The Journal
The notes I would have wanted at fifteen.
Long-form notes on shipping production systems, scaling SaaS, hiring engineers, AI integration, and the engineering decisions behind Yashveer Labs — written by founder Yashveer Singh.
Kubernetes for Startups: When It Makes Sense, When It Does Not
Kubernetes is a container orchestration platform that handles deployment, scaling, self healing, and traffic routing across clusters of machines. It was built by Google to manage workloads at planetary scale. Most startups are not operating at planetary scale. The companies that benefit from Kubernetes early are running multiple services, need finely tuned scaling per service, and have at least one engineer who can run the cluster without it becoming a full time job.
Cross Platform and Mobile DevelopmentKotlin Multiplatform vs Flutter vs React Native: A Real Comparison
Kotlin Multiplatform, Flutter, and React Native each solve the cross platform mobile problem with a different philosophy. KMP shares business logic while using native UI on each platform. Flutter renders everything with its own engine. React Native bridges JavaScript to native components. The right choice depends on your team's language background, how much you care about UI fidelity, and whether you are building a new app or adding mobile to an existing backend.
Backend, APIs, and System DesignKafka in 2026: When You Need It and When You Do Not
Kafka is a distributed event streaming platform built for high throughput, fault tolerant message delivery at massive scale. It processes millions of events per second, stores them durably on disk, and replays them on demand. Most companies do not need this. The ones that do are processing analytics in real time, coordinating between dozens of services, or running systems where losing a single event means losing money.
Security, Auth, and ComplianceJWT Best Practices in 2026: What Has Changed
JSON Web Tokens (JWTs) are a compact format, safe for use in URLs, for representing claims between two parties. In SaaS authentication, they are used primarily as access tokens and session tokens. The best practices around algorithm selection, token lifetime, key rotation, and revocation have evolved significantly since JWTs became widespread, and many production systems are still running on outdated patterns that create exploitable vulnerabilities.
Hiring Developers, Freelancers, and AgenciesJunior Developers Who Outperform Seniors: How to Spot Them
A junior developer who outperforms expectations is not one who knows more than their peers at hire. It is one who learns faster, asks better questions, takes ownership of outcomes rather than just tasks, and compounds their capability in ways that make them substantially more valuable within twelve months than their starting title implied. These developers exist, they are identifiable in hiring, and they are systematically underpriced relative to their eventual contribution.
Backend, APIs, and System DesignJSON Columns in Postgres: When They Make Sense
JSON columns in Postgres (using the jsonb type) store semi structured data alongside relational data in the same table. They are appropriate when data has variable or unpredictable structure, when the fields inside the JSON do not need to be individually indexed or queried in SQL, and when the alternative would be a wide table with many nullable columns or a complex EAV (entity, attribute, value) schema. They are not a substitute for proper relational design.
SaaS Architecture and ScalingJob Failure Recovery: How Good SaaS Companies Sleep at Night
Job failure recovery is the combination of retry strategies, dead letter handling, alerting, and idempotency design that ensures background jobs either complete successfully or fail in a way that is visible, recoverable, and does not corrupt data. A SaaS product with good job failure recovery treats a failing job as a recoverable event rather than a data loss incident.
Security, Auth, and ComplianceISO 27001 for Engineering Founders: A Practical Reading
ISO 27001 is the international standard for information security management systems. It defines a framework for identifying information security risks and implementing controls to manage them. Certification means an accredited third party auditor has verified that your security management system meets the standard's requirements. For SaaS companies, ISO 27001 is the compliance credential that opens European enterprise sales and provides a structured framework for building security practices that scale.
Cross Platform and Mobile DevelopmentiOS TestFlight vs Internal Testing: A Comparison
TestFlight is Apple's official external beta testing platform, allowing developers to distribute prerelease builds to up to 10,000 external testers through an invitation or public link. Internal testing is limited to the development team members added to the App Store Connect account, with a maximum of 100 testers and no Apple review requirement. The choice between them depends on who is testing, what feedback is needed, and how quickly builds need to reach testers.
Business Automation and OpsInvoicing Automation: Stripe Invoicing, Chargebee, Custom
Invoicing automation is the practice of generating, sending, tracking, and reconciling invoices programmatically rather than manually. For SaaS companies, this means connecting subscription and usage data to invoice generation without human intervention for each billing cycle. The right tool depends on billing model complexity, finance team requirements, and how much customization the customer relationship demands.
SaaS Architecture and ScalingInternal Admin Tools: Build vs Buy vs Retool
Internal admin tools are the dashboards, data tables, and action interfaces that customer success, operations, and engineering teams use to manage a SaaS product: viewing customer accounts, adjusting subscription states, running manual operations, and debugging issues. The build vs buy decision determines how much engineering time the product team spends on tooling that customers never see.
