Reporting UI Errors Without Blowing Up Prometheus
Piping frontend errors to a public backend endpoint is easy. Doing it without a metric-cardinality bomb or a log-injection hole takes a few deliberate choices.
Jo4 Blog
Insights on URL shortening, link management, and web development from the Jo4 team.
Alert on Brand-New Errors, Not Thresholds, with Redis
Count-threshold alerts never fire for the low-volume bug that hits one user. A first-seen detector using Redis SET NX EX alerts the moment a new error appears.
A Vulnerability Disclosure Policy for a Solo SaaS
Before any pen test or SOC 2 conversation, a product needs a way for researchers to report bugs. Here's the security.txt, PGP, and rotation setup we shipped.
Pacing Bulk Async Jobs Under an LLM Rate Limit
A bulk job fanned hundreds of async LLM calls onto a small pool at once and tripped the provider's rate limit. Retry helped; pacing the dispatch fixed it.
Versioned Content Fingerprints for Change Detection
How to tell if a web page actually changed — not just its markup — using a normalized, versioned hash. A small pattern that saves real work downstream.
Rate-Limit Failed Logins Without Locking Out Victims
The naive 'N failures and this account is locked' turns your brute-force defense into a denial-of-service tool. The fix is one decision: what you key on.
Closing the SSRF DNS-Rebinding Hole with a Custom Resolver
An up-front hostname check doesn't stop SSRF — the host re-resolves to an internal IP at connect time. Here's the TOCTOU fix that actually closes it.
OAuth client_credentials in Spring Boot for Prometheus Scrapes
How we added RFC 6749 §4.4 to our Spring Security stack so Prometheus could scrape /actuator/prometheus with a path-scoped CC bearer — and what schema relaxations were needed.
Bound Spring MVC's Async Executor or Pay for It Under Load
Spring MVC ships a default async task executor with no bounds and no queue. Wire a real one and emit the saturation gauge, or your tail-latency stack pages you at 2 AM.
How One Spring Boot Default Killed Our SSE Endpoint Under Load
spring.jpa.open-in-view=true is fine for request-response. For 30-minute Server-Sent Events, it pins a Hikari connection per browser tab. Pool exhausted at 11 subscribers.
Grafana as Code: Surviving Destroy-Recreate With Provisioning Files
Click-ops Grafana state lives in a sqlite file you'll lose. Here's the provisioning layout that survives droplet rebuilds — datasources, dashboards, alerts, Slack.
Watchtower Tried to Upgrade Itself. It Didn't Come Back.
Auto-updaters that update themselves are footguns. Here's how Watchtower froze our droplet for two days, and the two-layer pin that prevents a repeat.
Scrape Prometheus Over the VPC, Not Through Cloudflare
We routed our Prometheus scrape through Cloudflare's edge with a WAF rule + OAuth gate. Both droplets shared a DO VPC. Here's the simpler architecture we should have built first.
Why Your Grafana 5xx-Rate Alert Spams DatasourceNoData Every 4 Hours
A PromQL ratio that's 0/0 when traffic is quiet + humanizePercentage on nil + noDataState=NoData = repeating 4-hourly Slack noise. Here's the asymmetric fix.
Self-Healing Cloudflare CIDRs in DigitalOcean Firewalls
Hardcoded Cloudflare IP ranges in your DO firewall go stale every couple of years. Here's how to fetch them live in CI so drift is impossible.
Your Sentry DSN Is a GitHub Variable, Not a Secret
DSNs are public identifiers embedded in your client bundle. Storing them as GitHub Secrets is cargo-cult security. Here's what actually belongs in each.
Grafana 11 Provisions Alerts Before Dashboards — and That Breaks folderUid
Pin folderUid in your Grafana dashboard provisioning and the container exits 1 with 'folder already exists.' Here's the surprising ordering and the one-line fix.
Your sed -i Edit Isn't Reaching the Container: The Bind-Mount Inode Trap
You sed-i a file Docker bind-mounted into a container, the host file updates, the container keeps reading the old content. Here's why — and how to do it right.
Why pgrep Can't Detect cloud-init's Apt Races on DigitalOcean
Your apt-lock wait loop will lie to you. On DigitalOcean's Ubuntu 24.04 droplets, the contention isn't where you think — and pgrep only sees half of it.
