prompt outputs — here’s exactly how I write reliable unit tests for non-deterministic LLM responses without losing my mind. Last updated: May 29, 2025 When I first started integrating LLM calls into production code, I made the mistake every developer makes: I treated prompt…
-
Integrate Ollama LLM into a TypeScript Backend: The Right Way
Meta description: Veja como integrei um LLM local com Ollama em um backend TypeScript — streaming, Docker e error handling prontos para produção, sem nenhuma API key. Last updated: May 27, 2025 The first time I ran a language model entirely on my own hardware and called it from a TypeScript API, I felt like…
-
Memory Leaks in React Native FlashList: How I Fixed Them
Meta description: Aprenda a debugar memory leaks no React Native FlashList com Hermes Profiler e Flipper — economizei 200MB+ de RAM em produção seguindo esses passos. Last updated: May 27, 2025 I was three weeks from shipping a social feed feature when my QA lead sent me a Slack message: “The app crashes after scrolling…
-
Shrink Docker Python Image Size 70% with Multi-Stage Builds
Meta description: I cut my Docker Python image from 1.2GB to 180MB using multi-stage builds. Here’s the exact Dockerfile, the mistakes I made, and the production results. Last updated: May 2026 The first time I containerized a Python data API, I pushed a 1.4GB Docker image to production and thought nothing of it. A senior…
-
Next.js App Router TTFB: How I Fixed a 4-Second Response Time
Meta description: I spent weeks diagnosing a 4-second TTFB on a Next.js App Router project. Here’s exactly how I fixed it — from cold starts to streaming and caching. Last updated: May 2026 A few months ago, a client called me frustrated. Their Next.js App Router app was loading painfully slowly — Lighthouse was screaming…
-
Reducing OpenAI API Costs: How I Cut My Bill by 60%
Meta description: I was burning $400/month on the OpenAI API until I fixed my prompts, added caching, and chose the right models. Here’s exactly what I changed and what it saved. Last updated: May 25, 2025 Last year I built a document summarization feature for a client’s internal tool. Usage was modest — about 200…
-
Secure API Key Management in Frontend Apps: The Right Way
Meta description: I’ve seen too many leaked API keys in production. Here’s how I lock down frontend apps with proven patterns — no more keys in your source code, ever. Last updated: May 25, 2025 A few years ago, I was reviewing a pull request from a junior dev on my team. The code looked…
-
API Performance in Production: Why It Gets Slow and How to Fix It
Meta description: I’ve debugged slow APIs at scale across multiple companies. Here’s what actually kills API performance in production — and the exact fixes I applied to recover it. Last updated: May 24, 2025 Introduction I’ve seen it play out the same way at three different companies. A new API ships, staging looks great, load…
-
Memory Leak in Node.js: How I Fixed a Massive One in Production
Meta description: I tracked down and fixed a critical memory leak in a Node.js production app crashing every 6 hours. Here’s every step I took, the exact tools I used, and what finally solved it. Last updated: May 24, 2025 Introduction At 3 a.m. on a Tuesday, my phone started blowing up. Our Node.js API…
-
Reduce React Native App Size on iOS and Android
Meta description: I cut our React Native app from 42 MB to 18 MB — here’s every proven technique I used, step by step, for both iOS and Android. No features removed. Last updated: May 23, 2025 When I pushed our first React Native release to the App Store, the IPA weighed in at 42…
-
Reduce React Native App Size on iOS and Android
Meta description: I cut our React Native app from 42 MB to 18 MB — here’s every proven technique I used, step by step, for both iOS and Android. No features removed. Last updated: May 23, 2025 When I pushed our first React Native release to the App Store, the IPA weighed in at 42…
-
JWT Refresh Token Race Conditions: How I Finally Fixed It
Meta description: I’ve debugged silent logouts and duplicate refresh calls caused by JWT race conditions. Here’s the exact queue-based pattern I use in production to fix it for good. Last updated: May 20, 2025 Introduction About two years ago, I was debugging a strange bug where users would randomly get logged out mid-session on a…
