Engineering essays.
Deep-dives on AI code review, multi-agent architecture, and the craft of shipping reliable software at speed.
July 31, 2026Technical Deep DiveStripe Webhook Race: Processing the Same Event Twice
Real PR catch: webhook handler with no event-id idempotency — slow responses trigger Stripe retries, same event processed twice. DB unique-constraint fix.
8 min read· Mesrai Team
July 30, 2026Technical Deep DiveDeadlock in Two-Lock Acquisition: The Order Mesrai Always Recommends
Real PR catch: transfer-funds locking accounts in argument order — concurrent reverse transfers deadlock. Sorted-order fix.
8 min read· Mesrai Team
July 30, 2026Technical Deep DiveCache Stampede on Cold Boot: A Mesrai-Caught Architectural Smell
Real PR catch: cache-or-load path that lets every concurrent miss run the query. Single-flight + jitter fix.
8 min read· Mesrai Team
July 29, 2026Technical Deep DiveDouble-Submit Form Race: Mesrai's Idempotency-Key Suggestion
Real PR catch: payment endpoint without idempotency — double-clicks cause double charges. Stripe idempotency-key + DB upsert fix.
8 min read· Mesrai Team
July 29, 2026Technical Deep DiveLost-Update on Counter Increment: The UPDATE x SET n = n + 1 Pattern
Real PR catch: read-then-write counter increment — concurrent requests lose increments. Atomic UPDATE fix.
8 min read· Mesrai Team
July 28, 2026Technical Deep DiveReact useState Race Condition in Stale Closures
Real PR catch: setInterval in useEffect with empty deps capturing useState — counter stuck. Functional-update fix.
8 min read· Mesrai Team
July 28, 2026Technical Deep DiveAsync/Await Inside forEach: Why It Skips Errors + How Mesrai Flags
Real PR catch: `items.forEach(async ...)` — outer code does not await, errors disappear. for..of and Promise.all fixes.
8 min read· Mesrai Team
July 27, 2026Technical Deep DiveJavaScript Promise.all + Shared State Mutation: A Caught Bug
Real PR catch: side-effects from inside Promise.all callbacks — non-deterministic order. Return-value fix.
8 min read· Mesrai Team
July 27, 2026Technical Deep DiveGoroutine Leak in a Go HTTP Handler: Live Demo
Real PR catch: `go fetchAndProcess(...)` without context propagation — every cancelled request leaks a goroutine. Context+timeout fix.
8 min read· Mesrai Team
July 26, 2026Technical Deep DiveThe Inventory Race Condition Mesrai Caught Before Black Friday
Real PR catch: read-then-decrement on inventory — TOCTOU oversell under concurrent load. Atomic conditional update fix.
8 min read· Mesrai Team
July 26, 2026SecurityOAuth State Parameter Missing: How Mesrai Prevents CSRF on Callback
Real PR catch: OAuth callback without `state` verification. The session-binding attack and the generate-store-verify fix. CWE-352.
8 min read· Mesrai Team
July 25, 2026SecurityIDOR in REST Endpoints: The /users/:id Diff Mesrai Caught
Real PR catch: `/users/:id` with no ownership check — sequential ids let any user scrape the entire user table. CWE-639 walkthrough.
8 min read· Mesrai Team