https://mahmudul.dev Long-form writing and short notes on how things actually work — internals, protocols, and the occasional security postmortem. en Tue, 25 Aug 2026 00:00:00 GMT https://mahmudul.dev/posts/harness-engineering https://mahmudul.dev/posts/harness-engineering Reliability in agent systems comes from the harness, not the model. What a harness actually does — context, tools, durability, budgets, approval — and why a good one survives a model swap. Tue, 25 Aug 2026 00:00:00 GMT ai agents harness-engineering architecture context-engineering backend software-engineering https://mahmudul.dev/posts/fake-recruiter-git-hook-malware https://mahmudul.dev/posts/fake-recruiter-git-hook-malware A fake recruiter sent me a confidential project brief as a Git repo. Hidden in .git/hooks was a dropper that fires the moment you check out a branch. Wed, 03 Jun 2026 00:00:00 GMT security malware git social-engineering freelancing https://mahmudul.dev/posts/spec-driven-development-with-claude https://mahmudul.dev/posts/spec-driven-development-with-claude Spec-driven development with Claude: writing the spec first, structuring the context it reads, and the workflow that makes AI-assisted coding repeatable. Sat, 11 Apr 2026 00:00:00 GMT claude ai spec-driven-development context-engineering developer-productivity prompt-engineering software-engineering best-practices https://mahmudul.dev/posts/jq-json-command-line https://mahmudul.dev/posts/jq-json-command-line A practical guide to jq: piping JSON in, pretty-printing, filtering and reshaping it, with the handful of expressions worth committing to memory. Mon, 02 Feb 2026 00:00:00 GMT jq json command-line cli shell productivity https://mahmudul.dev/til/leap-seconds https://mahmudul.dev/til/leap-seconds Why atomic time and the Earth’s rotation disagree, how the leap second papered over it, and the outages that followed. Mon, 02 Feb 2026 00:00:00 GMT TIL time leap-seconds programming https://mahmudul.dev/posts/http-demystified https://mahmudul.dev/posts/http-demystified A working mental model of HTTP: URLs, methods and headers, then caching, cookies, CDNs, HTTP/2 and what HTTPS actually protects. Sun, 01 Feb 2026 00:00:00 GMT http web-development backend frontend networking debugging https://mahmudul.dev/posts/marketplace-malware-attack https://mahmudul.dev/posts/marketplace-malware-attack How attackers are using freelance platforms to trick developers into running malicious code that steals data and credentials Wed, 21 Jan 2026 00:00:00 GMT security malware social-engineering marketplaces awareness https://mahmudul.dev/posts/how-git-works-under-the-hood https://mahmudul.dev/posts/how-git-works-under-the-hood How Git stores your code: the object model behind commits, trees and blobs, and what branches, merges and the reflog really are underneath. Mon, 22 Dec 2025 00:00:00 GMT git version-control internals workflow command-line development-tools https://mahmudul.dev/posts/typescript-utility-types https://mahmudul.dev/posts/typescript-utility-types TypeScript’s utility types with real examples: Partial, Required, Pick, Omit, Record and Awaited, and when each one is the right tool for the job. Sun, 23 Nov 2025 00:00:00 GMT typescript utility-types type-safety web-development frontend programming https://mahmudul.dev/posts/abort-controller-guide https://mahmudul.dev/posts/abort-controller-guide Cancelling async work with AbortController: aborting a fetch, wiring up timeouts, cleaning up on unmount, and composing more than one signal. Fri, 24 Oct 2025 00:00:00 GMT javascript async cancellation fetch web-development frontend performance https://mahmudul.dev/posts/demystifying-jwt https://mahmudul.dev/posts/demystifying-jwt What a JSON Web Token actually contains, how signing and verification work, and where JWTs go wrong in real authentication flows. Tue, 21 Oct 2025 00:00:00 GMT jwt authentication security web-development https://mahmudul.dev/posts/css-specificity https://mahmudul.dev/posts/css-specificity A fun, beginner-friendly guide to understanding CSS specificity with practical examples and easy-to-remember rules. Mon, 22 Sep 2025 