The Journal
The notes I would have wanted at fifteen.
Long-form notes on shipping production systems, scaling SaaS, hiring engineers, AI integration, and the engineering decisions behind Yashveer Labs — written by founder Yashveer Singh.
Passkeys for SaaS: The Migration Plan
Passkeys are cryptographic credentials that replace passwords for authentication. Each passkey consists of a public key stored on the server and a private key stored on the user's device. Authentication proves possession of the private key using device biometrics or PIN, without transmitting the private key or any shared secret. Passkeys resist phishing because they are bound to the origin (domain) they were created for and cannot be used on lookalike sites. They are part of the WebAuthn (FIDO2) standard.
Backend, APIs, and System DesignPagination Patterns: Cursor vs Offset and Why It Matters
Pagination is the mechanism for breaking large dataset results into smaller pages. Offset pagination (LIMIT/OFFSET in SQL) skips a fixed number of rows to retrieve a specific page. Cursor pagination uses a position marker from the previous page to retrieve the next set of results. Offset pagination is simpler but produces inconsistent results on live data and degrades in performance on large offsets. Cursor pagination is more complex but produces consistent results and performs well regardless of dataset size.
DevOps, Deployment, InfrastructurePager Fatigue and How to Prevent It
Pager fatigue is the degradation in on call response quality caused by too many alerts, too many false positives, or too many alerts that require no action. Engineers experiencing pager fatigue begin to dismiss alerts without investigating, acknowledge pages and go back to sleep, or route all alerts to a low priority queue that is effectively ignored. The consequence is that real incidents are missed or responded to slowly, which defeats the purpose of alerting. Prevention requires reducing alert volume, increasing alert precision, and ensuring every alert that fires requires a human response.
Security, Auth, and ComplianceOWASP Top Ten for SaaS in 2026
The OWASP Top Ten is a periodically updated list of the ten most critical web application security risks, maintained by the Open Web Application Security Project. Each item represents a category of vulnerability that is both common and impactful. For SaaS products in 2026, the relevant categories include broken access control, cryptographic failures, injection attacks, insecure design, security misconfigurations, and three others that have increased in relevance due to the adoption of APIs, microservices, and AI features.
Hiring Developers, Freelancers, and AgenciesOutsource vs In House: The Five Questions That Decide
The outsource vs in house decision for software development is the choice between building engineering capability internally (hiring full time engineers who own the codebase and the product) and contracting external developers or agencies to build specific components. The right answer depends on the project's time horizon, the specificity of the domain knowledge required, the competitive differentiation of the capability being built, the budget constraints, and the team's ability to manage external contractors effectively.
DevOps, Deployment, InfrastructureOpenTelemetry: A Practical Adoption Guide
OpenTelemetry (OTel) is an open source observability framework that provides a standardized way to instrument applications for metrics, logs, and distributed traces. It includes instrumentation libraries for most languages, a data collector (the OTel Collector), and a common export format (OTLP) that sends data to any compatible observability backend. Adopting OpenTelemetry for instrumentation means the application code does not change when the observability backend changes.
AI Integration and Vibe Coding RescueOpenAI vs Anthropic vs Open Source: A 2026 Founder Decision Framework
The LLM provider decision for a production AI feature involves evaluating capability (does the model produce acceptable output for the specific task), cost (what does the inference cost at projected usage volume), reliability (what are the provider's uptime and rate limit characteristics), and strategic risk (what happens to the product if the provider raises prices, changes the API, or limits access). In 2026, OpenAI and Anthropic are the two primary API providers for frontier models; open source models running on self hosted infrastructure are the third option.
Recruiter and Career PositioningOpen Source Contributions That Move Your Career
Open source contributions for career positioning are public contributions to maintained software projects that demonstrate an engineer's technical capabilities, communication skills, and ability to work within an existing codebase. Not all contributions carry equal signal: a bug fix in a widely used library demonstrates more than a typo fix in documentation. The career value of open source contributions comes from their quality, the projects they appear in, and how they are presented, not from their quantity.
Cross Platform and Mobile DevelopmentOffline First Mobile Apps: A Reality Check
Offline first mobile architecture means designing the application to function fully without a network connection, with changes made offline automatically synchronized when connectivity is restored. True offline first requires a local data store, a synchronization engine, conflict resolution logic, and a UI that clearly communicates sync state. Most apps that claim to be offline first are actually offline tolerant: they handle brief disconnections but require connectivity for meaningful use.
DevOps, Deployment, InfrastructureObservability in 2026: Metrics, Logs, Traces
Observability is the ability to understand the internal state of a system from its external outputs. In the context of software systems, observability is implemented through three types of telemetry data: metrics (numerical measurements over time), logs (timestamped records of events), and traces (records of requests as they flow through distributed services). A system is observable when these three data types are available, correlated, and actionable. Monitoring is the practice of observing a system using this telemetry.
Backend, APIs, and System DesignOAuth 2.0 Without Tears: A Founder Engineer's Guide
OAuth 2.0 is an authorization framework that allows applications to access resources on behalf of a user without handling or storing the user's credentials. The user authorizes the application through an authorization server (Google, GitHub, Okta) and the application receives an access token it can use to call APIs. OAuth 2.0 defines several flows (authorization code, implicit, client credentials, device code) for different use cases. Implementing the wrong flow or mishandling tokens introduces security vulnerabilities.
Comparisons and Vendor DecisionsNotion vs Slite vs Confluence for Engineering Docs
Notion, Slite, and Confluence are knowledge management and documentation tools used by engineering teams to maintain architecture decision records, runbooks, onboarding guides, API documentation, and team processes. They differ in their organizational model, search quality, permission systems, and integration depth with engineering tools. The right choice depends on team size, the complexity of the documentation hierarchy, and the team's tolerance for setup overhead.
