# MSDEVBUILD — Multi-Stack Dev Build

> Multi-stack developer learning platform by Suthahar — hands-on Cloud, Azure, AI, GitHub Copilot, Flutter, .NET MAUI and Web. Real code, real trade-offs.

MSDEVBUILD (Multi-Stack Dev Build) is a multi-stack developer learning platform. It helps developers learn, build, modernize, and innovate across Cloud, AI, Mobile, Web, and modern software engineering. It is not a single-stack .NET blog — .NET is one of many technologies covered.

Topics covered in depth:

- Cloud & Azure architecture
- Azure AI, Generative AI & AI engineering
- GitHub Copilot, AI agents & AI-powered development
- Vibe coding & developer productivity
- Mobile development — Flutter & .NET MAUI
- Web development — Web API & React
- Legacy application AI integration & modernization
- Programming & software engineering fundamentals
- Firebase, analytics & modern application platforms

Written by Suthahar Jegatheesan (MSDEVBUILD). Cloud, AI & Mobile Solutions Architect with 18+ years in enterprise architecture across Azure, Google Cloud and Firebase, building with C#, Python, .NET MAUI and Flutter, and applying AI with Azure AI, Claude and GitHub Copilot. Creator of MSDEVBUILD.
This is the articles subdomain of msdevbuild.com; the main site is https://www.msdevbuild.com.

Every article below is available as clean Markdown by appending `.md` to its URL.
Author profile and verified identity links: https://blog.msdevbuild.com/about

## Web

- [How to Secure a .NET Minimal API with JWT Bearer Authentication](https://blog.msdevbuild.com/blog/secure-minimal-api-jwt-dotnet/.md): A working JWT bearer auth setup for ASP.NET Core Minimal APIs — token validation, role policies, and the config mistakes that silently disable security.
- [Structuring a .NET Minimal API Project That Survives Growth](https://blog.msdevbuild.com/blog/minimal-api-project-structure/.md): Program.cs stops scaling around twenty endpoints. Here is a vertical-slice layout for Minimal APIs that keeps routing, validation and handlers organised.

## Azure

- [How Azure Protects a Mobile App: The Full Request Flow, Layer by Layer](https://blog.msdevbuild.com/blog/azure-mobile-app-layers/.md): Front Door, your API, Microsoft Entra ID, authorization and a private database — the five layers that stand between a mobile app and its data on Azure.
- [Your Mobile App Is Leaking Its API Key — and Obfuscation Will Not Save It](https://blog.msdevbuild.com/blog/mobile-secret-in-apk/.md): An APK or IPA is a zip file. Anything hardcoded inside it, including your API key, is already public — and here is how to get it off the phone for good.
- [What Is Microsoft Foundry (Azure AI Foundry)? The Services, and When You Actually Need Them](https://blog.msdevbuild.com/blog/what-is-azure-ai-foundry-services-overview/.md): A plain tour of Microsoft Foundry for developers: the resource, projects, models, agents, tools, and when Azure OpenAI on its own is enough.

## AI

- [From Search Box to AI Agent: Microsoft Foundry (Azure AI Foundry) for a Food Delivery App](https://blog.msdevbuild.com/blog/azure-ai-foundry-ai-agent-food-delivery-app/.md): The business case for an AI agent on an app that already exists, what an agent really is, and the architecture that keeps it inside its lane.
- [Building a RAG Pipeline in .NET with Azure OpenAI and Azure AI Search](https://blog.msdevbuild.com/blog/azure-openai-rag-dotnet/.md): End-to-end retrieval-augmented generation in C#: chunking, embeddings, hybrid vector search, and grounding a chat completion so it cites its sources.
- [What Is an AI Token? Why Every AI Cost Is Calculated in Them](https://blog.msdevbuild.com/blog/what-is-ai-token-cost-calculated/.md): Tokens are not words, and they are not characters. Here is what a token really is, why AI billing counts them, and how to work out the cost of a request.

