Skip to content

Articles

Articles

Writing on Dev.to.

Software, architecture, and the developer experience, newest first.

© 2026 Nasrul Hazim

RSS Sitemap Contact

Articles

Writing on Dev.to.

Software, architecture, and the developer experience, newest first.

Writing notes in a notebook beside a laptop and coffee — Photo: Thought Catalog / Unsplash

Search articles

100 articles

September 21, 2026I turned my Claude Code sessions into a 3D office my team can watchClaude Code hooks + Agent Bus + Hermes3D — every session and subagent becomes a named staff member with a role, a task and a kanban card.September 9, 2026Dev Log: 6 September 2026 — A Guarantee You Only Wrote Down Isn't One92 commits today across six repositories, two products from scratch — a learning platform in Laravel...September 9, 2026Eleven Empty Folders and a Test: Enforcing Module Boundaries Before the First Class ExistsTL;DR — I started a modular monolith today and drew eleven bounded contexts before writing a single...September 6, 2026Four Env Vars and No Foreign Key: What It Means to Actually Attach a ResourceTL;DR — One commit today, and it's a Markdown file. No migration, no action class, no tests. I spent...September 5, 2026Unknown Is Not Failed: Four Bugs Where My Control Plane Claimed to Know Something It Didn'tTL;DR — Nineteen commits into a deployment control plane today. Reading them back, four of them are...September 4, 2026Dev Log: 3 September 2026 — Everything I Fixed Today Was Already WrittenSix commits across two codebases today — a deployment platform and an identity system. Different...September 4, 2026My Agent Skills All Said How to Start. None Said When to Stop.TL;DR — I read someone else's skill library, went back to my own 32 skills, and found every one of...September 4, 2026nginx add_header Appends. It Doesn't Override — And That Can Remove Protection.TL;DR — I shipped a baseline of security headers into every generated nginx vhost, meaning it as a...September 4, 2026Dev Log: 2 September 2026 — Every Bug Today Was a Claim Nobody CheckedTwenty-two commits across four repos today. Different stacks, different problems, and — reading them...September 4, 2026Dev Log: 1 September 2026 — Every Bug Today Was a Name ProblemFifty-three commits across eight repos today. Reading them back in one sitting, they sorted...September 4, 2026Dev Log: 31 August 2026 — Loaded Is Not ServingThirty-eight commits across five repos today. Reading them back, most were the same species of bug:...September 4, 2026The Most Dangerous Backup Is the One That Reports SuccessTL;DR — I spent today building out a backup subsystem, and almost every design decision that mattered...August 31, 2026A Symlink Swap Is Not a Zero-Downtime DeployTL;DR — I had Capistrano-style releases on a plain VM: build into releases/<ref>, swap a...August 31, 2026Dev Log: 30 August 2026 — Absence Is Not the Same as ZeroTwenty-three commits across four repos today. Looking back at them, most had the same shape...August 31, 2026A Credential Rotation Without an Overlap Is Just an Outage You ScheduledTL;DR — I shipped managed S3-compatible storage servers today, and the most interesting thing in the...August 30, 2026Dev Log: 29 August 2026 — Holes in the Ops Surface, and Docs That LieTwenty-five commits across eight repos today. The thread running through most of them: finishing...August 30, 2026CSP Broke Two of My Apps Today, in Opposite DirectionsTL;DR — Content-Security-Policy took down parts of two different apps in one day. One app enabled it...August 29, 2026Every Card Drew Perfectly. Every Relation Was Gone.TL;DR — nasrulhazim/claude 2.4.0 ships a schema-diagram skill and an /erd command that generate a...August 28, 2026All 112 Cards Drew Perfectly. All 161 Relations Were Gone.TL;DR — I built an interactive ERD for a 112-table Laravel schema: one self-contained HTML file,...August 28, 2026Dev Log: 27 August 2026 — Everything That Reported Success and Wasn'tThirteen repos moved today, sixty-nine commits. One is public — laravel-billing — and got its own...August 28, 2026My Payment Contract Was Typed on a Subscription. Ten Drivers Paid for It.TL;DR — laravel-billing 2.0.1 makes the one-off charge the primitive. A plan checkout is now just a...August 27, 2026Dev Log: 26 August 2026 — Every Second Copy of a Rule Is a Future DisagreementNine repos moved today. One is public and got its own post; the rest is private work, so what follows...August 27, 2026I Couldn't Fix