iiinova — where your digital self keeps evolving

Alex Rusin @alexrusin.com · 02/10/2026

Claude Code added the missing auth tests and they all pass. Now read them. Does the grace window test actually wait past the grace window? If not, it passes for the wrong reason and keeps passing after you break revocation. youtu.be/dvp3Gn-jiPo

youtu.be

The Top Mistake In JWT Authentication And How To Fix It

Free: 57 auth mistakes that fail a security review 👉 https://blog.alexrusin.com/auth-checklist/?src=yt-refresh-token-rotation This is a build. We add refresh tokens to a Node.js and Express API…

000

Alex Rusin @alexrusin.com · 01/10/2026

Access & Refresh Tokens: The Rotation Secret!

000

Alex Rusin @alexrusin.com · 30/09/2026

Refresh token rotation breaks in a way manual testing won't catch. A real frontend fires parallel requests. They all get a 401 and hit refresh with the same token. One wins, four look like theft, and a legitimate user gets logged out.

000

Alex Rusin @alexrusin.com · 29/09/2026

Fix Your Logout Handler! Token Security 101

000

Alex Rusin @alexrusin.com · 28/09/2026

In most JWT tutorials, logout returns 200 and does nothing. The server never stored the token, so it keeps working. Open your logout handler. If it only clears client state, you don't have a logout. youtu.be/dvp3Gn-jiPo

youtu.be

The Top Mistake In JWT Authentication And How To Fix It

Free: 57 auth mistakes that fail a security review 👉 https://blog.alexrusin.com/auth-checklist/?src=yt-refresh-token-rotation This is a build. We add refresh tokens to a Node.js and Express API…

000

Alex Rusin @alexrusin.com · 25/09/2026

Split Claude Code hooks into two tiers. Type check and lint after every edit. Full tests, coverage, and complexity gate on Stop. And check stop_hook_active, or a blocking Stop hook keeps firing until you kill the terminal. youtu.be/wU2SFAbnL3s

youtu.be

Claude Code Hooks: Stop Bad AI Code with TypeScript, ESLint, and Vitest

📘Complete Claude Code & Coding Agents Course 👉 https://trk.udemy.com/PzbLxN 📘Complete JavaScript Guide (Beginner + Advanced) 👉 https://trk.udemy.com/bOoJnx 📘NodeJS - The Complete Guide (MVC,…

010

Alex Rusin @alexrusin.com · 24/09/2026

Pro Tip: How to Implement Claude Code Hooks Effectively

000

Alex Rusin @alexrusin.com · 23/09/2026

Your Claude Code hook can't be a bare npm script. Wrap it in a script that runs the checks, captures output, and exits 2 on failure. Then Claude reads the failures and fixes them without being asked.

100

Alex Rusin @alexrusin.com · 22/09/2026

What are Claude Code Hooks Explained in 4 Seconds

000

Alex Rusin @alexrusin.com · 21/09/2026

A Claude Code hook that calls npm run gate looks correct and blocks nothing. A failing script exits 1, which is non-blocking on PostToolUse. Exit 0 is worse. Claude never sees the output. Exit 2 puts your stderr in front of the model. youtu.be/wU2SFAbnL3s

youtu.be

Claude Code Hooks: Stop Bad AI Code with TypeScript, ESLint, and Vitest

100

Alex Rusin @alexrusin.com · 18/09/2026

safeParse at the untrusted edge, where you want to catch the error and respond with it. parse at internal boundaries, where bad data is a bug in your own code and should fail loudly. parse throws, safeParse doesn't. youtu.be/YeFo6yoP6ro

youtu.be

Type-Safe Express APIs with Zod v4: One Schema, No Duplicate Types

010

Alex Rusin @alexrusin.com · 17/09/2026

Zod The Schema Library Every Dev Needs

010

Alex Rusin @alexrusin.com · 16/09/2026

Drop a Zod validation middleware into your Express route, then hover over req.body. It's any again. The runtime guarantee is real, the type just didn't survive the middleware boundary. Two ways out: a cast, or generics. youtu.be/YeFo6yoP6ro

youtu.be

Type-Safe Express APIs with Zod v4: One Schema, No Duplicate Types

010

Alex Rusin @alexrusin.com · 15/09/2026

Automate API Validation with Zod & TypeScript

010

Alex Rusin @alexrusin.com · 14/09/2026

TypeScript is gone by the time the request lands. A typed Express handler will still take a misspelled field and compile. One Zod schema does the runtime check and hands you the type from the same object. youtu.be/YeFo6yoP6ro

youtu.be

Type-Safe Express APIs with Zod v4: One Schema, No Duplicate Types

010

Alex Rusin @alexrusin.com · 14/09/2026

Yes. This is actually a good point.