How to Plug Claude Routines Into Your SaaS With MCP
We shipped an MCP server so Claude routines can shorten links, pull stats, and manage Jo4 accounts. Turns out it's mostly OAuth — here's the recipe that worked.
From Polling to SSE in RTK Query Without Breaking Reconnect Logic
Replacing 30s polling with SSE sounds easy. The hard part is reconnect, auth, RTK Query cache patching, and not blowing up on tab background.
Server-Sent Events Across Multiple Pods: Redis Pub/Sub + Spring WebFlux
Add a second app instance and your SSE stream only sees events from the pod the user is on. Here's the Redis pub/sub fan-out that fixes it.
We Were Hitting Auth0 /userinfo on Every Request. Here's the Fix.
Our backend hit Auth0's /userinfo as a fallback for missing JWT claims — thousands of external calls per day. The right fix was on the Auth0 side.
DigitalOcean Postgres Has a Firewall Trap. We Walked Right Into It.
Adding a single trusted-source rule to a previously-open DO managed Postgres flips the entire DB into enforcement mode. We learned this the hard way.
Why Your JPA Counter Column Keeps Resetting to Zero
Our denormalized click counters silently reset under load. The culprit was a one-line interaction between @Modifying @Query and @Version. Here's the fix.
Backups That You Don't Restore Aren't Backups: A Weekly Restore Drill
We back up Postgres nightly to DigitalOcean Spaces. Every Sunday a separate workflow restores the latest dump into a sandbox. Here's the pipeline.
How We Reset Monthly Quotas Without Race Conditions or Cron Drift
Stripe webhooks can't reset yearly subscribers. FREE users never trigger a payment at all. Here's the @Scheduled job that resets every account on the 1st.
Groq Returned Empty Content. The Bug Was Hiding in Reasoning Tokens.
Our LLM-backed URL safety classifier silently returned empty strings on hard pages. The token budget wasn't the problem we thought it was.
Redis Sliding Window Rate Limiting with Lua: The 15-Line Script That Saved Our AI Budget
How we built a per-user rate limiter for our Groq LLM endpoint using a Redis sorted set and a 15-line Lua script. Atomic, fast, and fail-open by design.
Adding Micrometer Metrics to Spring Boot Schedulers (Without Over-Engineering It)
How we added four metrics to a Spring Boot 3.4 scheduler in under an hour. No Prometheus operator, no Grafana dashboards, no YAML hell. Just counters and a timer.
How a 60-Day Sliding Window Flooded Our Slack with 500 Duplicate Alerts
Our dev.to crosspost script had two time windows that were supposed to align. A publishAfter bypass broke the invariant and turned every CI run into a Slack spam cannon.
Embedding Stats Widgets Without Breaking CSP: iframes, CORS, and Content Security Policy
Building an embeddable stats widget that works inside anyone's iframe without breaking their CSP or yours. Here's the full tutorial with code.
The Security Audit That Found 4 Issues in One Weekend
Spring Security's blanket headers were breaking embeds, leaking stack traces, and conflicting with custom CSP. Here's how I found and fixed all four issues in one weekend.
When Your SPA Eats Your API Routes: Fixing the Cloudflare Worker vs React Router Conflict
My affiliate tracking links were returning HTML instead of 302 redirects. The SPA was swallowing every URL. Here's how a Cloudflare Worker fixed it at the edge.
Testing Cloudflare Workers Without Cloudflare: A Vitest Setup That Actually Works
3,059 lines of Cloudflare Worker tests using Vitest and vi.stubGlobal, no miniflare required. Here's why lightweight unit tests catch the bugs that matter.
Why Auth0 E2E Tests Fail After Login: The localStorage Race Condition
14 lines fixed a maddening flaky test. Auth0 SPA SDK writes tokens to localStorage after handleRedirectCallback(), but Playwright snapshots state before the write completes.
Setting Up E2E Tests with Playwright + Auth0: The 5 Things That Took Longer Than the Tests Themselves
We deleted 10,000 lines of Terraform and added 1,637 lines of Playwright E2E tests. Here are the 5 things that took longer than writing the actual tests.
The Race Condition Between Bid Acceptance and Partnership Activation
A brand clicks 'Accept' on a bid, but the bid stays in SUBMITTED state. The root cause: notification failures were rolling back the entire transaction.
