Writing

The interesting architecture is easier to justify after something is in production. Before that, it is a guess with extra steps.

Allowing unauthenticated writes to one field sounds harmless. Getting the rule slightly wrong turns it into an open door.

Rich text editors produce HTML you cannot reason about. Plain text with a small grammar survives every migration you will ever do.

The top line is where it exploded. The line you actually want is usually further down, in a file you wrote.

Every permission system has a chicken-and-egg problem at the start. How you solve it decides whether an attacker can mint themselves an account.

You deployed. The old site is still there. Nothing is broken — a header is doing exactly what you told it to.

A comment explaining what a line does is noise. A comment explaining why it had to be that way is the most valuable thing in the file.

Static generation looks free until you notice every prerendered page opened its own database connection.

Client-side route guards hide UI. They do not stop anyone. If your rules are permissive, your data is public no matter what your React code says.

A personal site gets a few hundred reads a day. Paying for a running server to render pages nobody is waiting on is the wrong trade.