-
Debugging Next.js Hydration Errors: The Complete Guide
Meta description: I’ve spent hours tracking down hydration mismatches in Next.js. Here’s every root cause I’ve hit, how I diagnosed each one, and the exact fixes I use in production. Last updated: May 20, 2026 Introduction The first time I hit a Next.js hydration error in production, the app looked completely fine in development. No…
-
Core Web Vitals Optimization for SPAs: The Right Way to Score Green
Meta description: I spent weeks fixing Core Web Vitals for a React SPA with poor LCP and CLS scores. Here’s exactly what I changed to hit green across all metrics in production. Last updated: May 19, 2025 When I first ran a Lighthouse audit on our company’s React SPA, I was genuinely embarrassed. LCP sitting…
-
GitHub Actions Cache Tuning for Faster Builds: Stop Waiting, Start Shipping
Meta description: I cut our GitHub Actions build time from 14 minutes to under 3 minutes by tuning cache keys and restore strategies. Here’s the exact config I use in production. Last updated: May 19, 2025 Our CI pipeline was slowly killing developer velocity. Every pull request triggered a 14-minute build. Multiply that by 40…
-
How to Fix Apple App Store Rejection for Missing Privacy Descriptions
Meta description: My app got rejected by Apple for missing NSUsageDescription keys. Here’s the exact fix, the keys you need, and how to avoid rejection on your next submission. Last updated: May 2026 The Rejection Email Nobody Wants to See I was three days from a client’s launch deadline when Apple rejected the app. The…
-
Why Tailwind CSS Dynamic Classes Break in Production (And How to Fix It)
Meta description: I spent hours debugging missing Tailwind styles in production. Here’s exactly why dynamic classes get purged and the right way to fix it without bloating your CSS. Last updated: May 2026 The Production Bug That Wasted My Afternoon I had just deployed what I thought was a clean feature — a dynamic alert…
-
React Native Reanimated Stuttering: Fix Android Performance on Low-End Devices
Meta description: I solved React Native Reanimated stuttering on low-end Android devices by profiling the UI thread, fixing worklet misuse, and applying layout optimizations that cut jank by 80%. Last updated: May 2026 Introduction I shipped what I thought was a polished React Native app — smooth 60fps animations on my Pixel 8 Pro, buttery…
-
AWS NAT Gateway Costs: How I Cut My Startup’s Bill by 70%
Meta description: I reduced our startup’s AWS NAT Gateway bill from $400 to under $120/month using VPC endpoints, traffic routing fixes, and architecture changes any small team can replicate — no major refactors needed. Published on spiritcode.blog — Last updated: May 2026 Introduction The first time I saw our AWS bill spike past $400 in…
-
Deploy Day Anxiety: The Pre-Production Ritual That Keeps Me Sane on Fridays
Meta description: I used to white-knuckle every Friday deploy. Here’s the exact mental and technical ritual I built to neutralize pre-production anxiety and ship with clarity instead of dread. Last updated: May 15, 2026 TL;DR The Friday Deploy That Almost Broke Me It was 4:47pm on a Friday. I was about to push a database…
-
The Lonely Remote Worker Spiral: How I Broke the Isolation Cycle Working Remote in a New City
Meta description: I moved to a new city, worked 100% remote, and nearly lost my mind. Here’s the exact connection ritual I built to stop the loneliness spiral before it swallows you whole. Last updated: May 15, 2025 TL;DR The Day I Realized I Was in the Spiral It was a Tuesday. I had shipped…
-
Technical Writing for Engineers: How I Went From Bad Docs to Great Ones
Meta description: I spent years writing documentation nobody read — here’s the exact technical writing framework I now use to create clear, useful, developer-friendly docs that actually get maintained. Last updated: May 14, 2025 Three years into my engineering career, my team lead pulled me aside after a sprint review. “Your code is great,” she…
-
Secret Management for Startups: Stop Hardcoding Credentials
