Working notes on architecture, AWS and AI — what each decision cost and whether I'd make it again.https://rhynl.io/enhttps://rhynl.io/notes/flipping-the-auth-provider-without-logging-everyone-out/https://rhynl.io/notes/flipping-the-auth-provider-without-logging-everyone-out/Changing identity providers is a one-way door if you get the order wrong. A checklist for cutting over with a live fallback and a real rollback.Thu, 10 Sep 2026 00:00:00 GMTAuthSecurityAWSmail@rhynl.iohttps://rhynl.io/notes/dont-let-the-model-decide-the-checkout/https://rhynl.io/notes/dont-let-the-model-decide-the-checkout/In a chat-led app, some actions have to appear at the right moment every single time. That's not a job for tool calls. Here's the pattern we used instead.Mon, 24 Aug 2026 00:00:00 GMTAIArchitectureNext.jsNestJSmail@rhynl.iohttps://rhynl.io/notes/el-deploy-exitoso-que-no-estaba-en-produccion/https://rhynl.io/notes/el-deploy-exitoso-que-no-estaba-en-produccion/Un pipeline en verde no significa que tu código está sirviendo. Cómo verificar de verdad que un cambio llegó a producción.Mon, 24 Aug 2026 00:00:00 GMTAWSDevExmail@rhynl.iohttps://rhynl.io/notes/la-redaccion-de-logs-no-es-un-checkbox/https://rhynl.io/notes/la-redaccion-de-logs-no-es-un-checkbox/Un patrón de redacción como *.campo no siempre cubre lo que creés. Cómo mantener datos sensibles fuera de los logs en serio, y no solo en apariencia.Thu, 09 Jul 2026 00:00:00 GMTObservabilitySecurityNestJSmail@rhynl.iohttps://rhynl.io/notes/every-string-from-the-outside-needs-a-maximum-length/https://rhynl.io/notes/every-string-from-the-outside-needs-a-maximum-length/An unbounded string field on an unauthenticated endpoint is a bug. But the fix has a failure mode that can reject perfectly valid requests.Thu, 18 Jun 2026 00:00:00 GMTSecurityTypeScriptTestingmail@rhynl.iohttps://rhynl.io/notes/decisiones-con-fecha-por-que-escribo-adrs-aunque-seamos-dos/https://rhynl.io/notes/decisiones-con-fecha-por-que-escribo-adrs-aunque-seamos-dos/Un Architecture Decision Record no es burocracia. Es la única forma que conozco de que un sistema siga explicándose a sí mismo cuando ya nadie recuerda por qué se hizo así.Mon, 08 Jun 2026 00:00:00 GMTADRsArchitectureTeammail@rhynl.iohttps://rhynl.io/notes/fail-soft-by-default-integrating-an-llm-with-systems-that-can-go-down/https://rhynl.io/notes/fail-soft-by-default-integrating-an-llm-with-systems-that-can-go-down/An AI feature is only as reliable as its least reliable dependency. Here's how I make LLM integrations degrade quietly instead of taking the request down.Thu, 14 May 2026 00:00:00 GMTAIArchitectureNode.jsmail@rhynl.iohttps://rhynl.io/notes/the-sidecar-i-didnt-build/https://rhynl.io/notes/the-sidecar-i-didnt-build/The RFC said ClamAV in a container. The research said GuardDuty. Here's what changed, what it cost, and the parts of a HIPAA upload pipeline nobody puts on the diagram.Mon, 11 May 2026 00:00:00 GMTAWSComplianceArchitectureCostmail@rhynl.iohttps://rhynl.io/notes/the-subscription-that-went-deaf/https://rhynl.io/notes/the-subscription-that-went-deaf/Our Salesforce event subscription stopped delivering after a few days of uptime, with no errors and a green health check. The bug was in the transport, and the lesson was about what "healthy" means.Mon, 20 Apr 2026 00:00:00 GMTIntegrationsObservabilityNestJSAWSmail@rhynl.iohttps://rhynl.io/notes/cache-control-will-not-save-you-from-a-bandwidth-bill/https://rhynl.io/notes/cache-control-will-not-save-you-from-a-bandwidth-bill/A marketing site went from 32 GB to 32 TB of video traffic in nineteen days. The headers we added did nothing, and understanding why is the whole lesson.Mon, 02 Mar 2026 00:00:00 GMTCostAWSNext.jsArchitecturemail@rhynl.io