the Bug Until I Stopped Supporting the Old MajorTL;DR — laravel-scheduler-manager now targets Livewire 4 only. Not because Livewire 3 stopped...August 26, 2026Dev Log: 25 August 2026 — Silent Failures, Double Counting, and Constraints You Can't DefendFour repos moved today. One is public and got its own post; the rest were private work, so what...August 26, 2026My Test Suite Was Green Because Blade Never RecompiledTL;DR — I shipped a release note claiming "Livewire 4 is not supported" based on two failures I never...August 26, 2026Dev Log: 2026-08-24 — Everything That Only Breaks in ProductionTL;DR — Forty-one commits across six repositories and almost all of them share one shape: code that...August 26, 2026Raw SQL in a Laravel Package? Ask the Grammar, Don't Assume MySQLTL;DR — A package that writes raw SQL inherits every database its host application might run on....August 26, 2026Your Package's CDN Link Is Your Host App's CSP ViolationTL;DR — A Laravel package that fetches a stylesheet, a script, or a webfont from a third-party host...August 26, 2026Fail at Step 1, Not Step 14: Preflight Checks for Long PipelinesTL;DR — I spent today running a provisioning pipeline against a fresh OS family for the first time,...August 26, 2026Dev Log: 2026-08-23 — Preflight Gates, a Second OS Family, and a Chess Engine Behind FFITL;DR — A long day across a deployment platform and a brand-new mobile app. Two themes kept...August 26, 2026Your OS Abstraction Isn't Real Until the Second Family BootsTL;DR — I have an OsProfileContract with a Debian implementation that's been happily provisioning...August 23, 2026Dev Log: 2026-08-22 — Driver Seams, Apply-Then-Store, and Credentials That RetireTL;DR — A heavy day across a deployment platform and a CRM. The thread running through most of it:...August 23, 2026Sanitize Twice: Why One Pass Isn't Enough for Rich-Text EmailTL;DR — I sanitize rich-text email bodies when they're saved. Today I added a second pass at render...August 23, 2026One Interface, Three Database Engines: Building the Driver Seam Before You Need ItTL;DR — I spent today building the ability to manage a database server from a platform UI: create...August 22, 2026Dev Log: 2026-08-21 — Native Deploys, Masked Env Vars, and Two Migration PapercutsTL;DR — A long day across five repos. The theme that kept repeating: the failure that looks like...August 22, 2026Deploying Without Docker: Model the Native Build as a Recipe, Not a DockerfileTL;DR — I spent the day teaching a deployment control plane to build apps natively on a plain VM — no...August 22, 2026Your Package's Blade View Should Not Know Your App ExistsTL;DR — A view shipped inside cleaniquecoders/laravel-db-doc opened with <x-guest-layout> and...August 21, 2026Three Clicks, Three Concurrent Builds: Move Long Work Out of the HTTP RequestTL;DR — A Redeploy button in a Livewire component ran the full clone-and-build inline in the HTTP...August 21, 2026Your SSH Command Timeout Is Probably a Budget, Not an Inactivity WindowTL;DR — I spent an evening chasing a deploy that kept dying with "command produced no output for 30s...August 19, 2026Dev Log: 2026-08-19 — the bugs that never threwThirteen commits across five repos today, and once I lined them up in the evening the pattern was...August 19, 2026Bolting a rich-text editor onto a column full of plain textToday's job: let people write email bodies with bold text, headings, links and inline images instead...August 19, 2026Brand Your Terminal: An Isometric ASCII Banner with a True-Color GradientTL;DR — Every new terminal I open now greets me with my company's logo in isometric ASCII art,...August 18, 2026Dev Log: 2026-08-18 — everything that had to survive being called twiceEight commits across four repos, and by evening they'd all quietly converged on the same question:...August 18, 2026One person, one contact: deduping at the point of captureToday I shipped both sides of a form. A marketing site got a "Get Notified" modal on its course...August 17, 2026Dev Log: 2026-08-13 — machines that state their own identity, and four fakes that certified nothingTwenty-six commits across six repos, and the day had one accidental theme running through it: things...August 17, 2026Ask the machine what it is before you change itI spent today on a control plane that provisions plain VMs over SSH — the kind of app where a wrong...August 12, 2026Dev Log: 2026-08-11 — a tenant for every account, four frontend traps that never error, and