00:00:00 GMT css frontend specificity web-development beginner-friendly https://mahmudul.dev/posts/js-equality-myths https://mahmudul.dev/posts/js-equality-myths When to reach for ===, the few places == genuinely helps, and the coercion rules behind the comparisons that surprise people most. Fri, 19 Sep 2025 00:00:00 GMT javascript equality coercion basics web-development https://mahmudul.dev/posts/secret-life-of-a-website-visit https://mahmudul.dev/posts/secret-life-of-a-website-visit A fun, story-style walkthrough of what really happens when you type a URL: DNS, TCP, TLS/SSL, HTTP, caching, rendering, CORS, cookies, CDNs, and more. Thu, 18 Sep 2025 00:00:00 GMT web-development networking dns ssl cors http browser cdn security https://mahmudul.dev/posts/secure-jwt-frontend https://mahmudul.dev/posts/secure-jwt-frontend Storing and refreshing JWTs safely in a frontend app: in-memory access tokens, HttpOnly refresh cookies, rotation, and the CORS and CSRF details. Wed, 10 Sep 2025 00:00:00 GMT security jwt frontend web-development authentication https://mahmudul.dev/posts/closures-in-js https://mahmudul.dev/posts/closures-in-js A fun and practical guide to understanding closures in JavaScript, with real-world use cases like caching, rate limiting, event handling, and more. Tue, 09 Sep 2025 00:00:00 GMT javascript typescript closures caching frontend web-development https://mahmudul.dev/posts/imperative-vs-declarative https://mahmudul.dev/posts/imperative-vs-declarative A fun and practical guide to understanding when to use imperative vs declarative approaches in JS/TS, with lots of real-world examples. Sat, 06 Sep 2025 00:00:00 GMT javascript typescript imperative declarative programming best-practices https://mahmudul.dev/posts/promise-methods-playbook https://mahmudul.dev/posts/promise-methods-playbook A fun, practical guide to JavaScript promise methods — all, allSettled, race, any, resolve/reject, and finally — with examples you’ll actually use. Thu, 04 Sep 2025 00:00:00 GMT javascript async promises web-development frontend https://mahmudul.dev/posts/web3-auth-express https://mahmudul.dev/posts/web3-auth-express Wallet-based authentication in Express.js: verifying an Ethereum signature, issuing a session, and the replay and nonce problems to handle. Mon, 01 Sep 2025 00:00:00 GMT web3 authentication express ethereum blockchain nodejs security https://mahmudul.dev/posts/domain-driven-design-nextjs https://mahmudul.dev/posts/domain-driven-design-nextjs Where domain logic belongs in a Next.js app, and how entities, use cases and repositories keep it out of the route handlers and components. Wed, 27 Aug 2025 00:00:00 GMT ddd domain-driven-design nextjs typescript architecture software-design clean-architecture https://mahmudul.dev/posts/stop-using-get-in-server-actions https://mahmudul.dev/posts/stop-using-get-in-server-actions Why a GET inside a Next.js Server Action adds a round trip, how to fetch in a React Server Component instead, and when a Server Action is the right tool. Mon, 25 Aug 2025 00:00:00 GMT nextjs server-actions react-server-components performance web-development react optimization https://mahmudul.dev/posts/custom-auth-next-js https://mahmudul.dev/posts/custom-auth-next-js Custom authentication in Next.js against an external backend: access and refresh tokens, silent renewal, and where each token should actually live. Wed, 18 Sep 2024 00:00:00 GMT nextjs authentication jwt tokens security web-development react backend https://mahmudul.dev/posts/deleting-local-branches-git https://mahmudul.dev/posts/deleting-local-branches-git Cleaning up a Git repository by deleting the local branches whose remotes are gone — one command, plus what is actually safe to remove. Wed, 28 Aug 2024 00:00:00 GMT git version-control development-tools command-line productivity workflow https://mahmudul.dev/til/quick-inspect-package-json-scripts https://mahmudul.dev/til/quick-inspect-package-json-scripts A one-line shell function that prints the scripts block of any package.json, so you stop opening the file to remember a command name. Mon, 28 Aug 2023 00:00:00 GMT TIL bash shell json