Senior Full-Stack Software Engineer
Alireza is a Senior Full-Stack Software Engineer specializing in TypeScript and cloud-native architecture. He builds AI features into production web applications and writes for Stackonomist about AI systems, coding agents, AI infrastructure and what AI really costs.
CVE-2026-110264 lets an unauthenticated attacker run code on self-managed GitLab, in every release back to 7.0. Which version to move to, why the backports don’t close the whole release, and how to upgrade without a second incident.
DeepSeek’s Search and Fetch APIs cost $0.75 per 1,000 calls against $10 on Claude and OpenAI. For most agents the call fee is the smaller half of the bill: the result tokens are the rest. How to price both and cap them.
Hitting Claude Code’s weekly limit by Wednesday? /usage now shows where the allowance goes. Subagents running on your main model, long sessions and idle loops are the usual suspects, and most fixes are a setting.
OpenAI’s Decisions API returns probabilities instead of a generated JSON label, and bills input tokens only. When that number changes how you route, flag and abstain, and when Structured Outputs or function calling is still the right call.
Mistral Large 4 lists at $1.36 in and $4.18 out per million tokens, far below Claude Opus 5.5 and GPT-6 Astra. Here’s why the launch price, cached input and cost per finished task shrink that gap, and how to measure it on your own traffic.
Small models now cost a fortieth of the top tier, so routing easy requests to them is worth doing. How a cascade decides what escalates, where its hidden costs are (cold caches, long-prompt pricing, wrong answers that pass), and when one model is simpler.
Per-call LLM logs can’t explain why an agent took forty steps or cost ten times the usual. What an agent trace should capture, how to keep one trace across agents and pauses, what not to record, and how to sample.
A long agent run that crashes either starts over, repeating model calls and side effects, or is lost. How durable execution records and replays steps, where step boundaries go, and why idempotency is still your job.
Sandboxing each agent doesn’t isolate them from each other. Injection spreads through the memory, documents and messages they share. Where it travels, why per-agent safety doesn’t compose, and the design that contains it.
Ollama has no authentication for local requests, and vLLM’s --api-key covers only some paths. What an exposed inference server gives away, and the setup that closes it: loopback binding, an allowlisting proxy and closed ports.
A system prompt lowers how often an agent misbehaves; it can’t stop a prompt injection. Where controls actually hold: authorization in every tool, limits once untrusted content is in context, and checks before consequential actions.
Green CI only proves the branch builds and passes the tests it ships with. Read the task, the file list and the test diff before the implementation, and run the new tests against the old code.
Postgres full-text search returns nothing for a misspelling, by design. What trigram matching fixes, the wrong rows it brings with it, how to combine the two, and when a search engine with real typo tolerance earns its keep.
A model upgrade changes behaviour your prompts depend on, and the failures return HTTP 200: a missing field, a tool that isn’t called, a refusal, a bill that grows. How to build a small regression suite from your own traffic and decide from the diff.
AI features have a real cost per request, and it lands on your gross margin. How to log inference cost per customer and feature, where margin leaks (heavy users, free-tier abuse, model upgrades) and which levers move it.
A single passing run shows an LLM agent can do a task, not that it will every time. How to run repeated trials, estimate pass@k and pass^k per task, separate grader and infrastructure noise, and pick the number that gates a release.
Docker Sandboxes run coding agents in their own microVM. What that isolates compared with a container, and how to set up clone mode, proxy-injected credentials, deny-by-default network rules, kits, templates and shared skills so the isolation still holds.
From December 3, 2026, Atlassian bills automation steps beyond your included allowance, alongside Rovo credits. How steps are counted, how to forecast a typical, busy and worst month, and why running out and Rovo actions in rules matter more than the step price.
Tokens stream on localhost, then arrive late and in clumps behind a production proxy. How nginx, HAProxy, Caddy and Cloudflare can hold them, how to survive idle timeouts, and a probe that measures per-event latency and fails CI when events are held.
Most teams that “chose microservices” got distributed coupling instead. Here’s how to keep one Next.js deploy while making module boundaries real: public module APIs, ESLint import zones, per-module table ownership, and an anti-corruption layer for WordPress.
AWS tells you to avoid monoliths; Microsoft tells you to run a readiness assessment first. Here’s how to read both, what a service actually costs per year regardless of traffic, and how to enforce module boundaries so extraction stays cheap.
The monthly invoice is the smallest term in the comparison. A cost teardown of a single VPS against a managed Node.js-capable platform: patching hours, exposure from first boot, runtime upgrade cadence, and the compatibility work you skip or inherit.
A single green CI run tells you a change can pass, not that it does pass. Three gates that hold up when part of the diff was written by an agent: assert on observable state, repeat the run N times, and enforce a flake budget you define yourself.
Public leaderboards measure someone else’s repo. Here’s how to build a 20-task eval from your own git history, grade it with deterministic pass/fail scripts in a sandbox, and put the winner behind a router so the next switch is a config change.
A practical guide to drawing the server/client boundary in the Next.js App Router: what actually moves into the client bundle, why leaf components beat server-everything purism, and how to audit an existing tree for misplaced directives.
