Engineering Notes

Engineering Notes

Deep dives into how my open-source backend projects actually work: the design decisions, the trade-offs I accepted, and the tests that keep them honest. Every code excerpt links to the file it came from.

Articles

  1. Running webhook workers in parallel without double delivery

    8 min read webhook-relay

    How webhook-relay lets several workers share one PostgreSQL queue with FOR UPDATE SKIP LOCKED, claim leases and crash recovery, and the test that fails the moment the lock is removed.

    • postgresql
    • distributed-systems
    • python
    • reliability

  2. Measuring retrieval instead of guessing

    8 min read rag-eval-lab

    What rag-eval-lab learned by scoring three chunkers against four retrievers on a bilingual English and Bangla help centre, how evidence spans make the comparison fair, and where the numbers should not be trusted.

    • rag
    • information-retrieval
    • evaluation
    • bangla

  3. Guardrails that don't trust the model

    8 min read ai-support-agent

    How ai-support-agent lets a language model call refund and address tools without letting it authorise anything, and the ablation run where 46 of 53 scenarios still pass with the soft guardrails off and no money moves.

    • ai-agents
    • llm
    • security
    • evals

  4. Five rate-limiting algorithms, one Lua script each

    8 min read rate-limiter-service

    Token bucket, fixed window, sliding log, sliding window counter and GCRA side by side in rate-limiter-service, why every Redis step is a single Lua script, and what the benchmark table actually tells you.

    • redis
    • rate-limiting
    • algorithms
    • python

  5. Idempotency keys done properly in a payment API

    8 min read fastapi-payment-gateway

    Replaying stored responses, rejecting a reused key with a different body, committing the receipt with the charge, plus the state machine and integer money that make retries safe in fastapi-payment-gateway.

    • payments
    • fastapi
    • idempotency
    • fintech

  6. Refresh-token rotation with reuse detection, and tenancy in one dependency

    7 min read multi-tenant-saas-auth

    How multi-tenant-saas-auth rotates refresh tokens in families so a replayed token logs out the thief and nobody else, and how one FastAPI dependency answers "which tenant, with what permissions" for every route.

    • authentication
    • security
    • fastapi
    • multi-tenancy

About

I'm Akib Jafor, a senior full-stack engineer in Dhaka, Bangladesh. I build backends in Python (FastAPI, Django) and frontends in React, Next.js and Vue, mostly for payments, fintech, retail and cloud platforms, where retries, money and multi-tenancy are everyday problems rather than edge cases.

These notes accompany the public projects on my GitHub. More about my work is on my portfolio. New articles are announced in the RSS feed.