the fourth comparison siteThirty commits across three repos, and the day split cleanly into two halves: standing a control...August 12, 2026Dev Log: 2026-08-12 — a 96s suite that became 42s, a capability that wasn't a scope, and four steps to a passkeyFifteen commits, three repos, and the bulk of it in one: a control plane that got an MCP surface, a...August 12, 2026Not Found is the wrong answer to a permission problemI spent today putting an MCP surface on a multi-tenant Laravel control plane — the kind of app where...August 12, 2026The deploy script that always said it workedTL;DR I stood a Laravel control plane up on a bare Ubuntu host today. The provisioning...August 11, 2026Dev Log: 2026-08-10 — a toast that lied, an enum with a missing case, and a design system that finally has an addressFour commits across two repos, and a short day by commit count that still managed to contain the most...August 11, 2026"3 skipped" tells the operator nothingTL;DR Bulk actions over a mixed selection always skip rows. A count of skips is not a...August 10, 2026Dev Log: 2026-08-09 — 72 classes that should have been 8 rows, and a compliance clockSixteen commits, all on one private deployment platform, spread across a very long day — a batch just...August 10, 2026A driver that quietly does nothing is worse than one that isn't thereTL;DR A method that can't do its job has three options: do it, throw, or return "I can't"...August 9, 2026Dev Log: 2026-08-08 — stubs that answer politely, and a CSS property that doesn't existHeavy day, mostly on one private deployment platform, plus a small but instructive fix in a PDF book...August 9, 2026Which parts of this are real? Should be a question with an answerTL;DR The most expensive bug I hit yesterday wasn't a crash. It was a stub that answered...August 8, 2026Dev Log: 2026-08-07 — scrubbing secrets, reconciling drift, and extracting a book engineA heavy day across six repos. Rather than list commits, here's the through-line: almost everything...August 8, 2026Drift detection and autoscaling are the same shape: ask the provider, then decideTL;DR Drift detection and autoscaling look like different features. They're the same...August 8, 2026Scrubbing secrets from logs: patterns catch what you didn't issue, literals catch the restTL;DR cleaniquecoders/pii-protection now ships SecretScrubber (pattern-based),...August 7, 2026Dev Log: 2026-08-06 — Pest 5 everywhere, a build-preset registry, and an MCP server inside a Laravel appTL;DR Rolled a Laravel starter/scaffolder onto Pest 5, made pest --tia (test impact...August 7, 2026One interface, many runtimes: a build-preset registry in LaravelTL;DR When one system has to build many kinds of app (Laravel, Django, Go, Node,...August 7, 2026Putting an MCP server inside your Laravel appTL;DR An MCP server lets an AI assistant call your app's real actions instead of guessing...August 7, 2026Upgrading to Pest 5 and making --tia the defaultTL;DR Bumped Kickoff (my Laravel scaffolder) to Pest 5, PHP 8.4 floor, Symfony Console...August 6, 2026Two gotchas when your Laravel app shells out to a CLITL;DR If a web request shells out to a slow CLI (docker, kubectl, rsync…), move it to a...August 6, 2026Dev Log: 2026-08-05 — reverse proxies, email journeys, and a tenant that wasn't thereTL;DR On a deployment platform: added a real nginx reverse-proxy tier with health gating,...August 6, 2026Dev Log: 2026-08-03 — a toolkit ships, drivers land, and quotas get realTL;DR Shipped a big reorg of my open-source Claude Toolkit and bundled it into my Kickoff...August 6, 2026Skills, Agents, Commands: turning a pile of prompts into a toolkitTL;DR I reorganised my Claude Toolkit into three clear layers: skills (knowledge), agents...August 3, 2026Skills Were Only Half the Answer: Upgrading to Agents, Skills and CommandsBack in February I wrote about agent-skills — a repo of SKILL.md files that taught Claude Code my...August 3, 2026Dev Log: 2026-07-31TL;DR Fixed a package that ignored its own "configure your own model" setting. Reworked a...August 3, 2026Stop hard-coding the model: resolve the configured one insteadTL;DR A package that lets you configure a model, then calls the default one statically...July 30, 2026Two IDs, One Row: Keeping Public UUIDs and Internal Keys From Leaking Into Each OtherTL;DR I use two identifiers per row: a UUID as the public ID (URLs, APIs, forms) and an...July 28, 2026Shared-Database Multi-Tenancy in Laravel: The Foundation LayerTL;DR