Notelogs

A practical breakdown of the agent loop, tool use, planning strategies, and the architectural decisions that determine whether an agent is reliable in production.

A step-by-step guide to building semantic search for a content site using embeddings, a vector store, and a Next.js API route—no keyword matching required.

Practical techniques for reducing LLM API costs and response latency in production: prompt caching, model selection, streaming, output constraints, and smart batching.

Concrete techniques — retrieval grounding, structured output validation, self-critique, and guardrails — for shipping LLM features that users can actually trust.

A practical explanation of what text embeddings are, how similarity search works, and how to use embeddings for search, clustering, and recommendation in real applications.

A practical guide to managing conversation history, summarisation, and persistent memory so your AI chatbot remains coherent across long sessions and page reloads.

Understand how to give an LLM the ability to call your functions and APIs, enabling it to take real actions in the world rather than just generate text.

Learn how to stream tokens from the Claude API to your Next.js UI for a responsive, real-time chat experience using the Vercel AI SDK and Route Handlers.

Caching is the highest-leverage performance work you can do. This guide breaks down the layers — browser, CDN, ISR and Redis — how they fit together, and how to invalidate them without serving stale data.

How to structure prompts, system instructions, and few-shot examples to get consistent, reliable output from large language models—written for engineers, not marketers.

What vector databases are, how similarity search works under the hood, and how to choose between managed services and self-hosted options for your AI application.

How RAG grounds large language models in your own data: chunking documents, generating embeddings, querying a vector store, and assembling a grounded prompt for reliable generation.

A practical walkthrough for integrating Claude into a Next.js application—covering API setup, model selection, prompt structure, streaming, and error handling.

The ten most critical web security risks, reframed for JavaScript and Node.js developers—with concrete examples of how each manifests and how to prevent it.

A practical guide to locking down REST APIs: authentication, authorization, input validation, rate limiting, and the principle of least privilege—illustrated with Node.js examples.

A Content Security Policy header tells the browser which sources of scripts, styles, and other resources are legitimate. Configured correctly, it eliminates entire classes of XSS attacks. Here is how to build one for a Next.js application.

Storing passwords incorrectly is a critical vulnerability. This guide explains hashing, salting, the difference between bcrypt and Argon2, and how to implement secure password storage in a Node.js application.

Cross-site request forgery is widely misunderstood as a solved problem. SameSite cookies reduced the risk significantly, but CSRF still matters in specific configurations. This post explains when and how to protect against it.