Isolation Levels Across Databases: Why the Labels Mislead
The transaction setting you trust might describe very different behavior depending on the engine underneath it.
Alex Fadeev
Follow my Substack blog where I write about software engineering, system architecture, infrastructure, and building things that scale 📝
Live Last read · last published · next check
Latest episodes
Choosing Between Agent Tooling Layers in 2026
Why strong AI agent systems mix command-line execution, schema-based integrations, and a better interface layer on top
Natural Language as an Execution Vector
What the 2026 agent-framework RCE wave taught us about trust, tooling, and the real security boundary in AI systems
Keep Transactions Fast, Not Fragile
Why external API calls and database locks should never share the same critical section in 2026
Hardening OAuth Flows Against Configuration Errors in 2026
How to review `redirect_uri`, enforce PKCE and `state`, and detect suspicious callback and token behavior before an implementation gap becomes account takeover.
A Browser-Based VSCode Token Theft Chain
How a webview input-handling flaw turned a single click into GitHub token exposure in 2026
When AI Agents Share Too Much Power
Two database deletion incidents, nine months apart, show the same infrastructure flaw hiding behind different tools
Choosing Less Infrastructure: A Small Team’s Case Against Early Kubernetes
Why a powerful platform can slow product delivery when your team is still small, your scale is modest, and your real bottleneck is engineering time.
When AI Agents Start Acting, Prompt Injection Stops Being a Small Bug
Why tool-using systems turn one malicious instruction into a cross-system security incident in 2026
Rechecking SQL Isolation Behavior Across MySQL and MariaDB
Using an automated transaction runner to revisit old concurrency results and expose where modern engines now diverge
Understanding PostgreSQL Table Locks Before a Migration Bites You
Subtitle: A practical guide to PostgreSQL’s eight table-level lock modes, the DDL statements that trigger them, and what those locks really stop in production.
Making High-Ingest Search Work on Postgres Replicas
How a write-optimized index design improved ingest speed, exposed a replication flaw, and led to a safer approach for standby nodes in 2026.
When AI Coding Help Backfires on Veteran Maintainers
What a controlled study of experienced open-source developers suggests about real-world productivity, benchmark hype, and why “helpful” tools can still make people slower in 2026.
Production GitOps Without the Demo-Only Traps
A practical guide to scalable GitOps architecture, release flows, multi-cluster design, security, and adoption risks for platform teams
Practical Transaction Isolation in Relational Databases
How locks, snapshots, and InnoDB isolation rules shape concurrent reads and writes
Prompt Injection in 2026: What Last Year’s Attack Data Means for AI Apps
A developer-focused look at how prompt injection moved from edge case to production security risk
Practical Observability for Modern Software Teams in 2026
A developer-focused guide to telemetry, debugging workflows, and resilient distributed systems
Why Your Delivery Pipeline Feels Slow
Common CI/CD design mistakes that quietly erode speed, reliability, and release confidence in 2026
When Vector Search Breaks in Production
What actually goes wrong in ANN-backed retrieval systems, and which signals tell you trouble is already underway
Read-Only Transactions Can Still Break Serial Logic
Why PostgreSQL serialization errors are not just for writes