Shared-database multi-tenancy = one database, every row tagged with tenant_id, a...July 28, 2026Dev Log: 2026-07-23 — a portfolio-wide SEO passTL;DR Ran the same SEO + analytics checklist across five public repos and a couple of...July 28, 2026Admin-editable SEO & analytics without touching .envTL;DR Shipped a SEO + analytics baseline in Kickoff: meta/OG, canonical, JSON-LD org...July 22, 2026One folder shape for every course: a lifecycle monorepo conventionTL;DR I merged several training courses into one monorepo and gave every course the same...July 22, 2026Stop Screenshotting Architecture Diagrams: Build Them as Single-File HTMLTL;DR Spent today rebuilding two training diagrams — a layered reference architecture and...July 22, 2026Ebook Reviewer Wanted: Help Me Find What's Gone StaleI'm opening up my ebook series to technical reviewers before the final edition ships. Here's what the job actually involves, and the four-column format I use to make book feedback useful.July 20, 2026Dev Log: 2026-07-19TL;DR Shipped an email broadcast module: audience filtering, suppression, queued...July 20, 2026Building an Email Broadcast Engine That Survives RetriesTL;DR Shipped an email broadcast feature: audience filter → suppression gate → one queued...July 20, 2026Your Seeder Should Describe a Shape, Not Your LaptopTL;DR Rewrote a bootstrap seeder so the deployment stack — DB engine, queue runner, PHP...July 16, 2026The differentiator test: if a rival can copy the claim, it isn't oneTL;DR I rewrote a product's differentiators after noticing four of five were claims any...July 16, 2026Dev Log: 2026-07-16TL;DR Rewrote a product's landing-page differentiators to only keep claims a rival can't...July 16, 2026Dev Log: 2026-07-15TL;DR Shipped account suspension across two Laravel apps — an enum, a middleware, a...July 16, 2026Suspend a user in Laravel without deleting themTL;DR Suspension is not deletion: keep the row, block the sign-in. Model it as a status...July 15, 2026Dev Log: 2026-07-14TL;DR Fast-forwarded two Laravel apps off an old in-house skeleton — in layers, not one...July 15, 2026The Reconciler Pattern: When a Queued Job Simply Never RunsTL;DR A job dispatched once, at row-creation time, has a silent failure mode: if that...July 9, 2026Dev Log: 2026-07-09 — one source of truth, three times overTL;DR Three unrelated repos, one recurring theme: derive from a single source of truth...July 9, 2026One config, three surfaces: a registry-driven sidebar switcher in LaravelTL;DR The sidebar, the new section switcher, and breadcrumbs all read the same...July 9, 2026When a password sync is 'partly done', it's a bug: converging on one canonical flowTL;DR Two apps each had their own password-change/reset logic, plus config toggles to...July 7, 2026Dev Log: 2026-07-07TL;DR Collapsed a billing model from à-la-carte features to plans-only, in four safe...July 7, 2026Killing à-la-carte: migrating a feature-gating model to plans-onlyTL;DR Moved a SaaS from à-la-carte feature subscriptions (pay per feature) to plans-only...July 6, 2026Dev Log: 2026-07-06TL;DR Rolled a shared support-widget embed setting across the whole product suite — one...July 6, 2026The Blade Gotcha That 500s Your Page: Directives Inside Component AttributesTL;DR You can't put a Blade directive (@if/@endif) inside a component tag's attribute...July 6, 2026Dev Log: 2026-07-05TL;DR 23 commits across 4 repos, one theme: opening apps to the outside world,...July 6, 2026A Cookie-Free Embeddable Support Widget: What Adversarial Review CaughtTL;DR Built an embeddable support widget for a helpdesk product: no cookies — a...July 5, 2026Dev Log: 2026-07-04TL;DR Two Laravel backends started serving Flutter apps on the same day — an events...July 5, 2026Offline-First Check-In: A Laravel API That Survives Venue Wi-FiTL;DR A gate check-in app can't depend on live Wi-Fi: scans must work offline and sync...July 4, 2026Setting Up BayarCash (FPX) in Laravel the Right WayA driver-based, testable BayarCash integration pattern from three production Laravel apps — checkout, webhooks, and the recurring-billing reality.July 3, 2026Dev Log: 2026-07-03 — idempotent syncs, mail you can trace, and drain-not-deleteTL;DR Sync must be idempotent. Re-running a gateway sync should converge, not explode on...July 3, 2026Idempotent gateway sync: adopt on conflict, paginate for real, and never widen scopeTL;DR Syncing config into an API gateway (Kong here) is a converge operation, not an...