Field Notes
Notes on event-driven Java, Spring Boot, Kafka, and secure systems for regulated banking.
I pointed the new claude-security plugin at this very site. It spawned 82 agents, proposed 10 vulnerabilities, and then argued itself out of 9 of them. The one that survived was real — and it shipped to prod the same afternoon.
I got annoyed at 'free' CV builders that paywall the download button, so I built one that is actually free: a guided wizard with a live A4 preview, French and English, and a PDF that never touches my server. Here is the product thinking, the architecture, and the near-outage a code review caught.
Traces, Tempo and the LGTM stack
If you distribute a Claude Code agent to a marketplace, every developer who runs it spends your reasoning budget and yours to answer for. Here is how I wired Claude Code's built-in OpenTelemetry into a Grafana/LGTM stack to watch cost, tokens and tool decisions — per run.
Security and privacy, in practice
I added a privacy notice to my site and refused to make it a cookie banner — because the only cookie I set is a functional one. Here's the reasoning, and why the dismiss flag lives in localStorage, not a cookie.
Learning MongoDB · Part 2
Part 2 of my MongoDB learning series: how the aggregation pipeline reshapes documents stage by stage — $unwind, $group, $lookup — plus the type-mismatch bug that silently joins nothing and why stage order is a cost decision.
Learning MongoDB · Part 1
Part one of a series: a Spring Boot 4 playground, the embed-vs-reference call that replaces schema normalization, and the Decimal128 default that would have quietly corrupted every price I stored.
Shipping an AI feature into my own product · Part 3
I added job-description matching to the AI concierge on my career site. It shipped with no new bean, no new table, and no migration — because the leverage was in a seam I'd already built. A design note on shared streaming cores, streamable structured output, and treating a pasted JD as hostile.
A 5 minute experiment: wiring Alibaba's page-agent into my career site and pointing it at DeepSeek, so the whole UI takes orders in plain English. How it works under the hood, what its reasoning traces actually look like, and why I kept it strictly local.
Running the box: Docker, Linux, the JVM
Spring Boot's layered jar extraction splits your dependencies from your code for faster Docker rebuilds. But the mechanism that makes the pieces find each other at runtime isn't Spring at all — it's a JVM rule from 1998.
Security and privacy, in practice
The cheapest security win on a single-container stack lives at the reverse proxy. Here's the four-header Traefik middleware I shipped, the two things I deliberately held back, and the report-only CSP rollout I'm lining up next.