010

Alex Rusin @alexrusin.com · 11/09/2026

A test you've never seen fail is a test you're guessing about. Drop the unique index. Comment out the policy. Run it. If it doesn't go red, you just learned that test was never checking anything, in 5 minutes instead of in an accident. youtu.be/oYYXQSgn-bA

youtu.be

Node.js Integration Tests with a Real Postgres Database (Testcontainers + Vitest)

000

Alex Rusin @alexrusin.com · 09/09/2026

Mocking the data layer is fine when the thing under test is your code. It's useless when the thing under test is your database. Constraints, policies, cascade rules, transaction behavior. None of that lives in your source. It lives in the engine. youtu.be/oYYXQSgn-bA

youtu.be

Node.js Integration Tests with a Real Postgres Database (Testcontainers + Vitest)

000

Alex Rusin @alexrusin.com · 07/09/2026

I commented out the row-level security rule my isolation tests exist to check. The tests still passed. Not badly written tests. They were pointed at my dev database, and editing a migration file doesn't change a database that was already migrated. youtu.be/oYYXQSgn-bA

youtu.be

Node.js Integration Tests with a Real Postgres Database (Testcontainers + Vitest)

101

Alex Rusin @alexrusin.com · 03/09/2026

With presigned POST, the file has to be appended to the form data last. S3 checks the policy against the fields it has already parsed. Anything after the file is invisible to that check. Put the file first and your conditions never get read. youtu.be/IhbpLIdIo2k

youtu.be

The Right Way to Handle File Uploads in Node.js (Bypassing Express)

000

Alex Rusin @alexrusin.com · 02/09/2026

The content type you pass to getSignedUrl is a suggestion. The client can override it and S3 won't care. createPresignedPost is different — the policy travels with the request and S3 evaluates it before accepting a byte. youtu.be/IhbpLIdIo2k

youtu.be

The Right Way to Handle File Uploads in Node.js (Bypassing Express)

000

Alex Rusin @alexrusin.com · 01/09/2026

A presigned S3 PUT pins the bucket, the key, and the expiry. Not the size. Not the content type. I signed a URL for a 200KB PNG and uploaded 400MB of shell script to it. S3 accepted it. No error, no alert. youtu.be/IhbpLIdIo2k

youtu.be

The Right Way to Handle File Uploads in Node.js (Bypassing Express)

000

Alex Rusin @alexrusin.com · 28/08/2026

A queue is not a reliability feature. It's a deferral feature. Skip the retries, the backoff, the idempotent writes, the dead letter queue, and you've taken work that used to fail loudly and taught it to fail silently. youtu.be/kxgO32H0jmc

youtu.be

Node.js Background Jobs with BullMQ Postgres Backend: Everything You Need to Know

000

Alex Rusin @alexrusin.com · 24/08/2026

BullMQ's default is one attempt. Not three. One. If you never passed an options object, you don't have retries. You have a queue that gives up immediately, which is most of the way to not having a queue at all. youtu.be/kxgO32H0jmc

youtu.be

Node.js Background Jobs with BullMQ Postgres Backend: Everything You Need to Know

000

Alex Rusin @alexrusin.com · 21/08/2026

Set the tenant ID outside a transaction and it stays on the connection when it goes back to the pool. Now one request in a few hundred quietly answers with someone else's last name. Survives review, survives QA, surfaces in a ticket 6 months later. youtu.be/ctJy5AxgVXM

youtu.be

Claude Code + Prisma: Multi-Tenant Postgres API That Can't Leak Data

000

Alex Rusin @alexrusin.com · 17/08/2026

Enabling row-level security in Postgres isn't enough. Prisma connects as the table owner, and Postgres exempts owners from their own policies. Until you FORCE it, the policy is active and doing absolutely nothing. youtu.be/ctJy5AxgVXM

youtu.be

Claude Code + Prisma: Multi-Tenant Postgres API That Can't Leak Data

000

Alex Rusin @alexrusin.com · 10/08/2026

The best tasks to hand Claude are usually boring, not impressive. A 10-min task you do 50x a week beats a 3-hour task you do twice a year. Score every task on volume, drag, fit, then subtract risk — start with the low-risk hotspot. youtu.be/BrzxA3B7gEw

youtu.be

Why Your Claude Projects Keep Breaking (And How to Fix It for Good)

📘 Claude AI: The AI Assistant You'll Actually Use 👉 https://trk.udemy.com/ZVmxoX Most people don't quit Claude because it's bad — they quit because their Project breaks the moment the task gets…

000

Alex Rusin @alexrusin.com · 04/08/2026

This is a good point. I haven't tried it yet. Will check it out.

000

Alex Rusin @alexrusin.com · 03/08/2026

"Move that button down. No, the other one. The warning text is too aggressive." The agent can't see your UI — but the fix isn't better prompting. It's throwaway prototypes you review by pointing at the element instead of narrating it in English.

youtu.be

AI Can Write Your UI. It Can't Tell You If It's Good. Here's the Fix.

