# DERKONLINE

> An AI-native studio that takes a business from a napkin idea to a secured, deployed, monitored product. Founder: Derrick S. K. Siawor, Senior Platform Engineer & Solutions Architect. Based in Accra, Ghana; GMT · full EU overlap, large US overlap. One team designs, builds, deploys, secures, and runs software end to end.

## Services
- [Websites](https://derkonline.com/services/websites): A site that loads before they blink, and turns the visit into a customer.
- [Web apps](https://derkonline.com/services/web-apps): The software your business runs on, shipped end to end.
- [Mobile apps](https://derkonline.com/services/mobile-apps): Your app on both stores, with the push and offline that bring people back.
- [Server administration](https://derkonline.com/services/server-administration): Your infrastructure runs, scales, and recovers on its own while you sleep.
- [Email deliverability](https://derkonline.com/services/email-deliverability): Your email lands in the inbox, not the spam folder. Every time.
- [Email accounts](https://derkonline.com/services/email-accounts): Your own mail, on your own domain, on a server you control. Moved without losing a message.
- [Networking](https://derkonline.com/services/networking): The plumbing under everything, laid by a CCNA-certified network engineer.
- [Security audits](https://derkonline.com/services/security-audits): Find what an attacker would find. Before they do.
- [Consultation](https://derkonline.com/services/consultation): Senior judgment on the hardest technical decision in the room.

## Products
- [LadenX](https://derkonline.com/work/ladenx) — AI site-reliability engineer: Your server goes down at 3am. By the time you wake up, it has already found the cause, fixed it, and left you the receipt.
- [Mythic Intel](https://derkonline.com/work/mythic-intel) — AI interview trainer: Walk in having already answered the exact questions your panel will ask, out loud, until every one of them is yours.
- [OneScribe](https://derkonline.com/work/onescribe) — Meeting intelligence: Your meetings remember themselves: the decisions, the owners, and the next steps are waiting for you when you leave the call.
- [CeyMail](https://derkonline.com/work/ceymail) — Self-hosted mail platform: Run your own mail server from one dashboard, with AI screening the spam and the deliverability quietly handled for you.
- [LuxTherapy](https://derkonline.com/work/luxtherapy) — AI mental wellness: Someone to talk to at 2am, by voice or text, with no waitlist and no judgement, there every time the night runs long.
- [CaveCMS](https://derkonline.com/work/cavecms) — AI-native CMS: Beautiful, hand-coded-quality sites that the client, or their own AI assistant, can edit right on the page in plain words.
- [SmokeLeads](https://derkonline.com/work/smokeleads) — Sales prospecting: An empty pipeline becomes a call list of the right businesses, each with the owner's name and the script that lands.

## Client work
- [The RevPARtner](https://derkonline.com/work/revpartner) — Hotel revenue consulting: The rooms a hotel already has, earning more, from the rate, the channels, and the mix left on the table.
- [Anaarkutu Real Estate](https://derkonline.com/work/anaarkutu) — Luxury real estate: A luxury property agency that finally looks the part online, as quiet and premium as the homes it sells.
- [No1 Oxford Street](https://derkonline.com/work/oxford-street) — Luxury hospitality: Ghana's number-one landmark, its 108 suites and restaurant presented as the destination worth flying in for.
- [Kwarleyz Residence](https://derkonline.com/work/kwarleyz) — Luxury hospitality: Accra's luxury serviced living, shown so the stay feels inevitable long before the booking is made.
- [Privé Property Management](https://derkonline.com/work/prive) — Property management: High-end property management, presented with the polish its owners and tenants quietly expect.
- [Ghana Free Zones Authority](https://derkonline.com/work/ghana-free-zones) — Government: The digital front door for businesses entering Ghana through its free zones, clear enough to start an application.
- [Twist Night Club](https://derkonline.com/work/twist) — Nightlife: Accra's most luxurious club, with the night sold and the VIP table booked before anyone walks in.
- [A&A GenPro](https://derkonline.com/work/aagenpro) — Home services: Houston homeowners choose, buy, and book the install of a whole-home generator before the next outage hits.
- [Summit Developments](https://derkonline.com/work/summit-developments) — Property development: A property developer's portfolio, built to turn a browse into the next serious project inquiry.