## GitHub Copilot

- [Building a GitHub Copilot Security Agent for Legacy Systems (Honestly)](https://blog.msdevbuild.com/blog/github-copilot-security-agent-legacy-systems/.md): Learn what a GitHub Copilot security agent can find in a legacy system, what it can miss, and why scanners and people must still approve changes.
- [Making GitHub Copilot Understand a Legacy Codebase Nobody Documented](https://blog.msdevbuild.com/blog/github-copilot-understand-legacy-codebase-discovery/.md): A repeatable method for legacy discovery: turning the business rules, workflows and history a codebase never documented into knowledge Copilot uses.
- [GitHub Copilot Agents for Legacy Applications: A Complete Guide to Building an AI-Powered Development Team](https://blog.msdevbuild.com/blog/github-copilot-agents-for-legacy-applications/.md): A handbook for GitHub Copilot Agents on legacy code: what is a real feature, what is a pattern, and how to build an AI development team around it.
- [How to Save AI Tokens: 15 Habits That Cut My Copilot Context Waste](https://blog.msdevbuild.com/blog/save-ai-tokens-tips-copilot-context/.md): Fifteen tested habits that cut my monthly AI token usage without cutting how much I use AI, from context discipline to knowing when to restart a chat.
- [400K AI Tokens a Month: My Daily GitHub Copilot Workflow That Makes the Budget Last](https://blog.msdevbuild.com/blog/ai-token-budget-daily-copilot-workflow/.md): A 400K monthly AI token budget sounds generous until agent mode eats it in a week. Here is the daily Copilot workflow I use to make it last the month.
- [GitHub Copilot Hooks for Beginners: Why You Need Them and What You Can Build](https://blog.msdevbuild.com/blog/github-copilot-hooks-for-beginners/.md): A beginner GitHub Copilot Hooks tutorial: what a hook is, why an AI agent needs deterministic guardrails, and how to write your first one in ten minutes.
- [GitHub Copilot PR Summary: How to Get Descriptions Reviewers Actually Read](https://blog.msdevbuild.com/blog/github-copilot-pr-summary-reviewers-actually-read/.md): The GitHub Copilot PR summary: why an auto-generated description that restates the diff is noise, and how to get one reviewers actually read.
- [GitHub Copilot Can't Replace Your Code Reviewer — Here's What It Can Actually Automate](https://blog.msdevbuild.com/blog/github-copilot-automate-code-review-limits/.md): A software architect on GitHub Copilot code review — build a Skill that automates the mechanical layer, and the limits that keep a human in the loop.
- [Building an Azure Copilot Skill: Secure, Cost-Aware Cloud Baselines with Bicep, Start to Finish](https://blog.msdevbuild.com/blog/build-azure-copilot-skill-secure-cost-aware-bicep/.md): Build one GitHub Copilot Skill (SKILL.md) that guards your Azure Bicep — Managed Identity, private networking and cost tiers Copilot will not violate.
- [Building a Flutter Copilot Skill: Clean Architecture with BLoC and Firebase, Start to Finish](https://blog.msdevbuild.com/blog/build-flutter-github-copilot-skill-riverpod-firebase/.md): Build one GitHub Copilot Skill (SKILL.md) so Copilot writes Flutter the way your app does — layered folders, BLoC state, Firebase behind a repository.
- [Building Your First GitHub Copilot Skill: A .NET Clean Architecture SKILL.md, Start to Finish](https://blog.msdevbuild.com/blog/build-first-github-copilot-skill-dotnet-clean-architecture/.md): A build-along for .NET developers — create one GitHub Copilot Skill (SKILL.md) that enforces Clean Architecture, CQRS and your API contract.
- [GitHub Copilot Skills Deep Dive: The Missing Layer Between Prompts, Instructions, and Agents](https://blog.msdevbuild.com/blog/github-copilot-skills-deep-dive/.md): GitHub Copilot Skills explained by an architect — what they are, how they differ from prompts and instructions, and how to build reusable Skills for teams.
- [The Complete AGENTS.md Playbook: Build AI Coding Agents That Work Like Your Best Engineer](https://blog.msdevbuild.com/blog/agents-md-complete-playbook/.md): What belongs in an AGENTS.md file — architecture, security, testing, AI rules — plus what to leave out, common mistakes and a reusable template.
- [AGENTS.md in 2026: The One File Every AI-Assisted Developer Actually Needs](https://blog.msdevbuild.com/blog/agents-md-pain-points-workload-savings/.md): AI agents write more code each month than teams can review by hand. AGENTS.md is the one file that keeps it consistent — solo, team or enterprise.
- [What Is GitHub Copilot Custom Instructions? (And Why Your Project Needs One)](https://blog.msdevbuild.com/blog/github-copilot-custom-instructions/.md): GitHub Copilot custom instructions explained with a real Flutter app you can clone: what the file is, why every project needs one, and beginner mistakes.

