Things I've written down.
Ruby, Rails, performance, security and applied machine learning. Updated when something feels finished.
Prompt injection isn't XSS, but it rhymes
Both come from mixing instructions with data. The difference is that there is no escaping function for English.
Where Rails memory actually goes
Your app is not leaking. Ruby freed the memory and the allocator kept it. Arenas, fragmentation, and the two environment variables that fix most of it.
What's actually in your session cookie
Rails signs the session cookie, so users can read it but not forge it. That distinction decides what may go in it.
Your connection pool is probably wrong in one of two directions
ActiveRecord::ConnectionTimeoutError and "too many connections" are the same mistake made in opposite directions. The arithmetic is simple.
What belongs in a job, and what belongs in the request
Moving work to a background job doesn't make it faster. It moves who waits, and sometimes that's the wrong trade.
Your dependencies are your attack surface
A modest Rails app pulls in a hundred-odd gems and several hundred transitive ones. Almost none were chosen by anyone.
The 55% page-load win was four queries and a cache key
Cutting clinical-study page loads by more than half under real traffic. Not a rewrite — profiling, eager loading, and one honest look at what was cacheable.
Chunking is a retrieval decision, not preprocessing
How you split documents determines what is findable. Everything downstream inherits that choice, and almost nobody measures it.
Everything that runs before your controller
A Rails request passes through twenty-odd middleware before your code sees it. Knowing the stack turns a class of mystery into a list.