Realtime & messaging
A POST is not your event
A 200 on a public webhook URL proves someone POSTed. It does not prove the body is yours — HMAC is the gate; a secret in env is not.
Production notes
What still breaks after the tests go green.
I write about shipping backend and fullstack systems: concurrent limits, offline-tolerant clients, chat-native flows, and working with AI copilots without trusting local happy paths.
Latest note
All notesA public notebook
Notes from real delivery: racey quotas, sync when a device is offline, messaging APIs, and the gap between a clean local demo and production.
Not a product catalog, a tutorial syllabus, or a course funnel. If a post names a tool, I used it. If it describes a failure, it happened.