Why We Silently Drop Clicks for Paused Campaigns (Instead of Returning 404)
Two endpoints, two opposite behaviors for inactive campaigns — and both are correct. Here's why pixel tracking returns 200 while postbacks return 400.
Adding FTC Disclosure Gates to Our Affiliate Platform (And Why Server-Side Beats Client-Side)
235 lines of changes to add FTC disclosure acknowledgment as a server-side gate. Small diff, legally critical. Here's why a checkbox isn't enough.
State Machines for Bid Negotiations: Modeling Offers, Counters, and Rejections
How we modeled bid negotiations as a state machine with display priority, bid templates, and a security fix for a timing-attack oracle. 1,782 lines of tests.
Building an Affiliate Marketplace from Scratch: 14 Tables, 27 Services, Zero Money Movement
How we built a full affiliate marketplace with Stripe Connect integration where jo4 never holds or moves a single dollar. 14 database tables, 27 services, 81 test files.
From 30-Second Polling to Real Push Notifications
Our mobile app hammered the server every 30 seconds for notifications. We ripped it out and built direct FCM + APNs push. Here's every step.
I Made Claude Code Ding When It's Done (And It Changed My Workflow)
A 5-line config that plays a sound notification when Claude Code finishes a task or needs your input. Tiny hack, massive quality-of-life upgrade.
We Built a 2048 Clone, Then Taught It to Play Itself
How we built a tile-merging game with level-ups, marshmallow animations, and an AI autoplay that uses expectimax search with corner-lock strategy.
How to Generate Printable Calendar PDFs (Free, No Signup, Works Offline)
Need a custom printable calendar? Our free PDF generator has year, month, and weekly views with day filtering. No signup, no ads, works offline.
We Built a Referral Program Tool Inside Our URL Shortener. Here's Why.
Referral marketing tools start at $29/mo and don't include link tracking. We already had the link infrastructure. So we built Referral Kit.
RevenueCat Integration for Indie SaaS: The Apple Tax Nobody Prepares You For
You already have Stripe working perfectly. Then Apple says your mobile app needs IAP. Here's how I integrated RevenueCat with a Spring Boot backend without losing my mind.
Why Our Android Build Was Signed with the Wrong Key (A Regex Cautionary Tale)
Google Play rejected our AAB with a signing key mismatch. The culprit was a lazy regex quantifier in our release script that swapped debug and release signing configs.
CDN Cache Invalidation: Why Deleted URLs Still Redirect (And How We Fixed It)
You deleted the URL. Redis says it's gone. But users click it and still get redirected. The culprit: stale Cloudflare CDN cache that nobody told to purge.
How to Track Link Clicks with Meta Pixel for Facebook Retargeting
Fire Meta Pixel on every short link click without touching your destination site. Perfect for affiliate marketers and advertisers.
iOS App Store Screenshots and Compliance: The Gotchas After Your Build Succeeds
Your EAS build works. Now App Store Connect wants screenshots in exact dimensions, export compliance declarations, and privacy questionnaires. Here's what nobody told you.
One Push, Two App Stores: Parallel iOS and Android Builds with GitHub Actions
Our mobile CI/CD went from 'push to Play Store' to 'push to both stores simultaneously' with parallel EAS builds. Here's the workflow.
Why We Removed Ads from Our Free Tools (And Put Them Only on Blog Posts)
We added AdSense to every page. Conversions dropped. Here's why utility pages and ads don't mix, and where ads actually make sense.
The Auth0 Pricing Trap: Why Upgrading to Paid Gives You Less
Auth0's free tier includes 25,000 MAU. Their paid Essentials plan starts at 500 MAU. Yes, you read that right. Here's how to think about Auth0 pricing as a startup.
Publishing an Expo App to the App Store: The Parts Nobody Warns You About
EAS makes iOS builds easy, they said. Just run one command, they said. Here's the 4-hour rabbit hole I fell into with provisioning profiles, Sign in with Apple, and Services IDs.
Why We Killed Hold Windows in Our Affiliate Marketplace
We built a complex settlement system with hold windows, clawbacks, and carry-forwards. Then we deleted it all. Here's why simpler won.
The One-Character OAuth Bug That Broke Our API
Our OAuth scope parsing worked in tests but failed in production. A comma vs a space broke Pipedream. Here's the fix.
