Secure integration
Field notes on mTLS, WS-Security, SOAP, HSM file ingestion and certificate lifecycle between organizations — the enterprise security work nobody blogs about.
3 notes
Notes
What broke,
and why.
Not tutorials. Notes from systems that had to work: in banks, in payment flows, and in three products I run on my own.
Event-driven Java
Production notes on Kafka, Debezium change data capture, the transactional outbox, idempotent consumers, Avro schema evolution and audit trails in Spring Boot.
3 notes
Solo SaaS
What it takes to run three products single-handed: outages, quotas, untrusted code, real-time sync and the failures that taught the most.
3 notes
AI engineering
Field notes on building with AI coding agents and shipping LLM features that cite their sources: grounding, evaluation sets, on-device models and failure modes.
2 notes
Technical SEO
Technical SEO as engineering: structured data errors, ranking a personal name, hreflang, Search Console reports and answer-engine visibility.
3 notes
All notes · 14
AI engineering7 min
A signed Mac app in four days, built with AI coding agents
Kempt went from first commit to a notarized, auto-updating Mac app with Stripe licensing in four days. What the agents did, what I owned, and what nearly broke.
AI engineering6 min
Making a small on-device model safe for money questions
Apple's on-device model is small and private. Getting it to answer "what's my IBAN?" without inventing one took rules, labels and honest failures.
Technical SEO4 min
Invalid object type for field "creator": the one-line fix
Search Console flagged a VideoObject: invalid object type for field creator. The cause was a bare @id reference, and the fix is a few lines of JSON-LD.
Technical SEO5 min
A new domain to page one for my name in six weeks
yassirhalaoui.com was registered on 7 September 2026 and reached page one for my name by 21 October. What mattered, what didn't, and what's still left.
Technical SEO8 min
Your AI-built website works. Nobody visits it.
AI tools ship a working site in an afternoon, then it gets zero clicks. Why AI-built sites stay invisible, and the unglamorous fixes that bring visitors.
Solo SaaS6 min
Synchronizing one moment across every screen
Devices disagree about the time. How to fire one event at once on hundreds of screens worldwide, with a server clock, offset estimation and a scheduled reveal.
Event-driven Java6 min
Avro schema evolution when the consumer is a different company
Backward compatible is not the same as safe to deploy. Which compatibility mode to set, why defaults matter more than types, and how to retire a field over quarters.
Secure integration5 min
Certificate rotation between two companies
Mutual TLS is easy until the certificate belongs to someone else's change process. The overlap window, the trust-store split, and the alert that has to exist.
Solo SaaS7 min
Running untrusted code in 14 languages without losing the host
Running candidate code for real means running hostile code on your own servers. The threat model, the limits that matter, and what a container won't give you.
Event-driven Java6 min
Debezium against a database you do not own
An inactive replication slot pins the write-ahead log and fills the disk. Why it happens on quiet tables, and the heartbeat that stops it.
Secure integration5 min
WS-Security in 2026: making a 2004 spec work with Java 21
The libraries, the JAXB removal, the XML signature pitfalls and the canonicalization details that decide whether a WS-Security message verifies or silently fails.
Secure integration8 min
Ingesting HSM-encrypted files over SOAP with mTLS and WS-Security
How to ingest encrypted files from a hardware security module over SOAP in Spring Boot 3.5, secured with mutual TLS and WS-Security, and processed idempotently.
Solo SaaS5 min
The free-tier quota that took my product down for two days
A daily read quota reset at 07:00 UTC, a poller that never slept, and a product that died every afternoon. What went wrong and the three things that hid it.
Event-driven Java6 min
Idempotency keys are not enough when money moves
At-least-once delivery means a consumer sees some messages twice. Why a deduplication table alone falls short for financial operations, and what to add.