Meta description: I learned the hard way why secret management for startups matters — here’s the exact setup I use in production to keep API keys and credentials safe from day one. Last updated: May 14, 2025 Early in my startup career, I pushed a commit to a public GitHub repo with an AWS access…
-
Refactoring Legacy PHP Monoliths: A Step-by-Step Modular Guid
I walked a 10-year-old PHP monolith into a modular architecture without downtime — here’s the exact strategy, tools, and hard lessons I learned along the way. I once opened a PHP file called functions.php that was 14,000 lines long. No classes. No namespaces. Global variables everywhere, database queries inline with HTML, and business logic tightly…
-
CSS Variables Naming in Design Systems: The Right Way to Scale
I share the exact CSS variable naming conventions I use in large-scale design systems to keep tokens consistent, maintainable, and team-proof across every component. Three years ago, I inherited a design system with over 400 CSS custom properties named things like –blue, –blue2, –blueNew, and — my personal favorite — –blueActualFinal. Changing the brand’s primary…
-
Refactoring Legacy PHP Monoliths: A Step-by-Step Modular Guide
Meta description: I walk through how I broke apart a 200,000-line PHP monolith into clean, testable modules — without stopping feature delivery or rewriting everything from scratch. Last updated: May 2026 Introduction In my second year at a mid-sized e-commerce company, I inherited a PHP application that had been in production since 2009. It had…
-
Memory Leak Detection in Python: Fix Long-Running Scripts for Good
Last updated: May 2026 Meta description: I show you how I track down and fix memory leaks in long-running Python data pipelines — using tracemalloc, objgraph, and real production techniques that actually work. Introduction I used to run a nightly ETL pipeline that processed about 40 GB of JSON logs. Every morning I’d find it…
-
WSL2 + Zsh: The Right Way to Run a Linux Dev Environment on Windows
Description: I ditched dual-boot and set up a full Linux dev environment on Windows using WSL2 and Zsh. Here’s exactly how I did it — step by step, with every gotcha documented. Last updated: May 10, 2025 Introduction For years, developing on Windows felt like swimming upstream. I kept a dual-boot Ubuntu setup and rebooted…
-
GitHub Actions + Trivy: Automate Docker Image Scanning the Right Way
description: I integrated Trivy into our GitHub Actions pipeline to catch CVEs before they reach production. Here’s my exact workflow config, the gotchas I hit, and how to tune severity thresholds. Introduction My team shipped a Node.js API to production last year with a critical CVE hiding inside our base image. We didn’t know until…
-
Pandas to Polars: A Practical Migration Guide for High-Performance Python Teams
Published on SpiritCode.blog | Performance Engineering & Data Science I’ll be straight with you: I was a Pandas loyalist for years. I knew its quirks, had workarounds for its memory issues, and defended it in architecture meetings. Then I hit a 40GB CSV that had to be processed in under 10 minutes on a machine…
-
Automating HIPAA-Compliant Data Masking in Python ETL Pipelines
Published on SpiritCode.blog | Data Engineering & Compliance When I joined a healthcare analytics startup a few years back, one of the first things that landed on my desk was a compliance audit report with a long list of red flags. Patient names in plaintext. Social Security Numbers sitting in a staging table. ZIP codes…
-
Your Go Service Is Leaking Memory and You Don’t Know It Yet — A Production pprof Survival Guide
How I Stopped Getting Paged at 3 AM by Learning to Profile Heap and Goroutine Leaks Before They Escalate Introduction: The OOM Kill Nightmare at 3 AM It was a Tuesday night. I was deep in sleep when my phone blew up. PagerDuty. Then Slack. Then a second PagerDuty alert. Our Go API — handling…
-
Beyond Default Docker: My Guide to Hardening Kernels with Custom Seccomp Profiles
Stop Trusting the Defaults. Your Containers Are More Exposed Than You Think. Introduction: The Danger of Unfiltered Syscalls A few years back, I was doing a security audit for a fintech client running a fairly standard Docker setup on AWS. Their containers were “secured” — namespaces, cgroups, a non-root user, the whole checklist. What they…
