Featured
Keep the files off the app servers
A serverless S3 upload/download platform: two IAM roles, API Gateway, presigned URLs, SQS, processor Lambda, and PostgreSQL metadata.
Read the articleWriting
Articles
Technical notes from production systems. Comments are welcome on each article.
2026-09-02 · SSO · SAML 2.0 · OpenID Connect · Spring Security
SSO across split portals — SAML 2.0, OpenID Connect, and logout that must not take the estate with it
How a worker landing page federates independently deployed portals with SAML 2.0 or OpenID Connect — and why logging out of one application was returning 500s and a spinner on the others.
2026-08-30 · Security · Platform · IAM · Kubernetes · AWS
Platform security principles
How I expect a platform to be built: identity as the perimeter, least privilege, segmentation, secure defaults, small blast radius, tenancy isolation, auditability, and a control plane that is not the data plane.
2026-08-29 · Security · Secure coding · Spring Security · Code review
Secure coding practices
A working checklist for input validation, SQL injection, authn/authz, least privilege, privacy, CSRF, exceptions, secrets, dependencies, encryption, deserialization, file uploads, and code review.
2026-05-14 · Applied AI · RAG · MCP · Spring AI · AWS
Grounding an eligibility assistant without giving the model the keys
How policy ingestion, Bedrock Cohere embeddings, and full-document enrichment (FDE) produce a citable corpus in PostgreSQL/pgvector, while MCP keeps live Eligibility and Enrollment data behind authorized APIs.
2026-03-03 · Microservices · Spring Boot · DDD · AWS
Strangling a benefits monolith without stopping enrollment
A phased Strangler Fig migration of Maryland Eligibility & Enrollment into Spring Boot services, with file processing and batch moved off the application servers.
2025-11-18 · Kafka · Flink · RocksDB · Snowflake
Enriching behavioral events before they become someone else's incident
A Flink enricher on harvested clickstream: raw landing on S3, Kafka ingestion, sanitize and mask, RocksDB and HashMap state, windowing and offsets, then Snowflake for trusted facts and Kafka for bad events.