## Short videos

Short videos, one engineering idea each, about 30 seconds. The Markdown twin of each contains every step written out in order.

- [Secure a Mobile API in 5 Steps](https://blog.msdevbuild.com/shorts/secure-mobile-api-five-steps.md): In order. The order is most of the value. (8 steps, ~25s — page: https://blog.msdevbuild.com/shorts/secure-mobile-api-five-steps/)
- [What Happens When You Tap Sign In](https://blog.msdevbuild.com/shorts/secure-login-journey.md): The full login journey on a secure Azure app, step by step. (8 steps, ~25s — page: https://blog.msdevbuild.com/shorts/secure-login-journey/)
- [Your Mobile App Is Leaking Its API Key](https://blog.msdevbuild.com/shorts/mobile-secret-in-apk.md): It's hardcoded inside the app — anyone can unzip it and read it. (8 steps, ~26s — page: https://blog.msdevbuild.com/shorts/mobile-secret-in-apk/)
- [5 Mobile App Security Vulnerabilities](https://blog.msdevbuild.com/shorts/mobile-app-five-vulnerabilities.md): Found by a routine scan — nobody wrote any on purpose. (8 steps, ~25s — page: https://blog.msdevbuild.com/shorts/mobile-app-five-vulnerabilities/)
- [Insecure vs Secure: Same App, Two Builds](https://blog.msdevbuild.com/shorts/insecure-vs-secure-architecture.md): The same mobile app on Azure, built two different ways. (8 steps, ~25s — page: https://blog.msdevbuild.com/shorts/insecure-vs-secure-architecture/)
- [What Happens When You Hardcode an API Key](https://blog.msdevbuild.com/shorts/hardcoded-key-blast-radius.md): Stealing it costs hours. Rotating it can cost days. (8 steps, ~26s — page: https://blog.msdevbuild.com/shorts/hardcoded-key-blast-radius/)
- [Hacker vs Azure: 5 Attacks, 5 Defences](https://blog.msdevbuild.com/shorts/hacker-vs-azure-defences.md): Each attack, matched to the Azure feature that stops it. (8 steps, ~25s — page: https://blog.msdevbuild.com/shorts/hacker-vs-azure-defences/)
- [How Azure Protects Your Mobile App](https://blog.msdevbuild.com/shorts/azure-mobile-app-layers.md): The 5 layers standing between your app and the database. (8 steps, ~26s — page: https://blog.msdevbuild.com/shorts/azure-mobile-app-layers/)
- [Azure Key Vault, Explained Properly](https://blog.msdevbuild.com/shorts/azure-key-vault-explained.md): The one secret most tutorials forget to remove. (8 steps, ~25s — page: https://blog.msdevbuild.com/shorts/azure-key-vault-explained/)
- [An AI Bot Is Attacking Your Login](https://blog.msdevbuild.com/shorts/ai-bot-attacks-mobile-app.md): 8,000 password attempts a minute, while nobody's watching. (8 steps, ~25s — page: https://blog.msdevbuild.com/shorts/ai-bot-attacks-mobile-app/)
- [A 118-character URL. 15 characters back.](https://blog.msdevbuild.com/shorts/azure-url-shortener-design.md): Designing a link shortener on Azure — and the one digit that decides whether you ever see your click stats. (13 steps, ~65s — page: https://blog.msdevbuild.com/shorts/azure-url-shortener-design/)
- [A million taps a second. One tiny message.](https://blog.msdevbuild.com/shorts/azure-realtime-reactions-fan-out.md): 25 million people tapping 🔥 at the same moment — and not one of those taps is ever delivered to anyone. (14 steps, ~70s — page: https://blog.msdevbuild.com/shorts/azure-realtime-reactions-fan-out/)
- [One line of code. Seven stops.](https://blog.msdevbuild.com/shorts/azure-http-request-journey.md): What really happens between await http.GetAsync(...) and the JSON landing back in your app. (13 steps, ~64s — page: https://blog.msdevbuild.com/shorts/azure-http-request-journey/)
- [The queue was in order. Your workers were not.](https://blog.msdevbuild.com/shorts/azure-ordering-concurrency-sessions.md): A customer paid $120 for an item they removed, and Service Bus did nothing wrong. (12 steps, ~50s — page: https://blog.msdevbuild.com/shorts/azure-ordering-concurrency-sessions/)