Security, Auth, and ComplianceInsecure Direct Object References: The Bug Founders Underestimate
An Insecure Direct Object Reference (IDOR) is a vulnerability where an application exposes internal object identifiers in URLs or API requests without verifying that the requesting user has permission to access the referenced object. The result is that any user can access any other user's data by guessing or enumerating the identifier. IDOR vulnerabilities are consistently in the OWASP Top 10 and are among the most commonly reported in bug bounty programs.
Performance OptimizationINP: The New Core Web Vital Most Teams Are Failing
Interaction to Next Paint (INP) measures the latency between a user's interaction and the visual update that results from it. Unlike First Input Delay, which only measured the delay before the browser started processing the first input, INP measures the full interaction latency for all clicks, taps, and keypresses across the entire page session. A good INP is under 200 milliseconds. Poor is above 500 milliseconds.
Comparisons and Vendor DecisionsInngest vs Trigger vs Temporal for Background Jobs
Inngest, Trigger.dev, and Temporal all handle background job orchestration, but at different complexity levels and with different operational models. Inngest and Trigger are managed platforms optimized for developer experience and fast adoption. Temporal is a durable execution engine designed for complex workflows that run long, where correctness guarantees cannot be negotiated away. Choosing the wrong tool at the wrong scale creates technical debt in either direction.
Comparisons and Vendor DecisionsInngest vs Hatchet vs Trigger.dev: Async Job Platforms Compared
Async job platforms handle background work that should not block a web request: sending emails, processing uploads, syncing data, running scheduled reports. Inngest, Hatchet, and Trigger.dev are the three platforms competing for this space in 2026, each with a different take on how to write, observe, and scale background jobs for teams working primarily in TypeScript.
DevOps, Deployment, InfrastructureInfrastructure as Code: Terraform vs Pulumi vs CDK
Infrastructure as code is the practice of defining cloud resources in version controlled files rather than through manual console clicks. Terraform, Pulumi, and AWS CDK are the three dominant tools for doing this, each with a different philosophy: Terraform uses its own declarative language, Pulumi uses general purpose programming languages, and CDK uses TypeScript or Python to generate CloudFormation.
DevOps, Deployment, InfrastructureIncident Severity Levels: A Practical Definition
Incident severity levels are a classification system that tells the team how urgent an incident is, who needs to be notified, and what the expected response time is. A severity model that is clearly defined prevents two failure modes: a critical outage treated like a routine ticket, and a minor alert that triggers a full incident bridge.
Security, Auth, and ComplianceIncident Response for Startups: A Playbook
Incident response for a startup is a documented, practiced process for detecting, communicating about, and resolving service disruptions in a way that minimizes customer impact and preserves trust. The goal is not to prevent all incidents. It is to handle them in a way that customers and prospects find credible and that the team finds manageable.
Startup Technical StrategyImplementation Services: The Forgotten SaaS Revenue Line
Implementation services are the paid work a SaaS company does to help enterprise customers set up, configure, and integrate the product for their specific environment. Most companies do this work for free to close the deal. The companies that charge for it treat it as a product, invest in delivery quality, and generate a revenue line that funds the engineering work required to make the core product easier to implement.
Performance OptimizationImage Optimization at Scale: AVIF, WebP, Responsive Images
Image optimization at scale means automatically serving the smallest image that looks correct on the user's device and connection, using the most efficient format the user's browser supports. Done well, it reduces page weight by sixty to eighty percent compared to unoptimized JPEG delivery, with no visible quality loss and no manual work after the system is configured.
Backend, APIs, and System DesignIdempotency Keys: A Pattern Every Senior Engineer Should Master
An idempotency key is an identifier the client generates and attaches to a write request, letting the server detect and deduplicate repeated calls to the same operation. The pattern converts an operation with side effects from one that is unsafe to retry into one that is safe to retry, which is the difference between a payment system that occasionally charges twice and one that never does.
SaaS Architecture and ScalingIdempotency in API Design: Why It Matters More Than You Think
Idempotency in API design means that calling the same API operation multiple times with the same inputs produces the same result as calling it once. An idempotent API handles network retries, duplicate submissions, and errors on the client side gracefully. An API that lacks idempotency turns network instability into data corruption.
AI Integration and Vibe Coding RescueHuman in the Loop Design: The Pattern Behind Trustworthy AI Features
Human in the loop design is the practice of inserting human review or approval at the points in an AI workflow where errors are most costly or most likely. It is not a concession that AI is unreliable. It is a deliberate architecture that places AI automation where it adds speed and cost reduction while preserving human judgment where the stakes of an error are disproportionate.
MVP Development and Startup BuildsHow to Write a Product Requirements Document Without Being Technical
A product requirements document written without technical knowledge should describe the user, the problem, the core workflow, the acceptance criteria for each feature, and the explicit scope boundaries for the current version. Technical specifications belong to the developer. Business requirements, user outcomes, and scope decisions belong to the founder. A PRD that stays in its lane is more useful than one that crosses into technical territory and gets it wrong.