Money Debited, Order Failed: Payment Webhooks and Reconciliation on Azure
Payment succeeded but the order was not created? Save the webhook first, process it from Service Bus, and reconcile with the gateway on a timer.
views
#Azure
20 articles
One Hotel, Three Suppliers, Three JSON Shapes: Hotel Aggregator System Design
How a hotel aggregator integrates Expedia, Booking.com, Agoda and Trip.com when each returns different JSON: adapters, one model, hotel mapping.
views
The Blast Radius of a Hardcoded API Key in a Mobile App
The attacker costs you hours. Rotating a key baked into 40,000 installed apps costs you days — and that gap is the real price of a hardcoded secret.
views
The Double Tap That Charged Twice: Idempotency Keys and Azure SQL
How to prevent duplicate orders when a user double-clicks Place order: an idempotency key from the app and a unique index in Azure SQL.
views
Hacker vs Azure: Five Attacks and the Five Defences That Stop Them
Five real attacks on a mobile backend, matched one-for-one to the Azure service that stops each — and the default setting that quietly undoes the last one.
views
Five Mobile App Security Vulnerabilities a Scan Finds — and Nobody Chose
A security scan on a perfectly working mobile app turns up five findings. Every one is a default or a testing leftover, not a mistake — here is the fix for each.
views
Secure a Mobile API in Five Steps: The Order Is the Whole Point
HTTPS, authentication, authorization, secrets, then monitoring — five layers for a mobile API on Azure, and why doing them out of order defeats the point.
views
Azure Key Vault Explained: The One Secret Tutorials Never Remove
Moving every secret into Key Vault leaves exactly one behind — the credential that opens the vault. A managed identity is what finally gets you to zero.
views
Bot Attacks on a Mobile App: A Script Is Hitting Your Login Endpoint
A script tries 8,000 passwords a minute against your login API at 3am. Rate limiting, smart lockout and Defender for Cloud make speed the losing move.
views
Insecure vs Secure: The Same Mobile App, Two Azure Architectures
Both architectures work perfectly for a real customer. They only differ at six moments — and one of the two designs cannot be patched, only rebuilt.
views
The Secure Login Journey: What Happens When You Tap Sign In
A secure app never touches your password. It hands you to Microsoft Entra ID, gets back a signed token, and that token is all your API ever sees.
views
Paid, Then Sold Out: How Hotel Booking Confirmation Really Works
How hotel booking confirmation works after payment: authorize, book with the supplier, then capture, and what happens if another site sells the room first.
views
The Flash Sale That Ran Out of Bandwidth: When to Use a CDN on Azure
When to use a CDN on Azure, from a flash sale where one App Service served 1.6 million photo downloads. What to cache, and what never to.
views
The Flash Sale That Hit the Database: When to Use Azure Managed Redis
When to use Azure Managed Redis, which replaces Azure Cache for Redis, learned from a flash sale that hit Azure SQL 2,200 times a second.
views
Browsing Without a Login Was the Requirement: How to Secure a Public API on Azure
Browsing products without login was a real requirement. Trusting requests because they came from our own app was the bug, and curl does not care.
views
The Secret in Your APK: Why Obfuscation Will Not Save It
An APK or IPA is a zip file. Anything hardcoded inside it, including your API key, is already public — and here is how to get it off the phone for good.
views
How Azure Protects a Mobile App: The Full Request Flow, Layer by Layer
Front Door, your API, Microsoft Entra ID, authorization and a private database — the five layers that stand between a mobile app and its data on Azure.
views
GitHub Copilot Agents for Legacy Applications: A Complete Guide to Building an AI-Powered Development Team
A handbook for GitHub Copilot Agents on legacy code: what is a real feature, what is a pattern, and how to build an AI development team around it.
views
Building an Azure Copilot Skill: Secure, Cost-Aware Cloud Baselines with Bicep, Start to Finish
Build one GitHub Copilot Skill (SKILL.md) that guards your Azure Bicep: Managed Identity, private networking and cost tiers Copilot will not violate.
Updated views
GitHub Copilot Skills Deep Dive: The Missing Layer Between Prompts, Instructions, and Agents
GitHub Copilot Skills explained by an architect: what they are, how they differ from prompts and instructions, and how to build reusable Skills for teams.
Updated views
Get new posts by email
New technical articles, Azure AI and GitHub Copilot updates, and upcoming events. No spam, unsubscribe anytime.