3 Auth Bugs We Shipped to Production (Spring + Auth0)
A 405 from bot scanners, a filter ordering misfire, and a race condition in user creation. All in one commit. Here's what went wrong.
The Idempotency Bug That Spammed dev.to's API for Weeks
Our dev.to sync tool republished unchanged articles daily. The root cause: comparing updatedAt against published_at instead of edited_at.
Why Safari Said 'Link Not Found' (And Chrome Didn't)
Our URL shortener showed 'Link Not Found' on Safari but worked fine on Chrome. The root cause: a browser-level JS execution difference.
I Built a URL Shortener Because Bitly Made Me Angry
A senior dev once told me: 'Every side project is born from spite.' He was right. Here's the story of building jo4.io.
Async vs Sync Audit Logging: When to Use Which
When to use synchronous vs asynchronous audit logging in your application. A practical guide with real examples from production.
AWS ElastiCache vs MemoryDB: Which One Do You Actually Need?
A practical decision guide for choosing between ElastiCache and MemoryDB. TL;DR: If your data is ephemeral, use ElastiCache.
How I Tamed Claude Code with Pre-Tool Hooks (And You Should Too)
Using PreToolUse hooks to block dangerous git commands and cd in Claude Code. Keep your AI assistant productive without losing control.
I Built an API-First URL Shortener You Can White-Label
How I built jo4.io - a developer-friendly URL shortener with full API access and white-label support. Why Bit.ly pricing made me do it.
Jo4 Is Now on Zapier: From Design Doc to Live in 5 Weeks
OAuth2 with PKCE, REST hooks, a spam filter disaster, and a near-closed ticket. The full story of building and shipping our Zapier integration.
Getting Started with Jo4: Your Modern URL Shortener
Learn how to use Jo4 for URL shortening, QR codes, and link analytics. A complete guide to managing your links effectively.
Referral Tracking for Indie Hackers: Skip the $300/mo Tools
Enterprise referral platforms want $300/mo minimum. Here's how I built invite link tracking for my SaaS using a URL shortener and $0 extra spend.
20 Free Developer Tools We Built (And Why We Gave Them Away)
We built 20 utility tools and made them completely free. No signup, no ads, no catch. Here's the full list and why we did it.
The Easiest Integration We've Ever Done: Two Markdown Files and a Domain Name Identity Crisis
ClawHub integration took 30 minutes. The hardest part? Keeping up with their domain name changes. From calwd to openclaw to clawhub - we've seen it all.
Getting Your App on Pipedream: No Dashboard, Just Humans (And That's Actually Great)
Pipedream doesn't have a developer dashboard. You email their team directly. Sounds scary? It's actually the fastest integration process we've experienced.
The 5 Edge Cases That Broke Our Dev.to Auto-Crossposting (And How We Fixed Them)
Auto-crossposting sounds simple until you deal with duplicates, stale dates, and race conditions. Here's how we made it bulletproof.
5 Hard Lessons from Implementing Zapier OAuth in Spring Boot
Three days to get a 'simple' OAuth integration working with Zapier. Here's what I learned about filter chains, race conditions, and PKCE.
How We Solved the Producer-Consumer Problem (For Blog Posts)
Writing blog posts is easy. Publishing them consistently is hard. Here's how we built a homebrewed CMS that handles the classic producer-consumer problem.
Caching API Responses at the Edge with Cloudflare Cache Rules
Your API is getting hammered. Same endpoints, same responses, thousands of requests. Here's how I used Cloudflare Cache Rules to serve API responses from the edge.
Why Your @Async Method Ignores @Transactional (And Leaks Internal Errors)
Production bug report: 'Why does the webhook error say Executing an update/delete query?' Here's how an innocent-looking @Async method broke everything.
Implementing Per-Seat Team Billing with Stripe
Adding team plans to a SaaS is tricky. You need per-seat pricing, plan upgrades/downgrades, webhook handling, and graceful degradation when payments fail.
Why Auth0 email_verified Was Missing from My Access Token
Spent an hour debugging why verified users were getting blocked. The culprit? Auth0 doesn't include email_verified in access tokens by default.
Cloudflare Bot Fight Mode Breaks Zapier OAuth (And How to Fix It)
After solving all the code issues with Zapier OAuth, I hit one more wall: Cloudflare's Bot Fight Mode. Here's the fix.