## Journal
Technical field notes from production (150 articles), grouped by topic:

### Web Performance
- [Cut Your INP Below 200ms Before It Tanks Rankings](https://derkonline.com/blog/fix-inp-replace-fid-core-web-vitals): A field-data playbook for diagnosing and fixing Interaction to Next Paint, the metric that replaced FID and now decides your Core Web Vitals pass.
- [Stop Render-Blocking Resources From Stealing Your First Paint](https://derkonline.com/blog/kill-render-blocking-resources-critical-css): Inline critical CSS, defer the rest, and load fonts without flashing so above-the-fold content paints in one round trip.
- [Shrink Your Next.js Bundle With Server Components](https://derkonline.com/blog/nextjs-server-components-bundle-size): How React Server Components and the right client boundaries strip megabytes of JavaScript off the wire.
- [Make Your LCP Image Load First Every Single Time](https://derkonline.com/blog/lcp-image-optimization-priority-hints): Priority hints, fetchpriority, responsive AVIF, and preload tuning that drag your hero image's load under the 2.5 second LCP line.
- [Break Up Long Tasks So Your Main Thread Stays Responsive](https://derkonline.com/blog/javascript-long-tasks-main-thread-scheduling): Use scheduler.yield and web workers to chop blocking work into chunks so the main thread answers every tap instantly.
- [Why Your Lighthouse Score Lies and Field Data Tells the Truth](https://derkonline.com/blog/real-user-monitoring-vs-lab-data): Lighthouse runs in a lab and cannot measure INP at all. Wire up the web-vitals library to optimize what real visitors actually feel.
- [Drive Cumulative Layout Shift to Zero on Dynamic Pages](https://derkonline.com/blog/cls-layout-shift-zero-reserved-space): Pages jump because content arrives into space nobody reserved. Image dimensions, aspect-ratio, sized skeletons drive CLS to zero.
- [Move to HTTP/3 and QUIC to Kill Head of Line Blocking](https://derkonline.com/blog/http3-quic-connection-performance): QUIC kills head-of-line blocking, halves the handshake, and survives a phone switching networks. The biggest wins land on the worst connections.
- [Slash Time to First Byte With Streaming Server Rendering](https://derkonline.com/blog/ttfb-server-response-time-streaming-ssr): Stream HTML early, defer slow data, and tune your backend so the browser starts working before your server finishes.
- [Tame the Third-Party Scripts Wrecking Your Page Speed](https://derkonline.com/blog/third-party-scripts-performance-budget): Audit, sandbox, and lazy-load analytics, chat widgets, and tag managers so other people's code stops blowing your speed budget.
- [Build an Image Pipeline That Serves the Perfect Byte Count](https://derkonline.com/blog/image-cdn-responsive-formats-pipeline): Automate AVIF/WebP fallback, srcset sizing, lazy loading, and layout reservation so every device gets the smallest sharp image.
- [Make Page Navigations Feel Instant With Speculation Rules](https://derkonline.com/blog/prefetch-speculation-rules-instant-navigation): Prerender and prefetch the next likely page with Speculation Rules so clicks resolve in milliseconds without wasting bandwidth.
- [Find the Memory Leaks Making Your SPA Slower by the Hour](https://derkonline.com/blog/memory-leaks-spa-performance-degradation): Detached nodes, orphaned listeners, and growing caches bloat long sessions; heap snapshots expose and fix them.
- [Make Slow Feel Fast With Optimistic UI and Smart Skeletons](https://derkonline.com/blog/perceived-performance-optimistic-ui-skeletons): Skeletons, optimistic UI, and streaming make a product feel twice as fast on the same backend, if you build the rollback as carefully as the happy path.
- [What Every Slow Second Actually Costs You in Revenue](https://derkonline.com/blog/page-speed-conversion-revenue-impact): Tie Core Web Vitals to bounce and conversion so performance work earns its place on the roadmap as a revenue calculation.
- [Set a Performance Budget Your Team Will Not Quietly Break](https://derkonline.com/blog/performance-budgets-team-culture-shipping): Turn speed from a one-off cleanup into a shipping discipline that survives every new feature and hire, set from the top.

### Web Apps
- [Hunt Down the N Plus One Queries Quietly Slowing Your API](https://derkonline.com/blog/database-query-latency-n-plus-one): Trace, index, and batch the database calls behind your p95 latency so every request returns before the user notices.
- [Make pnpm dev Bring Up Your Whole Stack in One Command](https://derkonline.com/blog/one-command-dev-bootstrap-docker-deps): Wire a predev hook so pnpm dev brings up Docker, runs migrations, and checks env automatically with no manual prerequisites.
- [Stop Exhausting MySQL Connections in Next.js Dev Reloads](https://derkonline.com/blog/globalthis-db-pool-hot-reload-connections): Hot reload re-creates module-scoped pools until MySQL caps out; stash the pool on globalThis so reloads reuse one set.
- [Kill Startup Races With docker compose up --wait and Healthchecks](https://derkonline.com/blog/docker-compose-wait-healthy-service-races): Define real healthchecks and wait on them with up --wait so your app never boots before MySQL and Redis can answer.
- [Scale Realtime WebSockets Without Drowning in Backpressure](https://derkonline.com/blog/websocket-realtime-scale-backpressure): Connection limits, batched fan-out, backpressure, and jittered reconnection keep live updates smooth from ten to ten thousand users.
- [How to Hunt Down N Plus One Queries Before They Melt Production](https://derkonline.com/blog/kill-n-plus-one-queries-production): Find and fix the silent query fan-out that runs fine at ten rows and melts at five hundred, with eager loading and keyset pagination.
- [Next.js Server Components Without the Waterfall Tax](https://derkonline.com/blog/nextjs-server-components-data-fetching): Structure data fetching so server components stream and parallelize instead of stacking sequential round trips the user feels as lag.
- [Fix Next.js 15 Pages That Render Unstyled Only in Safari](https://derkonline.com/blog/next-15-turbopack-tailwind-safari-unstyled): A Turbopack and Tailwind v4 dev-bundler bug drops your CSS in Safari; default dev to webpack and WebKit renders correctly again.