120

Alex Rusin @alexrusin.com · 27/07/2026

Cursor's 1,000-agent swarm rebuilding SQLite hit the same coordination failures a single Claude Code session hits, just scaled up. Fix: give the strong model only planning, a cheap model the coding. Same quality, an eighth of the cost.

youtu.be

Cursor Ran 1,000 Agents At Once. Every Problem They Hit, You Hit Too

100

Alex Rusin @alexrusin.com · 20/07/2026

An agent optimizes for code that's correct in isolation — because that's all it can see. Concurrency correctness lives in the interaction between requests, which the file never reveals. So it'll write a check-then-act race condition happily.

youtu.be

Claude Code Looks Perfect in Demos. Then You Ship Real Node.js

020

Alex Rusin @alexrusin.com · 08/07/2026

A Claude Project isn't a folder — it's a brief. Role, context, format, guardrails. Skip guardrails and Claude will invent details when data's missing. You just won't find out until the worst moment.

youtu.be

Stop Re-Explaining Yourself to Claude Every Week

📘Claude AI: The AI Assistant You’ll Actually Use👉 https://trk.udemy.com/ZVmxoX Most people use Claude Projects like a folder. They upload some files, write a vague instruction line, and wonder why…

000

Alex Rusin @alexrusin.com · 07/07/2026

The Claude tasks worth automating are rarely the impressive ones. Score any task on volume, drag, fit, and risk — the boring, repetitive stuff nearly always beats the flashy one-off you'd actually want to demo.

youtu.be

Most People Use Claude on the Wrong Work (Here's How to Fix That)

📘Claude AI: The AI Assistant You’ll Actually Use👉 https://trk.udemy.com/ZVmxoX Most people who try Claude at work give up after two weeks. Not because Claude is bad — because they aimed it at the…

000

Alex Rusin @alexrusin.com · 23/06/2026

I ran a free Claude Code skill against my own codebase to audit its architecture. It came back with 5 ranked suggestions — strong to speculative. One was a structural issue I'd already caught by hand. That's when I trusted it.

youtu.be

I Let AI Audit My Node.js Codebase: Here's What It Found

000

Alex Rusin @alexrusin.com · 16/06/2026

🤖 Stop copy-pasting from ChatGPT and hoping for the best. In my latest video, I walk through the structured, multi-agent AI workflow I actually use to ship features — with planning, TDD, and code review built right in. youtu.be/ls-gruxjQ4M

youtu.be

The Exact Workflow I Use to Ship Features with AI Agents

100

Alex Rusin @alexrusin.com · 09/06/2026

Here's the uncomfortable truth: when you clone someone else's skill system, you get their residue — not their experience. The best skill system you'll ever use isn't on GitHub. It's the one you build yourself. 🔨 youtu.be/bSYEQB8AJq8

youtu.be

This 5-Step Method Replaces Popular Skill Libraries

000

Alex Rusin @alexrusin.com · 01/06/2026

Why AI coding feels brilliant in one project and useless in another? The problem usually isn’t the model or the prompt — it’s the codebase. In this video I break down the 3 biggest levers that improve AI coding. youtu.be/GhZEHeep1XQ

youtu.be

Your Codebase Is Sabotaging Your AI Assistant

000

Alex Rusin @alexrusin.com · 26/05/2026

Most developers using AI coding agents make the same mistake — the agent finishes, they glance at the output, and they ship it. That's how critical bugs make it to production. 😬 youtu.be/BptgtU3UkwU

youtu.be

Why Your AI Assistant's Code Is Dangerous

110

Alex Rusin @alexrusin.com · 18/05/2026

One of the biggest mistakes developers make when using AI agents is jumping straight to the prompt without thinking through the feature first. The result? Mediocre code that misses half the requirements. In my latest video, I compare 3 planning tools designed to fix that youtu.be/rJJ8wslG9jo

youtu.be

I Made 3 Claude Code Skills Build the Same API — One Asked Me 37 Questions

📘Complete JavaScript Guide (Beginner + Advanced) 👉 https://trk.udemy.com/bOoJnx 📘NodeJS - The Complete Guide (MVC, REST APIs, GraphQL, Deno) 👉 https://trk.udemy.com/EEN1oK Which Claude Code…

000

Alex Rusin @alexrusin.com · 10/05/2026

The best developers using AI tools right now aren't the ones who trust them the most. They're the ones who verify the most. Healthy skepticism isn't slowing them down — it's what makes their output actually ship-ready. 🚢

010

Alex Rusin @alexrusin.com · 09/05/2026

There's something deeply ironic about an AI that's supposedly too dangerous for the public to use... having a next-best model that can't look up the current version of a npm package. The hype and the reality need to have a conversation. 🙃

000

Alex Rusin @alexrusin.com · 08/05/2026

🔁 Stop one-shotting your project setups. Start with TypeScript config. Validate. Add your framework. Validate. Add your database layer. Validate. Let AI fill in the boilerplate. The extra 20 minutes upfront will save you hours later.

010

Alex Rusin @alexrusin.com · 07/05/2026

One-shotting a complex project setup with AI is like ordering a custom house and not checking if the foundation meets code. The rooms might look great. But you won't know there's a problem until something breaks. 🏠

000