25 original how-to guides on web performance, APIs, databases, DevOps, and frontend — written for developers who search when something is broken.
New here? Start here Useful resources
BudhiWorks itself is a static site. Here is how I deploy the same kind of project to Netlify, GitHub Pages, or a plain Nginx box—without mystery 404s and stale caches.
Kubernetes Secrets are base64, not encryption. Here is how I store, mount, and rotate credentials in clusters without leaving plaintext in git or world-readable env dumps.
I still maintain Webpack apps and start most greenfield UI in Vite. Here is how I choose in 2026 without rewriting working build pipelines for sport.
When a Node service climbs from 200MB to 2GB over a day, guessing wastes time. Here is the heap-snapshot workflow I use to find what is retaining memory.
Accessibility work stuck on our backlog until I turned WCAG into a short, shippable checklist for every PR. Here is what I actually verify before calling a UI done.
Aggregation pipelines stopped being “advanced Mongo” for me once report endpoints started timing out. This is the shape I use for filters, joins, and rollups without pulling half the collection into Node.
Most Node secret leaks I investigate are not exotic exploits. They are .env files in git, DEBUG logs printing process.env, and Docker layers that baked credentials into the image.
Rate limiting is not a nice-to-have once bots or a buggy client find your public endpoints. Here is the token-bucket design I use with Redis, including the failure modes I hit in production.
Hero images dominate LCP on most marketing pages I audit. Switching to AVIF/WebP helps only if sizing, priority, and encoding are right—here is the workflow that moved real numbers.
Debounce and throttle both limit how often a function runs, but they fix different UX problems. Here are the implementations I use and the call sites that broke when I mixed them up.
The database choice shows up in every later decision. Here is how I pick SQL vs NoSQL for web apps, with scenarios I have shipped—and one choice I regret.
Clients should not need tribal knowledge to use your API. These are the REST conventions I enforce on Node services—status codes, pagination, and errors that do not invent a private dialect.
I want every push to main to run tests and every green build to be deployable without SSH archaeology. This is the GitHub Actions setup I use for Node apps, including the mistakes that wasted CI minutes.
Caching is easy until a key expires and a thousand requests hammer Postgres at once. These are the Redis patterns I use in production Node services, including how I prevent stampedes.
Exposing Node on port 3000 to the internet is fine for a demo and a liability in production. Here is the Nginx reverse proxy setup I reuse, plus SSL mistakes that cost me overnight outages.
I wasted weeks fighting Flexbox for two-dimensional pages before Grid existed in my muscle memory. Here is the rule I use now, with the layouts people actually search for.
I ignored generics for years and sprinkled as casts instead. Once we typed our API client and a few shared components properly, a whole class of production bugs became compile errors.
Rebase versus merge is not religion on our team. It is about whether the commits are private and whether we want a linear PR.
I added five indexes in a panic once and made writes 3 times slower. Now I only ship indexes backed by EXPLAIN ANALYZE and a workload note.
App Router caching surprised us in production: a live admin page served stale inventory for 60 seconds. Here is how I choose fetch options on purpose.
Most useEffect bugs I review are not exotic. They are missing deps, missing cleanup, or effects that should have been event handlers.
I want one command that brings up API, Postgres, and Redis the same way on every laptop. This is the Compose setup we copy into new services.
I stopped putting JWTs in localStorage after one XSS demo emptied a staging account. Here is the access plus refresh cookie pattern we use in production Express apps.
I treat Core Web Vitals as a release gate, not a blog buzzword. This is the checklist we run before shipping marketing pages and authenticated dashboards.
I still see CORS turn a 20-minute feature into a two-hour rabbit hole. Here is the checklist I use when the browser blocks a fetch that works fine in curl.