Series

Taking .NET Minimal APIs from a single-file demo to a maintainable, secured, observable production service.

1. 1.
   Structuring a .NET Minimal API Project That Survives Growth

   Program.cs stops scaling around twenty endpoints. Here is a vertical-slice layout for Minimal APIs that keeps routing, validation and handlers organised.

2. 2.
   How to Secure a .NET Minimal API with JWT Bearer Authentication

   A working JWT bearer auth setup for ASP.NET Core Minimal APIs — token validation, role policies, and the config mistakes that silently disable security.

Giving AI coding agents the context they need: custom instructions, AGENTS.md, Copilot Skills, hooks, code review, and the token budget behind it all.

1. 1.
   What Is GitHub Copilot Custom Instructions? (And Why Your Project Needs One)

   GitHub Copilot custom instructions explained with a real Flutter app you can clone: what the file is, why every project needs one, and beginner mistakes.

2. 2.
   AGENTS.md in 2026: The Pain Points It Removes and the Workload It Saves

   AI agents write more code each month than teams can review by hand. AGENTS.md is the one file that keeps it consistent: solo, team or enterprise.

3. 3.
   The Complete AGENTS.md Playbook: Build AI Coding Agents That Work Like Your Best Engineer

   What belongs in an AGENTS.md file (architecture, security, testing, AI rules), plus what to leave out, common mistakes and a reusable template.

4. 4.
   GitHub Copilot Skills Deep Dive: The Missing Layer Between Prompts, Instructions, and Agents

   GitHub Copilot Skills explained by an architect: what they are, how they differ from prompts and instructions, and how to build reusable Skills for teams.

5. 5.
   Building Your First GitHub Copilot Skill: A .NET Clean Architecture SKILL.md, Start to Finish

   A build-along for .NET developers: create one GitHub Copilot Skill (SKILL.md) that enforces Clean Architecture, CQRS and your API contract.

6. 6.
   Building a Flutter Copilot Skill: Clean Architecture with BLoC and Firebase, Start to Finish

   Build one GitHub Copilot Skill (SKILL.md) so Copilot writes Flutter the way your app does: layered folders, BLoC state, Firebase behind a repository.

7. 7.
   Building an Azure Copilot Skill: Secure, Cost-Aware Cloud Baselines with Bicep, Start to Finish

   Build one GitHub Copilot Skill (SKILL.md) that guards your Azure Bicep: Managed Identity, private networking and cost tiers Copilot will not violate.

8. 8.
   GitHub Copilot Can't Replace Your Code Reviewer: Here's What It Can Actually Automate

   A software architect on GitHub Copilot code review: build a Skill that automates the mechanical layer, and the limits that keep a human in the loop.

9. 9.
   GitHub Copilot PR Summary: How to Get Descriptions Reviewers Actually Read

   The GitHub Copilot PR summary: why an auto-generated description that restates the diff is noise, and how to get one reviewers actually read.

10. 10.
    GitHub Copilot Hooks for Beginners: Why You Need Them and What You Can Build

    A beginner GitHub Copilot Hooks tutorial: what a hook is, why an AI agent needs deterministic guardrails, and how to write your first one in ten minutes.

11. 11.
    What Is an AI Token? Why Every AI Cost Is Calculated in Them

    Tokens are not words, and they are not characters. Here is what a token really is, why AI billing counts them, and how to work out the cost of a request.

12. 12.
    400K AI Tokens a Month: My Daily GitHub Copilot Workflow That Makes the Budget Last

    A 400K monthly AI token budget sounds generous until agent mode eats it in a week. Here is the daily Copilot workflow I use to make it last the month.

13. 13.
    How to Save AI Tokens: 15 Habits That Cut My Copilot Context Waste

    Fifteen tested habits that cut monthly AI token usage without cutting how much you use AI, from context discipline to knowing when to restart a chat.

Azure AI Foundry from first principles to multi-agent: the platform, function tools in ASP.NET Core, a Flutter client, security, MCP and handoff.

1. 1.
   What Is Microsoft Foundry (Azure AI Foundry)? The Services, and When You Actually Need Them

   A plain tour of Microsoft Foundry for developers: the resource, projects, models, agents, tools, and when Azure OpenAI on its own is enough.

