The notes I would have wanted at fifteen.
Long form pieces on shipping production systems, scaling SaaS, hiring engineers, AI integration, and the engineering decisions behind Yashveer Labs.
799 posts · page 28 of 34
- Security, Auth, and Compliance
The Threat Model: How to Build One in Two Hours
A threat model does not have to be a hundred-page document. A useful one fits on a whiteboard, takes two hours to build, and changes how the team makes security decisions for months. Here is the format I use.
13 min read
- Security, Auth, and Compliance
The Permission System That Scales With Your B2B Customers
Most B2B permission systems break when the second enterprise customer asks for a different role model. Building it right from the start means picking the right abstraction, not the fastest one.
12 min read
- Security, Auth, and Compliance
The Bug Bounty Decision: When You Are Ready, When You Are Not
How to decide if your SaaS is ready for a bug bounty program, what readiness actually looks like, and what happens when you launch one too early.
12 min read
- Security, Auth, and Compliance
Vulnerability Disclosure Programs: Why Even Small Teams Need One
A vulnerability disclosure program is a public commitment to listen when someone finds a security issue in your product. It costs nothing and prevents the worst version of every incident. Most teams skip it because they have not thought about what they will do when a researcher emails them.
11 min read
- Security, Auth, and Compliance
The Single Tenant Argument: When Enterprise Customers Demand It
Enterprise customers who demand single tenant deployments are not being irrational. They are making a calculation about data isolation and audit scope. Here is how to evaluate the request and when to say yes.
11 min read
- Security, Auth, and Compliance
The Security Gap: How One Missing SOC 2 Control Kills Your Enterprise Deal
Enterprise buyers do not walk away from deals because your security is bad. They walk away because one specific gap appears in the security questionnaire and nobody can answer it. Here is how to find that gap before they do.
12 min read
- Backend, APIs, and System Design
Why Your Service Should Have Two Health Checks Not One
A single /health endpoint is doing two jobs that contradict each other. One health check is for the load balancer. A different one is for the orchestrator. Conflating them is how a healthy service gets restarted into an outage.
12 min read
- Backend, APIs, and System Design
The Health Check Endpoint: Less Trivial Than It Looks
Why health check endpoints are more complex than returning 200 OK -- and how to design them to actually tell you whether your service is healthy.
12 min read
- Backend, APIs, and System Design
Timeouts: The Setting Most Engineers Get Wrong
Working notes on timeouts: the setting most engineers get wrong. Written for founders, engineers, and operators who want a clear read on backend, apis, and system design from someone who has shipped the work.
11 min read
- Backend, APIs, and System Design
The Backend Engineer's Reading List for 2026
The books, resources, and reference materials that actually make backend engineers better. Curated from what I return to on client projects.
12 min read
- Backend, APIs, and System Design
The Boring API: Why Predictability Beats Cleverness
Why the most durable APIs are the most predictable ones, and why clever API design decisions become maintenance nightmares within two years.
12 min read
- Backend, APIs, and System Design
Why Logical Deletes Are Almost Always a Mistake
Soft deletes feel safe until the schema rot and query complexity make everything harder. Here is the case against them, when they are genuinely warranted, and what to use instead.
12 min read
- Backend, APIs, and System Design
The Soft Delete Trap: A Pattern That Catches Up With Teams
Working notes on the soft delete trap: a pattern that catches up with teams. Written for founders, engineers, and operators who want a clear read on backend, apis, and system design from someone who has shipped the work.
11 min read
- Backend, APIs, and System Design
Time Series Data in SaaS: When to Pull in TimescaleDB or InfluxDB
Working notes on time series data in saas: when to pull in timescaledb or influxdb. Written for founders, engineers, and operators who want a clear read on backend, apis, and system design from someone who has shipped the work.
12 min read
- Backend, APIs, and System Design
The State Machine Pattern: A Backend Engineer's Quiet Hero
Working notes on the state machine pattern: a backend engineer's quiet hero. Written for founders, engineers, and operators who want a clear read on backend, apis, and system design from someone who has shipped the work.
12 min read
- Backend, APIs, and System Design
The Multi Tenant Database: One Schema or Many?
The three multi-tenancy models for SaaS -- shared table, separate schema, separate database -- and when each one is worth its complexity.
12 min read
- Backend, APIs, and System Design
Zero Downtime Database Migrations: A Step By Step Guide
Most outages I have seen during a schema change were avoidable. Zero downtime migrations are not magic. They are a discipline. This is the sequence I use on real production systems, with the traps that catch teams who skip a step.
13 min read
- Backend, APIs, and System Design
The Replication Lag Problem: How to Detect and Defend
Working notes on the replication lag problem: how to detect and defend. Written for founders, engineers, and operators who want a clear read on backend, apis, and system design from someone who has shipped the work.
12 min read
- Backend, APIs, and System Design
The Write Heavy Workload: A Different Set of Tradeoffs
Working notes on the write heavy workload: a different set of tradeoffs. Written for founders, engineers, and operators who want a clear read on backend, apis, and system design from someone who has shipped the work.
11 min read
- Backend, APIs, and System Design
The Read Heavy Workload: Strategies That Move the Needle
Working notes on the read heavy workload: strategies that move the needle. Written for founders, engineers, and operators who want a clear read on backend, apis, and system design from someone who has shipped the work.
12 min read
- Backend, APIs, and System Design
The Edge: When to Move Logic Off Your Origin
What belongs at the CDN edge, what must stay at origin, and how to make the decision correctly for your specific workload.
12 min read
- Backend, APIs, and System Design
The Outbox Pattern: A SaaS Reliability Cheat Code
Working notes on the outbox pattern: a saas reliability cheat code. Written for founders, engineers, and operators who want a clear read on backend, apis, and system design from someone who has shipped the work.
12 min read
- Backend, APIs, and System Design
The N+1 Query Problem: Detection, Prevention, and Refactoring
How the N+1 query problem degrades API performance at scale, how to detect it with query logging, and how to fix it with joins and data loaders.
12 min read
- Backend, APIs, and System Design
Webhooks vs Polling vs Server Sent Events vs WebSockets
Working notes on webhooks vs polling vs server sent events vs websockets. Written for founders, engineers, and operators who want a clear read on backend, apis, and system design from someone who has shipped the work.
13 min read
More than blog posts.
The Labs folder has the experiments themselves. The Systems folder has the stack and architecture. The Journey folder has the timeline. Pick whichever pulls you.