Static export vs server build: where does your API key end up?
One Next.js config, two build targets. The only difference that really matters is who can read your API key: your server, or every visitor.
Next.jsSecurityArchitecture
Read article →Blog
Writing
Notes on web, mobile, and backend engineering, from shipping secure software in regulated products
Why a CI pipeline build beats a build from your laptop
A build that only works on one machine is a liability. Moving release builds into a pipeline makes them repeatable, auditable, and safe to hand to anyone on the team.
CI/CDDevOpsMobile
Read article →Biometrics are not the secret: lessons from banking apps
A fingerprint prompt feels like security, but it only unlocks something. What matters is what it unlocks, and where that thing lives.
SecurityReact NativeMobile
Read article →One codebase, many banks: designing for white-label apps
When two financial institutions want the same product with different brands and rules, the answer is configuration, not branches.
ArchitectureReact NativeTheming
Read article →The release habits that keep App Store rejections rare
Rejections are rarely a surprise. A short, boring checklist run on every release removes most of them.
MobileReleaseProcess
Read article →