- [Why Your AI Agent's Token Bill Exploded](https://blog.msdevbuild.com/shorts/ai-agent-token-cost.md): Nothing failed. The loop just paid for its own history, twelve times per task. (12 steps, ~51s — page: https://blog.msdevbuild.com/shorts/ai-agent-token-cost/)
- [You tapped View Product.](https://blog.msdevbuild.com/shorts/azure-view-product-request-flow.md): Five Azure services answer before the page paints. Here is the order they run in. (12 steps, ~50s — page: https://blog.msdevbuild.com/shorts/azure-view-product-request-flow/)
- [A rack just lost power. The shop kept selling.](https://blog.msdevbuild.com/shorts/azure-fault-domain.md): Why Azure places your VMs on different physical racks, and what breaks the moment it does not. (16 steps, ~53s — page: https://blog.msdevbuild.com/shorts/azure-fault-domain/)
- [Azure is rebooting your server. Nobody notices.](https://blog.msdevbuild.com/shorts/azure-availability-set.md): How an Azure Availability Set keeps an online shop selling straight through planned server maintenance. (14 steps, ~64s — page: https://blog.msdevbuild.com/shorts/azure-availability-set/)
- [The outage lasted 18 minutes. Your retries lasted 4 seconds.](https://blog.msdevbuild.com/shorts/azure-poison-message-retry-window.md): 720 good orders in the dead-letter queue, and not one of them was poison. (12 steps, ~50s — page: https://blog.msdevbuild.com/shorts/azure-poison-message-retry-window/)
- [One server goes down. Nobody can buy anything.](https://blog.msdevbuild.com/shorts/azure-availability-zones.md): How Azure Availability Zones keep an Amazon-scale shopping app online while an entire datacenter fails. (10 steps, ~32s — page: https://blog.msdevbuild.com/shorts/azure-availability-zones/)
- [Azure rebooted the server. The bank never noticed.](https://blog.msdevbuild.com/shorts/azure-update-domain.md): How update domains let Microsoft patch the hosts under your VMs without dropping a single customer. (16 steps, ~57s — page: https://blog.msdevbuild.com/shorts/azure-update-domain/)
- [What is MCP?](https://blog.msdevbuild.com/shorts/model-context-protocol-explained.md): Model Context Protocol — how an AI assistant reaches GitHub, your database, your files and Slack. (8 steps, ~27s — page: https://blog.msdevbuild.com/shorts/model-context-protocol-explained/)
- [LLMs have no memory](https://blog.msdevbuild.com/shorts/copilot-context-window.md): So how does Copilot know your code? It never remembers. It re-reads, re-ranks and re-sends your context on every single request. (9 steps, ~28s — page: https://blog.msdevbuild.com/shorts/copilot-context-window/)
- [From a model to a shipped AI product](https://blog.msdevbuild.com/shorts/azure-ai-foundry.md): Azure AI Foundry is the platform Microsoft built for the part everyone underestimates — everything after the demo. (8 steps, ~25s — page: https://blog.msdevbuild.com/shorts/azure-ai-foundry/)
- [Your Durable Function runs many times](https://blog.msdevbuild.com/shorts/azure-durable-functions-replay.md): The orchestrator body re-executes from line one, over and over, until every step is answered. (8 steps, ~22s — page: https://blog.msdevbuild.com/shorts/azure-durable-functions-replay/)
- [Netflix does not stream from Netflix](https://blog.msdevbuild.com/shorts/how-netflix-works-internally.md): The video you watch tonight is already sitting inside your internet provider. (8 steps, ~22s — page: https://blog.msdevbuild.com/shorts/how-netflix-works-internally/)
- [In Python, a name is a sticker, not a box](https://blog.msdevbuild.com/shorts/python-mutable-vs-immutable.md): Two names can sit on one object. Whether it can change is what makes lists and strings behave differently. (8 steps, ~24s — page: https://blog.msdevbuild.com/shorts/python-mutable-vs-immutable/)
- [A call needs both people free. A message does not.](https://blog.msdevbuild.com/shorts/azure-sync-vs-async-messaging.md): Sync versus async, decided by one question — and priced honestly. (10 steps, ~32s — page: https://blog.msdevbuild.com/shorts/azure-sync-vs-async-messaging/)
