Engineering essays.
Deep-dives on AI code review, multi-agent architecture, and the craft of shipping reliable software at speed.
September 28, 2026SecurityPrototype Pollution in Object Merge Utilities: A Caught Pattern
Real Mesrai catch on a homebrew merge utility — `__proto__` keys mutate Object.prototype for the whole process. CWE-1321 walkthrough with safe-merge fix.
9 min read· Mesrai Team
September 20, 2026SecurityThe Hardcoded API Key Mesrai Found in a Test Fixture
Real PR catch: a Stripe live key hardcoded in a test fixture. Mesrai's flag, the rotation procedure, and the pre-commit hook that closes the class. CWE-798.
8 min read· Mesrai Team
August 5, 2026Technical Deep DiveStale useEffect Dependency: The Closure Bug Mesrai Catches Daily
Real PR catch: useEffect with empty deps + setResults([...results, r]) — stale state + listener leak. Functional update + cleanup fix.
8 min read· Mesrai Team
August 5, 2026Technical Deep DiveDropping a Column Used in a Read-Replica Query: The Cascade Bug
Real PR catch: DROP COLUMN on a field still referenced by canary + analytics worker. Two-phase rollout fix.
8 min read· Mesrai Team
August 4, 2026Technical Deep DiveSchema Migration Without Rollback: Mesrai's Always-Reversible Rule
Real PR catch: `ADD COLUMN NOT NULL DEFAULT` on a 50M-row table — production lock for minutes. Three-step safe migration.
8 min read· Mesrai Team
August 4, 2026Technical Deep DiveJSONB Index Misuse in Postgres: A Diff-by-Diff Tuning
Real PR catch: JSONB query with `->>` on a GIN-indexed column — index unused, seq scan. Containment + expression-index fixes.
8 min read· Mesrai Team
August 3, 2026Technical Deep DiveConnection Pool Exhaustion: The Hidden await Mesrai Found
Real PR catch: `withConn(...)` without await — connections leak under error rate, pool drains. Await + structured error handling fix.
8 min read· Mesrai Team
August 3, 2026Technical Deep DiveMissing ON CONFLICT Clause in Upsert: The Race-to-Insert Bug
Real PR catch: SELECT-then-INSERT upsert pattern — concurrent calls race, unique-constraint violation. ON CONFLICT fix.
8 min read· Mesrai Team
August 2, 2026Technical Deep DiveTransaction-Less Batch Update: A Partial-Failure Bug Mesrai Found
Real PR catch: per-row updates in a loop without a transaction — mid-job failure leaves DB inconsistent. Transaction + bulk UPDATE fixes.
8 min read· Mesrai Team
August 2, 2026Technical Deep DiveOFFSET-Based Pagination Past 10K Rows: The Cursor-Pagination Fix
Real PR catch: OFFSET pagination scans 10K rows for page 200. Keyset cursor fix with EXPLAIN deltas.
8 min read· Mesrai Team
August 1, 2026Technical Deep DiveSELECT * in Hot Path: Why Mesrai Always Flags This
Real PR catch: `SELECT *` on a posts endpoint with 24 columns. Wire-size + TOAST decompression cost. Projected-columns fix.
8 min read· Mesrai Team
August 1, 2026Technical Deep DiveMissing Index on a Foreign Key: Mesrai's EXPLAIN-Driven Suggestion
Real PR catch: FK column added without index — seq scan on 30M rows. CREATE INDEX CONCURRENTLY fix with audit query.
8 min read· Mesrai Team