### Security
- [Lock Out Credential Stuffers With Progressive Rate Limiting](https://derkonline.com/blog/progressive-lockout-rate-limiting-auth): Per-IP and per-email sliding windows plus escalating lockouts that stop credential stuffing without punishing real users.
- [Prevent User Enumeration in Your Login and Reset Flows](https://derkonline.com/blog/prevent-user-enumeration-login-flows): Identical messages, constant-time responses, and honeypots that stop attackers from harvesting valid accounts one request at a time.
- [Stop Leaking Your Admin Login URL in Redirects and Errors](https://derkonline.com/blog/stop-leaking-admin-login-urls): Why redirecting unauthenticated admin traffic to your login page hands attackers the map, and how to return a clean 404 instead.
- [Issue JWTs Attackers Cannot Forge or Replay](https://derkonline.com/blog/jwt-claims-that-cannot-be-forged): Lock the algorithm to HS256, verify issuer and audience, and cap expiry so a leaked token dies before it does damage.
- [Build CSRF Protection That Survives OAuth Callbacks](https://derkonline.com/blog/csrf-tokens-that-actually-hold): HMAC-signed CSRF tokens plus the SameSite settings that block forged requests without breaking your Slack or Stripe login.
- [Kill SQL Injection With Parameterized Queries and Allowlists](https://derkonline.com/blog/kill-sql-injection-defense-in-depth): Why prepared statements alone are not enough, and how table allowlists plus column regex give you layered protection.
- [Hash Passwords With Scrypt and Timing-Safe Comparison](https://derkonline.com/blog/scrypt-password-hashing-timing-safe): The memory-hard scrypt setup and constant-time comparison that keep a stolen user database from becoming an overnight breach.
- [The Security Headers Every Next.js App Should Ship](https://derkonline.com/blog/security-headers-every-nextjs-app-needs): From CSP and HSTS to killing the X-Powered-By tell, the exact header set that hardens a production Next.js deploy in one config file.
- [Verify Payment Webhooks Before They Move Money](https://derkonline.com/blog/verify-paystack-stripe-webhooks): Signature checks, amount matching, and idempotency guards that stop forged Paystack and Stripe events from charging users twice.
- [Rotate Production Secrets Without Taking the App Down](https://derkonline.com/blog/rotate-secrets-without-downtime): A dual-key rollover keyed on kid lets you swap JWT, CSRF, and webhook secrets while every active session keeps working.
- [Accept File Uploads Without Opening a Remote Code Hole](https://derkonline.com/blog/secure-file-uploads-without-rce): A profile-picture field is a door to your filesystem. Validate magic bytes, re-encode, store outside the web root, and rename every file.
- [Pin Third-Party Scripts With Subresource Integrity](https://derkonline.com/blog/subresource-integrity-third-party-scripts): The Polyfill.io attack hit 380,000 sites because nobody pinned the script. SRI plus CSP makes that class of supply-chain breach a non-event.
- [Scope API Tokens So a Leak Cannot Touch Everything](https://derkonline.com/blog/scope-api-tokens-least-privilege): A token will leak. Scope it by resource and action, one per consumer, rotate and revoke, so a leak costs a shrug not your business.
- [Build Audit Logs That Actually Help After a Breach](https://derkonline.com/blog/audit-logs-that-survive-an-incident): Record every privileged action, make logs append-only and tamper-evident, forward them off-host, and keep them queryable when minutes matter.
- [Mask PII in Public API Responses by Default](https://derkonline.com/blog/mask-pii-in-public-api-responses): The API response is the exposure surface, not the rendered page. Mask email, phone, and references at serialization; gate full data to admins.
- [What Skipping Security Early Really Costs a Startup](https://derkonline.com/blog/cost-of-skipping-security-early): Deferring security does not save the cost, it multiplies it and moves the bill to a breach. The basics built in are the cheapest insurance.
- [Lock Down CORS Before It Hands Over Your Session Tokens](https://derkonline.com/blog/lock-down-cors-against-token-theft): The wildcard and reflected-origin mistakes that let any site read your authenticated API, and the strict allow-list that closes them.
- [Stop Brute Force and POST Floods With Nginx Rate Limit Zones](https://derkonline.com/blog/nginx-rate-limiting-zones-burst-control): Layer connection limits and POST burst zones at the edge so abusive traffic dies in nginx before it ever touches your app.
- [Why One Leaked Secret Should Never Compromise the Rest](https://derkonline.com/blog/production-secrets-separation-per-concern): Split JWT, CSRF, and cron secrets per concern, load every one from env, and throw on missing so one leak stays contained.
- [What A Small Team Needs Before Its First Security Incident](https://derkonline.com/blog/security-incident-readiness-small-team): The minimum response plan, roles, logging, and tested backups that turn a breach from an existential event into a contained Tuesday.
- [Why OAuth Login Breaks With SameSite Strict, and the Fix](https://derkonline.com/blog/csrf-samesite-oauth-callback-bug): SameSite Strict silently signs users out mid-OAuth; the Lax plus CSRF-token combo keeps logins working and safe.
- [Lock Down Service Traffic With Self-Rotating mTLS](https://derkonline.com/blog/mtls-service-to-service-auth): Give every internal call a verifiable identity with mTLS and self-rotating short-lived certs, so a leaked credential expires before it can be used.
- [Stop Shipping API Keys in Your Frontend Bundle](https://derkonline.com/blog/stop-leaking-secrets-in-frontend-bundles): How secrets sneak into client JavaScript through public env prefixes, and the build-gate audit that catches them before deploy.