- [Two Azure queues. Which one do you pick?](https://blog.msdevbuild.com/shorts/azure-service-bus-vs-queue-storage.md): Five questions that settle it, and the one where the cheap option wins. (10 steps, ~32s — page: https://blog.msdevbuild.com/shorts/azure-service-bus-vs-queue-storage/)
- [Somebody said “we need Kafka”.](https://blog.msdevbuild.com/shorts/azure-service-bus-vs-kafka.md): A broker and a log are not two brands of the same thing. (10 steps, ~32s — page: https://blog.msdevbuild.com/shorts/azure-service-bus-vs-kafka/)
- [The sale opened. The orders vanished.](https://blog.msdevbuild.com/shorts/azure-service-bus-flash-sale.md): What a queue actually does to a traffic spike your server cannot absorb. (10 steps, ~33s — page: https://blog.msdevbuild.com/shorts/azure-service-bus-flash-sale/)
- [The gateway timed out. Where did the payment go?](https://blog.msdevbuild.com/shorts/azure-service-bus-dead-letter.md): Retries, delivery counts and the queue Azure fills for you whether you read it or not. (10 steps, ~32s — page: https://blog.msdevbuild.com/shorts/azure-service-bus-dead-letter/)
- [Azure Relay: No Inbound Ports Needed](https://blog.msdevbuild.com/shorts/azure-relay-hybrid-connection.md): How the cloud reaches a server it is not allowed to connect to. (10 steps, ~32s — page: https://blog.msdevbuild.com/shorts/azure-relay-hybrid-connection/)
- [You picked the topic. Then it filled up.](https://blog.msdevbuild.com/shorts/azure-queue-vs-topic-traps.md): Five Service Bus traps that only show themselves six months later. (10 steps, ~32s — page: https://blog.msdevbuild.com/shorts/azure-queue-vs-topic-traps/)
- [The upload froze the app for 8 seconds.](https://blog.msdevbuild.com/shorts/azure-queue-storage-image-upload.md): The fix is the cheapest queue Azure sells, and a pointer instead of a payload. (10 steps, ~32s — page: https://blog.msdevbuild.com/shorts/azure-queue-storage-image-upload/)
- [Three teams. One queue. Everyone missed messages.](https://blog.msdevbuild.com/shorts/azure-pubsub-vs-point-to-point.md): A queue is a DM. A topic is the group broadcast. The difference is a real bug. (10 steps, ~32s — page: https://blog.msdevbuild.com/shorts/azure-pubsub-vs-point-to-point/)
- [Azure Notification Hubs: One Push, a Million Phones](https://blog.msdevbuild.com/shorts/azure-notification-hubs-broadcast.md): Why looping over device tokens yourself is the answer that fails the interview. (10 steps, ~32s — page: https://blog.msdevbuild.com/shorts/azure-notification-hubs-broadcast/)
- [15,000 GPS pings a second. Do not put that in a queue.](https://blog.msdevbuild.com/shorts/azure-event-hubs-driver-pings.md): Partitions, offsets and the reason four teams can read the same event. (10 steps, ~32s — page: https://blog.msdevbuild.com/shorts/azure-event-hubs-driver-pings/)
- [Event Grid vs Event Hubs](https://blog.msdevbuild.com/shorts/azure-event-grid-vs-event-hubs.md): One is a doorbell. The other is a tape you can rewind. (10 steps, ~32s — page: https://blog.msdevbuild.com/shorts/azure-event-grid-vs-event-hubs/)
- [One order. Four teams need to know.](https://blog.msdevbuild.com/shorts/azure-event-grid-order-placed.md): Why the fourth subscriber is the only argument for Event Grid that matters. (10 steps, ~32s — page: https://blog.msdevbuild.com/shorts/azure-event-grid-order-placed/)
- [The queue drained. Nothing was consuming it.](https://blog.msdevbuild.com/shorts/azure-dead-letter-incident.md): One Service Bus default, six hours, and 4,318 orders that never existed. (10 steps, ~32s — page: https://blog.msdevbuild.com/shorts/azure-dead-letter-incident/)

## Optional

- [RSS feed](https://blog.msdevbuild.com/rss.xml): machine-readable index of all posts
- [Sitemap](https://blog.msdevbuild.com/sitemap-index.xml): every indexable URL
- [About the author](https://blog.msdevbuild.com/about): credentials and profile links