-
Micro-Frontends with Module Federation: How I Finally Escaped Dependency Hell (And Why Build-Time Integration Is a Trap)
The honest, production-tested guide to implementing micro-frontend architecture with Webpack 5 and Rspack — including the mistakes I made so you don’t have to. The Monolith That Almost Broke My Team Picture this: a 400,000-line React monolith shared by six product teams across three time zones. Every dependency upgrade becomes a negotiation. A react-dom version…
-
How I Hardened Our Docker Supply Chain: A Practical Security Guide
How I stopped shipping “mystery meat” container images — and the tools that changed the way my team thinks about Docker security in 2025. Why This Keeps Me Up at Night (And Should Keep You Up Too) A few years back, I inherited a microservices platform that had been running in production for 18 months.…
-
Moving Beyond the VPN: My Hands-On Guide to Zero Trust for Remote Engineering Teams
By SpiritCode | Security Engineering · DevOps Culture There’s a mental model baked into most corporate security infrastructure that goes something like this: inside the network is safe, outside is hostile. The VPN was the drawbridge. Get across it, and the castle trusts you. That model is dead. It has been dead for a while.…
-
Beyond Prompt Engineering: Why and How I Fine-Tune Open Source LLMs for Niche Business Logic
By SpiritCode | LLM Engineering · Applied AI There’s a moment every AI-curious engineer hits: you’ve written a clever system prompt, chained a few tools together, and the demo looks great. Then someone from the actual business team says “can it understand what we mean by a ‘C3 deviation’ or a ‘closed-won reforecast’?” and the…
-
Why Your Snowflake Bill Is So High (And Exactly How I Fixed It)
How I Cut Our Snowflake Bill by 40% Without Touching a Single Pipeline A battle-tested, SQL-heavy playbook from the trenches of a $300K/month data warehouse problem. By Rafael Dias · Senior Data Engineer · May 2026 · ~2,400 words The $87,000 Wake-Up Call I still remember the exact moment. It was a Tuesday morning in…
-
Handling Messy LLM JSON: How I Use Pydantic to Fix Broken AI Outputs
Your LLM is Lying About Its JSON. Here’s How I Force it to Tell the Truth. There is nothing quite as frustrating as watching your beautifully crafted agentic workflow crash because GPT-4 decided to wrap its JSON response in conversational prose. You asked for a schema; it gave you: “Sure! Here is the data you…
-
Secure Remote Dev Has Finally Been Solved: Tailscale + VS Code
Ditch the Legacy VPN: My Guide to a Secure, Fast Remote Dev Setup with Tailscale I’ve spent a non-trivial portion of my career fighting with legacy VPNs. You know the drill: clunky clients that drop connection when your laptop sleeps, complex firewall rules that feel like playing Jenga, and the constant anxiety of exposing your…
-
Trim the Fat: How I Reduced My Android App Size by 40% Using R8
Why Every Megabyte Matters for Your Install Rate Let’s be real: nobody likes a bloated app. We’ve all seen the data—for every 6MB increase in APK size, you can expect a 1% drop in install conversion rates. In emerging markets, that number is even more brutal. Yet, as developers, we keep adding libraries like they’re…
-
How to Secure React SPAs Against XSS Using Secure JWT Cookies
Stop Storing JWTs in LocalStorage: The Secure Way to Handle Auth in React We’ve all been there. You’re building a sleek React SPA, you’ve got your JWT (JSON Web Token) from the backend, and you need a place to put it. The easiest path? localStorage.setItem(‘token’, jwt). It’s simple, it persists through refreshes, and it’s what…
-
How I Build Bulletproof Accessible Forms for Federal Agencies
Beyond Compliance: My Guide to Building WCAG-Ready Forms for Government Contracts When I first started consulting for US government contractors, I quickly realized that “accessibility” wasn’t just a checkbox for a better UI—it was a strict federal mandate. In the world of public sector tech, if your forms aren’t Section 508 compliant, you aren’t just…