### Email Deliverability
- [Make Logins Feel Instant by Sending Email in the Background](https://derkonline.com/blog/background-email-sends-never-block-requests): Never await SMTP in a request handler; fire transactional email after you respond so users get their code without the hang.
- [Run Side Effects in the Background So Logins Stay Fast](https://derkonline.com/blog/background-jobs-never-block-response): Stop awaiting slow SMTP and webhook calls in request handlers and return the response the instant the user actually needs it.
- [Set Up SPF, DKIM, and DMARC So Your Mail Stops Hitting Spam](https://derkonline.com/blog/spf-dkim-dmarc-setup-that-actually-passes): The DNS records, alignment rules, and report-reading that move a cold domain from spam to the primary inbox under Gmail and Yahoo's rules.
- [Move DMARC From None to Reject Without Killing Legitimate Email](https://derkonline.com/blog/dmarc-reject-rollout-without-blocking-real-mail): A staged none to reject rollout that reads aggregate reports and catches every unaligned sender before you enforce.
- [Read Your DMARC Reports and Find Who Is Spoofing Your Domain](https://derkonline.com/blog/read-dmarc-aggregate-rua-reports): Your DMARC reports already name everyone spoofing your domain. Parse the RUA XML into a sender map and walk the policy to enforcement.
- [Warm a Brand New Sending Domain to Full Volume in Six Weeks](https://derkonline.com/blog/domain-warmup-schedule-cold-to-inbox): A cold domain sending at volume looks like a spammer. Warm it over six weeks, gated on engagement, with authentication right from message one.
- [Dedicated or Shared IP: Choose Before You Send](https://derkonline.com/blog/dedicated-vs-shared-ip-sending-decision): Dedicated is not automatically better. Below six figures a month a vetted shared pool lands better mail than a cold IP you cannot keep warm.
- [Get Out of the Gmail Spam Folder and Stay Out](https://derkonline.com/blog/fix-gmail-spam-folder-placement): How Gmail scores senders by spam rate and engagement in 2025, and the concrete fixes that recover inbox placement.
- [Meet Google and Yahoo Bulk Sender Rules Without Getting Throttled](https://derkonline.com/blog/google-yahoo-bulk-sender-requirements-compliance): The 2024 sender mandate decoded: one-click unsubscribe, the 0.3% spam ceiling, and SPF, DKIM, and DMARC you must ship now.
- [Drive Your Spam Complaint Rate Under the 0.3 Percent Line](https://derkonline.com/blog/lower-spam-complaint-rate-below-threshold): Consent, cadence, one-click unsubscribe, and list hygiene pull complaint rates under the 0.3% line that gets you blocked.
- [Get Your IP Off Spamhaus and Other Blocklists Fast](https://derkonline.com/blog/diagnose-ip-blocklist-delisting-fast): Confirm the listing, identify the list and root cause, fix it, then submit a Spamhaus delisting request that actually sticks.
- [Put Your Verified Logo Next to Every Email With BIMI](https://derkonline.com/blog/bimi-vmc-brand-logo-inbox): The DMARC enforcement, SVG-P/S logo, and VMC certificate that earn a verified brand logo and checkmark in the inbox.
- [Run a Self-Hosted Mail Server That Lands in the Inbox](https://derkonline.com/blog/self-hosted-postfix-dovecot-deliverability-stack): Configure Postfix, Dovecot, rDNS, DKIM alignment, and TLS so a mail server you own competes with the big platforms on inbox placement.
- [Stop Bounces From Wrecking Your Sender Reputation](https://derkonline.com/blog/list-hygiene-bounce-handling-suppression): Classify hard and soft bounces, automate suppression, and verify addresses so dirty list signals never wreck your sender reputation.
- [Split Transactional and Marketing Mail by Subdomain](https://derkonline.com/blog/subdomain-strategy-transactional-vs-marketing): A subdomain and reputation architecture that protects password resets when a marketing blast gets flagged.

