Write-ups of real problems from production: what broke, why, and what I changed.https://hlmnhkl.my/enhttps://hlmnhkl.my/writing/it-worked-until-the-hundred-and-first/https://hlmnhkl.my/writing/it-worked-until-the-hundred-and-first/Permissions were being read one page at a time. Nobody noticed for a year, because nobody had more than a hundred of them.Mon, 27 Jul 2026 00:00:00 GMTpaginationbugshttps://hlmnhkl.my/writing/picking-fields-is-not-access-control/https://hlmnhkl.my/writing/picking-fields-is-not-access-control/If the only reason a client never sees a number is that the app forgot to ask for it, that is not a boundary. That is a habit.Mon, 15 Jun 2026 00:00:00 GMTaccess controlmulti-tenanthttps://hlmnhkl.my/writing/ten-that-looked-like-a-thousand/https://hlmnhkl.my/writing/ten-that-looked-like-a-thousand/Prices are stored in the smallest unit, so the number in the database is a hundred times the price. Miss the conversion once and a cheap extra looks expensive.Tue, 09 Jun 2026 00:00:00 GMTmoneybugshttps://hlmnhkl.my/writing/nobody-could-pay/https://hlmnhkl.my/writing/nobody-could-pay/A safety check meant to protect customers was the thing blocking them. The server had the wrong idea about its own address.Fri, 10 Apr 2026 00:00:00 GMTpaymentsnginxnuxthttps://hlmnhkl.my/writing/paid-but-not-finished/https://hlmnhkl.my/writing/paid-but-not-finished/The money went through. The order stayed a draft, because finishing it depended on the customer coming back to our page.Fri, 03 Apr 2026 00:00:00 GMTpaymentswebhooks