Writing
Deep dives into Next.js, PostgreSQL, Supabase, and production engineering — written while building AI Art Arena from scratch.
A production Next.js + Supabase voting platform, built entirely in public with every decision documented. Here is what that actually looked like — the architecture, the bugs that got shipped, the things that only broke under concurrency, and what Directed Output means in practice.
26 May 2026
12 min read
Submitting a username left the app stuck on the onboarding page with no way to proceed — and the fix exposed two more routing bugs hiding in the same codebase. Here is exactly what broke and why.
25 May 2026
7 min read
Every link on my profile page was broken. After an afternoon of chasing URLs, I understood why — and instead of patching the links, I built a tool that makes this class of bug impossible to miss. That is the difference.
21 May 2026
7 min read
Every AI art voting platform asks one question: which image is better? We added a second: did it nail the prompt? Here is exactly what that required at the schema level, why a junction table beats a simple counter, and the one design decision the obvious approach gets wrong.
21 May 2026
8 min read
Five sequential database queries in a vote handler create race conditions and ~200ms latency. One atomic PostgreSQL function eliminates both. Here is the exact problem, the fix, and what the refinement loop looked like getting there.
19 May 2026
8 min read
Storing raw IP addresses is a GDPR liability. Hashing them one-way with a secret salt gives you everything you need for rate limiting with none of the exposure. Here is the exact implementation — and why the salt can never change after launch.
18 May 2026
7 min read
Most NextAuth v5 tutorials cover one provider in isolation. Running all three in the same app — shared session types, a users table that handles all three, middleware that covers every case — is a different problem. Here is what the integration actually looks like.
17 May 2026
9 min read
A Supabase Realtime subscription updates vote counts live. The initial count comes from SSR. Get the handoff wrong and users see a flash of zero. Get it right and there is no visible transition at all — the count is correct from the first render.
16 May 2026
7 min read
The next/og ImageResponse API looks simple until you hit the edge runtime. No fs module. No Node.js crypto. CSS limited to flexbox. Font loading via fetch only. Remote images need base64 encoding. Here is every gotcha encountered building contest preview images for AI Art Arena.
15 May 2026
6 min read
Five sequential database queries in a vote handler create a TOCTOU race condition and ~200ms latency. A single SECURITY DEFINER function eliminates both — one atomic transaction, ~40ms, no interleaving possible.
10 May 2026
9 min read
Using createClient() with cookies() inside a revalidate=60 page silently breaks ISR. Here's the three-client Supabase setup that keeps Server Components server-rendered, CDN-cached correctly, and the use client boundary deliberate.
9 May 2026
8 min read
A fixed window rate limiter resets at midnight. A sliding window tracks the rolling 24 hours. The difference sounds academic until someone figures out they can vote 18 times by straddling the reset boundary.
8 May 2026
7 min read
React's development build requires eval() for stack reconstruction and DevTools. Your production CSP must not include 'unsafe-eval'. The fix is a NODE_ENV gate in middleware.ts — one conditional, correct in both environments.
7 May 2026
6 min read
In NextAuth v5, getServerSession() is replaced by auth(), authOptions moves to auth.ts, and the middleware uses a wrapping pattern instead of withAuth(). This covers all three changes with working code for Next.js 14 App Router.
6 May 2026
8 min read
RLS policies enforce access rules at the database layer. They are not a replacement for application-layer auth — they are the guarantee that application-layer bugs do not become data breaches.
5 May 2026
7 min read
A Sentry stack trace tells you what broke. A structured pino log with a request ID tells you everything else: which request, what input, how long it ran, what preceded the failure. Here is how to build that in Next.js API routes.
4 May 2026
6 min read
Vercel cron functions fire and forget — no retries, no event chaining, no step-level observability. Inngest adds all three. Here is how the contest automation chain works: archive fires an event, that event triggers create-next-contest, with automatic retries throughout.
3 May 2026
7 min read
TypeScript catches type errors at compile time. At the API boundary — HTTP request bodies, query parameters, webhook payloads — TypeScript has no power. Zod validates at runtime, before anything touches Redis or the database.
2 May 2026
6 min read
next/image is an image transformation pipeline, not just a component. Here is what actually happens when you configure remotePatterns, formats, and minimumCacheTTL — and how priority, sizes, and aspect-ratio wrappers affect LCP and CLS.
1 May 2026
7 min read