### Infrastructure
- [Harden SSH Without Locking Yourself Out of Production](https://derkonline.com/blog/harden-ssh-against-fail2ban-lockouts): Key-only auth, Fail2ban tuning, and an access protocol that stops one wrong login from banning your own deploy box.
- [How to Ship Next.js Updates With Zero Downtime Using PM2](https://derkonline.com/blog/zero-downtime-pm2-deploys-nextjs): Build to a fresh release, health-check it, then reload PM2 worker by worker so users never see a 502 on deploy.
- [Why Your Dev Site Breaks in Safari but Not Chrome on Localhost](https://derkonline.com/blog/localhost-https-hsts-safari-broken-dev): HSTS and upgrade-insecure-requests get honored on loopback by Safari alone; gate them to production and clear the pinned cache.
- [Why Safari Gets 520 Errors When Chrome Works on Your Nginx Server](https://derkonline.com/blog/nginx-1-18-safari-520-large-cookies): Large auth cookies plus nginx HTTP/2 field-size defaults silently reset Safari streams; here is the two-line fix.
- [Run Your Own Signed Release Channel for Self-Hosted App Updates](https://derkonline.com/blog/signed-self-hosted-release-channel-auto-updates): Build, Ed25519-sign, and publish update zips so self-hosted customers pull verified releases no attacker can forge.
- [Build a Deploy That Rolls Back When Health Checks Fail](https://derkonline.com/blog/self-healing-deploys-auto-rollback-health-checks): Capture the good commit, curl the health endpoint with retries, and restore the last working build automatically when a deploy goes bad.
- [The PM2 Multi-Daemon Trap That Breaks Your Next Deploy](https://derkonline.com/blog/pm2-multi-daemon-trap-process-ownership): Start an app under the wrong user and your deploy can never restart it; here is how PM2_HOME ownership actually works.
- [Turn Noisy Server Logs Into Alerts You Actually Trust](https://derkonline.com/blog/structured-logging-actionable-server-alerts): Read the error body, not the alert headline. JSON logs and tuned, specific alerts cut the noise so one investigation finds the root cause.
- [Never Fix Production by Hand: Scripts Are the Truth](https://derkonline.com/blog/scripts-as-source-of-truth-no-manual-prod): Every 11pm manual fix is a time bomb of config drift. Encode fixes in deploy scripts so any server rebuilds from zero, identically.
- [How One Wrong SSH User Locks Your Whole Server Out](https://derkonline.com/blog/fail2ban-ssh-lockout-prevention-key-discipline): Fail2ban bans your IP after a few bad SSH attempts with no programmatic undo. Verify credentials once, never retry blindly, whitelist your IPs.
- [Self-Hosting vs Managed Cloud: The True Cost Founders Miss](https://derkonline.com/blog/self-host-vs-managed-cloud-true-cost): A clear-eyed model of when running your own servers wins on margin and control, and when managed infrastructure is the cheaper bet.
- [Give Autonomous Fixes Guardrails Before They Touch Production](https://derkonline.com/blog/self-healing-infrastructure-guardrails): Approval gates, dry-runs, and blast-radius limits that let an AI act on your servers without turning automation into the outage.
- [Hand Your Deploy Pipeline to an Agent and Still Sleep at Night](https://derkonline.com/blog/automating-deployment-pipeline-with-agents): Wrap build, health-check, and auto-rollback so an agent ships safely, with destructive actions gated behind human approval.
- [How Reliability Becomes A Competitive Moat Nobody Can Copy](https://derkonline.com/blog/reliability-as-competitive-moat): Customers leave over outages, not features; turning uptime into a kept promise wins the deals price and features cannot.
- [How AI Site Reliability Cuts Your On Call Burden To Near Zero](https://derkonline.com/blog/autonomous-ops-replace-on-call): What an autonomous SRE catches and fixes automatically, and which incidents still need a human at three in the morning.
- [Roll Out Risky Features Behind Flags You Can Kill in One Click](https://derkonline.com/blog/feature-flags-safe-progressive-rollout): Progressive delivery with targeting, one-click kill switches, and cleanup discipline so a bad release never becomes a midnight rollback.
- [Instrument Your App to Find Root Cause in Minutes](https://derkonline.com/blog/observability-traces-logs-find-root-cause): Structured logs, distributed traces, and correlation IDs that turn a vague outage report into an exact line of code in minutes.
- [The Safari Only 520 Error That Large Auth Cookies Quietly Cause](https://derkonline.com/blog/nginx-cloudflare-520-safari-cookies): How Safari-coalesced cookies overflow nginx HPACK limits behind Cloudflare, and the two-line server block that ends the 520 mystery.

