Engineering essays.
Deep-dives on AI code review, multi-agent architecture, and the craft of shipping reliable software at speed.
September 28, 2026SecurityPrototype Pollution in Object Merge Utilities: A Caught Pattern
Real Mesrai catch on a homebrew merge utility — `__proto__` keys mutate Object.prototype for the whole process. CWE-1321 walkthrough with safe-merge fix.
9 min read· Mesrai Team
September 20, 2026SecurityThe Hardcoded API Key Mesrai Found in a Test Fixture
Real PR catch: a Stripe live key hardcoded in a test fixture. Mesrai's flag, the rotation procedure, and the pre-commit hook that closes the class. CWE-798.
8 min read· Mesrai Team
September 4, 2026Technical Deep DiveThe Logging Statement That Was Quietly Writing PII to Datadog
Real incident: log statement printing req.body sent PII to Datadog for 6 months. SOC2 audit finding. Redaction fix.
8 min read· Mesrai Team
September 3, 2026Technical Deep DiveA Forgotten Feature Flag That Almost Shipped to 100% of Users
Real story: feature flag catch-all defaulting to true — would have shipped half-built feature on flag-service blip. Safe-default fix.
8 min read· Mesrai Team
September 3, 2026Technical Deep DiveA One-Character Bug in a Pricing Tier Check: The $X-Per-Month Save
Real incident: `<` instead of `<=` in tier check — $24K leaked over 3 months. Boundary-test fix.
8 min read· Mesrai Team
September 2, 2026Technical Deep DiveThe Migration That Locked the User Table for 8 Minutes — Avoided
Real incident: ADD COLUMN NOT NULL on 80M-row users held lock 8 minutes — auth outage. Three-step migration fix.
8 min read· Mesrai Team
September 2, 2026Technical Deep DiveA Race Condition in Webhook Replay That Created Duplicate Orders
Real incident: 4 webhook retries during network glitch created 4 duplicate orders. Event-id idempotency fix.
8 min read· Mesrai Team
September 1, 2026Technical Deep DiveThe CSP Header Mesrai Restored During an Emergency Hotfix
Real story: CSP header commented during hotfix, shipped to prod. Mesrai catch on diff. Restore + HSTS fix.
8 min read· Mesrai Team
September 1, 2026Technical Deep DiveA Hidden N+1 That Took Down Postgres at 2AM IST
Real incident: feed N+1 under marketing-spike traffic crashed Postgres. 12-minute outage. IN-clause fix.
8 min read· Mesrai Team
August 31, 2026Technical Deep DiveThe Payment Refund Loop That Cost $40K — Caught Pre-Merge by Mesrai
Real incident: refund retry loop without idempotency — 47 duplicate refunds, $40K liability. Stable-key fix.
8 min read· Mesrai Team
August 31, 2026Technical Deep DiveA Production-Wide Outage That Started as a Missing await
Real incident: session flush missing await — 80% error rate, 40-minute outage. Mesrai catch of the same shape.
8 min read· Mesrai Team
August 30, 2026Technical Deep DiveThe Auth Bypass Mesrai Caught 12 Minutes Before a Customer Demo
Real incident: pre-demo hotfix disabling auth API-wide. Mesrai flagged with 12 minutes to spare. Scoped-router fix.
8 min read· Mesrai Team