Engineering notes
from the field.

A point lookup and a range scan against the same table have opposite indexing requirements. Building one table to serve both shapes optimises for neither — the fix is splitting the write model from the read model.

The migration worked perfectly in local Docker. On RDS, it failed with a missing extension error. After removing that line, it failed again — this time trying to drop an index that had never been created.

The application health check was green. Alembic was silently failing. Two drivers, one protocol, two different parameter names for the same setting — and a bug that passes every test until your first production deploy.

If your login endpoint takes measurably different amounts of time to respond to "email not found" vs "wrong password," an attacker can enumerate every valid email on your platform without ever seeing an error message.

The default on: push trigger fires CI and deploy simultaneously. If your tests take four minutes and your deploy takes two, broken code reaches production before the first test result comes in.

The layered structure every FastAPI tutorial teaches looks clean in a screenshot. It falls apart the first time you add soft deletes and have to touch five directories for one logical change.