### AI & Automation
- [Make Agent Tool Calls Idempotent Before a Double Charge](https://derkonline.com/blog/agent-tool-calling-retry-idempotency): Design retries, idempotency keys, and side-effect guards so a retrying AI agent never fires the same action twice.
- [Teach an AI SRE to Diagnose Root Cause, Not Restart](https://derkonline.com/blog/ai-sre-autonomous-incident-diagnosis): Why naive auto-restart loops mask incidents and how to build an agent that finds and fixes the actual failing layer.
- [Force LLM Output Into Schemas Your Code Can Actually Trust](https://derkonline.com/blog/llm-output-validation-structured-schemas): Use strict structured outputs, schema-first design, and a validation layer so a model can never silently break the code that acts on its answers.
- [Defend Tool-Using Agents Against Prompt Injection](https://derkonline.com/blog/prompt-injection-defense-tool-agents): Dual-LLM isolation, tool allowlisting, and human sign-off that keep a poisoned web page from hijacking a tool-using agent.
- [Fix the Retrieval Layer That Is Quietly Wrecking Your RAG Answers](https://derkonline.com/blog/rag-retrieval-quality-eval-loop): Measure recall, chunking, and reranking so you stop blaming the model for the bad context your retrieval layer handed it.
- [Orchestrate Multiple Agents Without Losing Control of the Flow](https://derkonline.com/blog/multi-agent-orchestration-handoff-patterns): Supervisor, handoff, and shared-state patterns plus inspectable state and gated destructive actions keep multi-agent systems debuggable.
- [Cut Your LLM Bill in Half Without Touching Answer Quality](https://derkonline.com/blog/llm-cost-control-token-budgeting): Caching, model routing, thinking-budget tuning, and token discipline cut LLM bills 60 to 80 percent without changing a single answer.
- [See Exactly What Your Agent Did When It Goes Off the Rails](https://derkonline.com/blog/agent-observability-tracing-spans): Trace every tool call, prompt, and decision with OpenTelemetry so you can replay and root-cause an agent failure in minutes, not an afternoon.
- [Build an Eval Harness That Catches LLM Regressions](https://derkonline.com/blog/llm-evaluation-harness-before-shipping): Golden datasets, LLM-as-judge scoring, and cheap deterministic gates that prove a prompt change actually improved things.
- [Stop Your Agent From Forgetting What It Was Doing](https://derkonline.com/blog/agent-memory-context-window-management): Observation masking, summarization, and context curation that keep long-running agents coherent instead of forgetting the task.
- [Stream LLM Responses That Never Cut Off Mid-Sentence](https://derkonline.com/blog/streaming-llm-responses-without-cutoffs): Token-budget headroom, thinking-config, finish-reason checks, and backpressure keep streamed AI answers complete and fast.
- [When Fine-Tuning Beats Prompting and When It Burns Money](https://derkonline.com/blog/fine-tuning-vs-prompting-decision): Prompt first, retrieve for knowledge, fine-tune for behavior: a practical framework that avoids burning money on the wrong tool.
- [Train a Small Local Classifier That Beats a Frontier Model](https://derkonline.com/blog/local-model-classifier-on-your-own-data): A focused on-prem model can match or beat a frontier API on narrow classification, with the data and tooling to get there.
- [Decide What AI to Build and What to Buy Before You Waste](https://derkonline.com/blog/build-vs-buy-ai-automation-founders): A founder's framework for spending engineering time on the AI that is your moat, not commodity plumbing you can rent.
- [Ship an MCP Server That Survives Real Agent Traffic](https://derkonline.com/blog/mcp-server-production-checklist): The OAuth 2.1 audience validation, tool-schema, and rate-limit decisions that separate a demo MCP server from one you trust with real agent traffic.
- [Price Your AI Feature So Token Costs Never Eat Your Margin](https://derkonline.com/blog/pricing-ai-features-usage-based): Usage, seat, and hybrid pricing models plus product-side cost controls that keep an AI feature profitable as token costs swing.

### Networking
- [Push Your CDN Cache Hit Ratio Past 95 Percent](https://derkonline.com/blog/edge-caching-cdn-cache-hit-ratio): Stale-while-revalidate, surrogate keys, and origin-shield patterns that keep traffic off your servers and pages near instant.
- [Serve Unlimited Subdomains From One Cloudflare Origin Certificate](https://derkonline.com/blog/cloudflare-origin-certs-multi-subdomain-nginx): Use a wildcard SAN origin cert behind Cloudflare so every new subdomain goes live without minting or renewing a certificate.
- [How Anycast DNS Cuts Resolver Latency Without Adding Servers](https://derkonline.com/blog/anycast-dns-resolver-latency-tuning): Why one IP answered from dozens of cities beats regional nameservers, and how to verify with dig and NSID that it routes close.
- [TLS 1.3 Zero Round Trip Resumption and the Replay Risk It Hides](https://derkonline.com/blog/tls-13-handshake-zero-rtt-tradeoffs): 0-RTT shaves a round trip off reconnects, but ship it wrong and you invite replayed POSTs; here is exactly where the line is.
- [Why Your Site Returns 520 in Safari but Works in Chrome](https://derkonline.com/blog/cloudflare-520-large-cookie-safari): Safari coalesces cookies into one HPACK field that trips nginx 1.18 limits, so Cloudflare returns an untraceable 520. Two lines fix it.
- [Set DNS TTLs So Failover Is Instant Without Hammering Resolvers](https://derkonline.com/blog/dns-ttl-strategy-for-fast-failover): Short TTLs reroute traffic in seconds but multiply query load. Set TTL per record by volatility, and lower it before any planned cutover.
- [Expose an Internal App Publicly Without Opening a Single Port](https://derkonline.com/blog/cloudflare-tunnel-no-open-ports): Cloudflare Tunnel reaches out from your server instead of letting the world reach in, so your origin IP and firewall stay invisible.
- [Route Every User to Their Nearest Region With Latency Based DNS](https://derkonline.com/blog/geodns-latency-routing-global-users): Serve the closest healthy origin automatically so a user in Accra and one in Frankfurt both get a fast first byte.