Comparisons and Vendor DecisionsNotion vs Coda vs Linear vs ClickUp for Engineering Teams
Notion, Coda, Linear, and ClickUp are productivity and project management tools used by engineering teams for documentation, issue tracking, and work management. They serve overlapping but distinct primary purposes: Notion and Coda are primarily knowledge and content tools with project management features added; Linear is primarily an issue tracker optimized for engineering workflows; ClickUp is a general project management tool with broad feature coverage. Choosing the right tool requires knowing which problem is being solved.
Web App and Frontend DevelopmentNext.js vs Remix vs Astro vs Nuxt in 2026
Next.js, Remix, Astro, and Nuxt are full stack web frameworks that handle routing, server rendering, data fetching, and deployment. Each makes different bets about the right default approach to rendering (server components vs. loaders vs. static generation) and the right abstraction for data fetching. The right framework for a given project depends on the rendering requirements, the team's existing skills, the deployment target, and how much flexibility versus convention the project benefits from.
Cross Platform and Mobile DevelopmentNative iOS Development in 2026: SwiftUI, Combine, and the New Stack
Native iOS development in 2026 means building with SwiftUI for UI, Swift as the primary language, Swift Concurrency (async/await and actors) for asynchronous code, and SwiftData or Core Data for local persistence. UIKit remains fully supported and necessary for complex custom UI, but new projects and new screens default to SwiftUI. The combination of SwiftUI and Swift Concurrency represents the most significant shift in iOS development patterns since Swift replaced Objective-C.
Cross Platform and Mobile DevelopmentNative Android Development in 2026: Compose, KMP, and Where It Is Going
Native Android development in 2026 means building with Jetpack Compose for UI, Kotlin as the primary language, and Kotlin Multiplatform (KMP) as the emerging standard for sharing business logic across Android and iOS. The XML layout system, built on the old View framework, still exists but receives no new investment from Google. Teams starting new Android projects in 2026 that use XML layouts are building on a path that Google is actively moving away from.
MVP Development and Startup BuildsMVP vs Prototype vs Proof of Concept: Stop Confusing Them
A proof of concept demonstrates that a technical approach is feasible. A prototype demonstrates what a user experience could feel like. An MVP is a product with real functionality released to real users to test whether a business hypothesis is correct. Confusing them leads to investing prototype effort in a proof of concept, shipping a prototype when an MVP is needed, or overengineering an MVP to enterprise product standards when a prototype would generate the same learning.
MVP Development and Startup BuildsMVP Validation Frameworks: A Comparison of the Top Five
MVP validation frameworks are structured approaches to testing whether a product hypothesis is correct before investing in full development. Each framework defines a method for gathering evidence about customer behavior, willingness to pay, and problem severity. The right framework depends on what is being validated: the problem, the solution, the pricing, or the demand. Using the wrong framework for the question being asked produces misleading validation signals.
MVP Development and Startup BuildsMVP Pricing Models: How to Charge for Something That Is Not Done Yet
MVP pricing is the decision about what to charge for a product that is not yet complete, with limited features, and an unproven track record. The pricing decision for an MVP serves two purposes: it validates whether target customers will pay at all (proof of willingness to pay), and it establishes a pricing baseline that is easier to adjust upward as the product improves than to rebuild from a free tier that trained customers not to expect to pay.
MVP Development and Startup BuildsMVP Failures I Have Witnessed: A Field Guide
MVP failures are the outcomes where a minimum viable product launch does not produce validated learning or a path to product market fit, regardless of whether the product was technically completed. Most MVP failures are not technical failures; they are discovery failures, scope failures, or validation failures that surface after significant investment in building. Understanding the failure patterns lets founders recognize the early signs before they become expensive.
Tech Debt and RefactoringMutation Testing: A Discipline Worth Considering
Mutation testing is a test quality measurement technique where a tool automatically introduces small code changes (mutations) into the codebase and checks whether the existing test suite detects each change. If a mutation survives without causing a test failure, the test suite has a gap: that code path can change behavior without any test catching it. The mutation score is the percentage of mutations that are killed by the test suite.
SaaS Architecture and ScalingMulti Tenant Background Jobs: Fair Scheduling and Noisy Neighbors
Fair scheduling in multi tenant background jobs is the practice of preventing any single tenant from monopolizing the job queue at the expense of others. Without fairness controls, a tenant who submits 10,000 jobs simultaneously blocks all other tenants from processing any jobs until their queue is exhausted. Fair scheduling algorithms allocate processing capacity across tenants proportionally, ensuring that every tenant makes progress regardless of the relative size of their job queues.
DevOps, Deployment, InfrastructureMulti Region Deployments: Decision Framework and Cost Math
Multi region deployment cost math covers the infrastructure components required to run in a second or third geographic region: compute, database, networking, monitoring, and the engineering time to manage the additional operational surface. For a typical SaaS product, adding a full second region increases monthly infrastructure cost by 80 to 150 percent, depending on database replication strategy and whether the second region runs a full or read optimized stack.
SaaS Architecture and ScalingMulti Region Deployment: When It Is Worth the Pain
Multi region deployment is the practice of running application infrastructure and data in more than one geographic location simultaneously. It serves two distinct purposes: latency reduction for users far from the primary region, and data residency compliance for customers in jurisdictions with data sovereignty requirements. The engineering cost is substantial: data replication, consistent deployment across regions, cross region traffic management, and operational complexity all increase meaningfully with each additional region.