2. 2.
   From Search Box to AI Agent: Microsoft Foundry (Azure AI Foundry) for a Food Delivery App

   The business case for an AI agent on an app that already exists, what an agent really is, and the architecture that keeps it inside its lane.

3. 3.
   Azure AI Foundry Model Catalog: How to Choose the Right Model

   A decision framework for the Foundry model catalog: LLMs vs SLMs, chat vs reasoning models, and specialized models, with real business use cases.

A decade-old codebase nobody documented, and the AI development team that makes it safe to change: discovery, tests, security, orchestration.

1. 1.
   GitHub Copilot Agents for Legacy Applications: A Complete Guide to Building an AI-Powered Development Team

   A handbook for GitHub Copilot Agents on legacy code: what is a real feature, what is a pattern, and how to build an AI development team around it.

2. 2.
   Making GitHub Copilot Understand a Legacy Codebase Nobody Documented

   A repeatable method for legacy discovery: turning the business rules, workflows and history a codebase never documented into knowledge Copilot uses.

3. 3.
   Building a GitHub Copilot Security Agent for Legacy Systems (Honestly)

   Learn what a GitHub Copilot security agent can find in a legacy system, what it can miss, and why scanners and people must still approve changes.

A mobile app secured end to end on Azure: the key that should never ship, the layers between app and database, and what happens when you tap Sign in.

1. 1.
   The Secret in Your APK: Why Obfuscation Will Not Save It

   An APK or IPA is a zip file. Anything hardcoded inside it, including your API key, is already public — and here is how to get it off the phone for good.

2. 2.
   How Azure Protects a Mobile App: The Full Request Flow, Layer by Layer

   Front Door, your API, Microsoft Entra ID, authorization and a private database — the five layers that stand between a mobile app and its data on Azure.

3. 3.
   Hardcoded API Key Blast Radius: What Happens When a Mobile Key Leaks

   The attacker costs you hours. Rotating a key baked into 40,000 installed apps costs you days, and that gap is the real price of a hardcoded secret.

4. 4.
   Hacker vs Azure Defences: Five Attacks on a Mobile Backend, Five Controls

   Five common attacks on one Azure mobile backend and the control that stops each: WAF, Entra ID, an owner check, Key Vault and a private endpoint.

5. 5.
   Five Mobile App Security Vulnerabilities a Scan Finds, and Which to Fix First

   Five findings on a working mobile app, none deliberate: a secret in the package, a token in plain storage, an open endpoint, TLS off, extra permissions.

6. 6.
   How to Secure a Mobile API on Azure in Five Steps, in the Right Order

   HTTPS only, authentication, authorization, secrets and monitoring: five steps to secure a mobile API on Azure, and why the order carries most of the value.

7. 7.
   Azure Key Vault Explained: The One Secret Tutorials Never Remove

   Moving every secret into Key Vault leaves exactly one behind: the credential that opens the vault. A managed identity is what removes it.

8. 8.
   AI Bot Attacks on a Mobile App Login, and How Azure Stops Them

   A script tries 8,000 passwords a minute against your login API at 3am. Rate limiting, smart lockout and Defender for Cloud make speed the losing move.

System design on Azure, one real-world problem at a time: what broke or what had to be built, the query or trade-off that decided it, and the design that held.

1. 1.
   Browsing Without a Login Was the Requirement: How to Secure a Public API on Azure

   Browsing products without login was a real requirement. Trusting requests because they came from our own app was the bug, and curl does not care.

2. 2.
   The Flash Sale That Hit the Database: When to Use Azure Managed Redis

   When to use Azure Managed Redis, which replaces Azure Cache for Redis, learned from a flash sale that hit Azure SQL 2,200 times a second.

3. 3.
   The Flash Sale That Ran Out of Bandwidth: When to Use a CDN on Azure

   When to use a CDN on Azure, from a flash sale where one App Service served 1.6 million photo downloads. What to cache, and what never to.

4. 6.
   Paid, Then Sold Out: How Hotel Booking Confirmation Really Works

   How hotel booking confirmation works after payment: authorize, book with the supplier, then capture, and what happens if another site sells the room first.