### Mobile
- [Build Gesture-Driven Mobile Animations That Run at Sixty FPS](https://derkonline.com/blog/gesture-driven-mobile-animations-reanimated): Drive swipes, drags, and shared transitions on the UI thread with Reanimated and Gesture Handler so nothing stutters under load.
- [Build a PWA That Feels Native on iOS Despite Safari's Limits](https://derkonline.com/blog/pwa-that-feels-native-on-ios): Work around Safari's push, storage-eviction, and standalone-mode rules to ship an installable web app iPhone users actually keep.
- [Design Offline-First Mobile Sync That Survives Bad Networks](https://derkonline.com/blog/offline-first-mobile-sync-conflicts): Queued mutations, idempotency, and last-write-wins versus CRDTs so your app keeps working in a tunnel and reconciles cleanly later.
- [Stop Losing Taps to Bad Thumb Zones and Tiny Targets](https://derkonline.com/blog/mobile-touch-targets-thumb-zones): The reach-map, target-size, and bottom-anchor rules that turn a fiddly mobile UI into one people navigate one-handed without thinking.
- [Ship React Native Updates the Same Day You Write Them](https://derkonline.com/blog/expo-eas-build-deploy-pipeline): EAS Update ships JS fixes over the air in minutes while runtime versions keep native changes store-compliant. A same-day mobile pipeline.
- [Send Mobile Push Notifications People Open Instead of Mute](https://derkonline.com/blog/push-notifications-people-dont-mute): iOS gives you one permission prompt. A soft ask at first value nearly doubles opt-in, then segment and respect quiet hours to keep it.
- [Make Deep Links and Attribution Survive the App Store Round Trip](https://derkonline.com/blog/deep-linking-attribution-mobile): Universal links, deferred deep linking, and install attribution wired so a tapped link lands users on the right screen after download.
- [When a PWA Beats a Native App for Your Startup's Budget](https://derkonline.com/blog/pwa-versus-native-app-decision): A founder's framework for choosing PWA, React Native, or full native by reach, retention, store economics, and time to revenue.
- [What App Store Rejections Really Cost a Shipping Startup](https://derkonline.com/blog/mobile-app-store-rejection-cost): The review cycles, privacy-label traps, and pre-submission checks that decide whether your launch slips a week or a month.
- [Make Horizontal Overflow Structurally Impossible on Mobile](https://derkonline.com/blog/horizontal-overflow-defense-mobile): Four CSS guards that stop a single long token or grid track from blowing your mobile layout sideways, verified by measuring rects not page scroll.
- [Pick the Service Worker Caching Strategy That Fits](https://derkonline.com/blog/service-worker-caching-strategies-that-work): Cache-first, network-first, and stale-while-revalidate compared, plus the versioning and purge logic that stops users seeing stale screens.

### Design & UX
- [Design Tokens That Survive Five Products and a Rebrand](https://derkonline.com/blog/design-tokens-that-scale-across-products): Set up tiered design tokens so a single color or spacing change propagates everywhere without a week of find-and-replace.
- [Hit WCAG Contrast Without Wrecking Your Brand Palette](https://derkonline.com/blog/accessible-color-contrast-without-ugly-ui): Tune luminance in OKLCH while holding hue, so your interface clears WCAG 4.5:1 contrast and still looks premium.
- [Get New Users to Their First Win Before They Leave](https://derkonline.com/blog/onboarding-flows-that-reach-first-value): Design activation-focused onboarding that drives users to first value in minutes and turns trials into paying customers.
- [Micro-Interactions That Separate Premium From Prototype](https://derkonline.com/blog/micro-interactions-that-feel-alive): Hover, press, and entrance animations with the right easing and timing so every element feels considered, premium, and alive.
- [Turn Dead Empty States Into Your Highest-Converting Screens](https://derkonline.com/blog/empty-states-that-drive-action): The blank first screen loses more new users than any feature. Design empty states that explain, reassure, and hand users their first win.
- [Build Real Dark Mode That Is Not Just an Inverted Color Sheet](https://derkonline.com/blog/dark-mode-done-right-not-inverted): A real dark theme is a new design system, not a flipped one: dark-gray bases, lightness elevation, desaturated color, text stepped off pure white.
- [Write Error Messages That Recover Trust, Not Lose Users](https://derkonline.com/blog/error-messages-that-keep-users): Turn dead-end failures into specific, calm, recovery-first copy that keeps users moving and protects your brand.
- [Build Visual Pickers Users Can See, Not Name Lists](https://derkonline.com/blog/visual-pickers-over-dropdown-lists): Swatch grids, font previews, and icon tiles that let people choose by sight instead of decoding library identifiers.
- [Design Your Site as a Connected Graph, No Dead Ends](https://derkonline.com/blog/information-architecture-connected-graph): Hub-and-spoke linking, contextual cross-links, and persona traces that let visitors travel by instinct, not the top nav.
- [Design an App Shell So Users Never Stare at a Spinner](https://derkonline.com/blog/react-19-app-shell-loading-states): App shell, skeletons, Suspense streaming, and prefetch make every screen feel instant instead of waiting on the network.
- [Animate Boldly While Respecting Users Who Get Sick From Motion](https://derkonline.com/blog/prefers-reduced-motion-inclusive-animation): Guard large and looping motion with prefers-reduced-motion so bold animation never triggers nausea or fails accessibility.
- [Design a Pricing Page That Makes the Right Plan Feel Obvious](https://derkonline.com/blog/pricing-page-design-that-sells): Three tiers, a featured plan, an anchor, equal-height aligned cards, and outcome-led copy guide buyers to the right plan.

