Engineering essays.
Deep-dives on AI code review, multi-agent architecture, and the craft of shipping reliable software at speed.
October 14, 2026ComparisonsGemini 4 Argon vs Claude vs GPT vs DeepSeek: AI Code Review & BYOK Guide
A technical guide to choosing an LLM for pull-request review: what CodeReviewBench actually measures, how leading model families compare, how to calculate true cost per useful finding, and how BYOK changes the economics.
10 min read·Surya Pratap Singh
September 28, 2026SecurityPrototype Pollution in Object Merge Utilities: A Caught Pattern
Real Mesrai catch on a homebrew merge utility — `__proto__` keys mutate Object.prototype for the whole process. CWE-1321 walkthrough with safe-merge fix.
9 min read·Arjun Mehta
September 20, 2026SecurityThe Hardcoded API Key Mesrai Found in a Test Fixture
Real PR catch: a Stripe live key hardcoded in a test fixture. Mesrai's flag, the rotation procedure, and the pre-commit hook that closes the class. CWE-798.
8 min read·Arjun Mehta
September 4, 2026Technical Deep DiveThe Logging Statement That Was Quietly Writing PII to Datadog
Real incident: log statement printing req.body sent PII to Datadog for 6 months. SOC2 audit finding. Redaction fix.
8 min read·Surya Pratap Singh
September 3, 2026Technical Deep DiveA Forgotten Feature Flag That Almost Shipped to 100% of Users
Real story: feature flag catch-all defaulting to true — would have shipped half-built feature on flag-service blip. Safe-default fix.
8 min read·Surya Pratap Singh
September 3, 2026Technical Deep DiveA One-Character Bug in a Pricing Tier Check: The $X-Per-Month Save
Real incident: `<` instead of `<=` in tier check — $24K leaked over 3 months. Boundary-test fix.
8 min read·Surya Pratap Singh
September 2, 2026Technical Deep DiveThe Migration That Locked the User Table for 8 Minutes — Avoided
Real incident: ADD COLUMN NOT NULL on 80M-row users held lock 8 minutes — auth outage. Three-step migration fix.
8 min read·Surya Pratap Singh
September 2, 2026Technical Deep DiveA Race Condition in Webhook Replay That Created Duplicate Orders
Real incident: 4 webhook retries during network glitch created 4 duplicate orders. Event-id idempotency fix.
8 min read·Surya Pratap Singh
September 1, 2026Technical Deep DiveThe CSP Header Mesrai Restored During an Emergency Hotfix
Real story: CSP header commented during hotfix, shipped to prod. Mesrai catch on diff. Restore + HSTS fix.
8 min read·Surya Pratap Singh
September 1, 2026Technical Deep DiveA Hidden N+1 That Took Down Postgres at 2AM IST
Real incident: feed N+1 under marketing-spike traffic crashed Postgres. 12-minute outage. IN-clause fix.
8 min read·Surya Pratap Singh
August 31, 2026Technical Deep DiveThe Payment Refund Loop That Cost $40K — Caught Pre-Merge by Mesrai
Real incident: refund retry loop without idempotency — 47 duplicate refunds, $40K liability. Stable-key fix.
8 min read·Surya Pratap Singh
August 31, 2026Technical Deep DiveA Production-Wide Outage That Started as a Missing await
Real incident: session flush missing await — 80% error rate, 40-minute outage. Mesrai catch of the same shape.
8 min read·Surya Pratap Singh
Surya Pratap Singh
Arjun Mehta