### Product & Business
- [How To Cut Your Cloud Bill In Half Without Breaking Anything](https://derkonline.com/blog/reduce-cloud-bill-without-breaking-product): The handful of changes that recover most wasted cloud spend, ranked by savings against the risk of touching them.
- [Turn Your Security Posture Into a Closing Argument](https://derkonline.com/blog/security-as-sales-asset-founders): Why enterprise buyers gate deals on security questionnaires, and how shippable proof shortens the sales cycle instead of stalling it.
- [The Questions To Ask A Software Partner Before You Sign](https://derkonline.com/blog/software-vendor-due-diligence-checklist): A due diligence checklist that exposes whether a software studio will own your outcome or just bill you for hours.
- [How To Scope An MVP That Ships In Six Weeks](https://derkonline.com/blog/mvp-scope-that-ships-in-six-weeks): Cut your first build to the one workflow that tests your riskiest assumption, defer everything else, and ship in six weeks instead of never.
- [What Every Hour of Downtime Actually Costs Your Business](https://derkonline.com/blog/downtime-cost-uptime-revenue-case): Translate outages into lost revenue and churned trust so you can justify the monitoring and reliability spend with real arithmetic.
- [Why Your First Software Hire Should Not Be A Developer](https://derkonline.com/blog/first-engineering-hire-or-agency): Most founders hire raw coding hands when they need technical direction first; here is the sequencing that ships product faster.
- [How To Set A Software Budget That Survives Your Runway](https://derkonline.com/blog/software-budget-that-survives-runway): Pin engineering spend to the next milestone, not future scale. Every dollar should answer which milestone it buys, or it is just burn.
- [How To Tell If Technical Debt Is Quietly Killing Your Roadmap](https://derkonline.com/blog/technical-debt-slowing-roadmap): A velocity drop with no other cause is usually debt, not your team. Five signals confirm it, then fix the choke point first.
- [How To Price Your Software Product Before You Have Customers](https://derkonline.com/blog/pricing-software-product-first-version): Anchor your first price to the outcome you deliver, not your costs, and escape the underpricing trap that starves growth.
- [How To Measure Your Engineering Team Without Vanity Metrics](https://derkonline.com/blog/measure-engineering-team-without-vanity-metrics): Track DORA and SPACE outcomes that predict shipped value instead of commit counts that reward looking busy.
- [Vet a Vendor's Security Before You Hand Over Your Data](https://derkonline.com/blog/vendor-security-due-diligence-before-you-sign): The questions to ask any SaaS or contractor about secrets, access, and incident response before you hand over your data.
- [What Teams Get Wrong Shipping to African Markets](https://derkonline.com/blog/shipping-to-africa-payments-latency): Mobile money, latency, and device reality decide adoption here; design for them upfront or lose the market to an afterthought.
- [How To Hand Off Software So It Survives The Person Who Built It](https://derkonline.com/blog/software-handover-without-key-person-risk): Eliminate bus-factor risk with documentation, tests, and access practices that keep your product running after anyone leaves.
- [When To Refactor Your Legacy Product And When To Rewrite It](https://derkonline.com/blog/rewrite-vs-refactor-legacy-product): A clear-eyed framework for the most expensive software decision, and why the strangler fig usually beats the doomed rewrite.
- [In House or Outsourced Engineering for a Startup](https://derkonline.com/blog/in-house-vs-outsourced-engineering-velocity): Weigh speed, ownership, and cost by stage so you pick the build model that gets you to revenue, not just to code.
- [How To Set Reliability Targets Your Whole Company Can Agree On](https://derkonline.com/blog/slo-error-budget-for-founders): Use error budgets to settle the eternal fight between shipping fast and staying up, with one shared, data-driven number.
- [When Rewriting Your App Pays Off and When It Kills You](https://derkonline.com/blog/rebuild-vs-rewrite-legacy-app-decision): A founder's framework for choosing refactor, strangler-fig, or full rewrite without betting the roadmap on a guess.
- [When To Build Custom Software Instead Of Buying Off The Shelf](https://derkonline.com/blog/buy-vs-build-software-ghana-startups): A core-versus-context framework that tells founders which workflows justify custom code and which a SaaS subscription solves cheaper.
- [Prove an Automation Project Paid for Itself in Hours Saved](https://derkonline.com/blog/measuring-roi-of-automation-projects): Baseline the manual work, instrument the automated path, and report automation ROI across all three value categories a CFO will believe.
- [What an Hour of Downtime Really Costs Your Business](https://derkonline.com/blog/downtime-cost-uptime-investment-roi): Price outages across lost revenue, productivity, recovery, and churn so reliability spend reads as insurance instead of overhead.
- [Why Founders Should Sell the First Hundred Deals](https://derkonline.com/blog/founder-led-sales-software-product): The first hundred deals are product research, not just sales, and they set the real price only the founder can learn by selling them.
- [What An Hour Of Downtime Actually Costs Your Business](https://derkonline.com/blog/downtime-cost-real-number): A simple one-slide model to put a defensible dollar figure on outages and justify reliability spend to your board.
- [The Bandwidth Bill Quietly Eating Your Margin and How to Cap It](https://derkonline.com/blog/cdn-egress-costs-bleeding-margin): Egress and cache misses scale with growth in ways founders never model; here is where the spend hides and how to claw it back.

- [All articles](https://derkonline.com/blog)

## About & contact
- [About the studio](https://derkonline.com/about)
- [How we work](https://derkonline.com/process)
- [Free security scan](https://derkonline.com/security-audit)
- [Contact](https://derkonline.com/contact) — hello@derkonline.com
- Ghana: Accra, Ghana — +233 55 572 4218
- United States: 80 Rumbrook Rd, Leominster, MA — +1 504 300 9240