11 Years in Tech | Backend | System Design | AI Building https://xitter.cf/t.co/YyyZZNpQyL DM For Collab & workđ©
Joined February 2026
- Tweets16.2K
- Following814
- Followers3K
- Likes16.8K
Pinned Tweet
Tech Lead says:
Never use boolean flags in your database.
Junior dev: But isActive, isDeleted, isPaid is so simple.
Tech Lead: What happens when business logic needs a third state?
Junior dev: đ¶
Do you know what the Tech Lead meant? đ€
Vikash Singh Tomar retweeted
Product exists -> 200 OK.
Product doesnât exist -> 200 OK, body: null.
Frontend shows a blank page.
Monitoring says everything is healthy.
Nobody gets an alert.
Same endpoint. Same code.
Zero errors anywhere.
Whatâs wrong? đ€
Product exists -> 200 OK.
Product doesnât exist -> 200 OK, body: null.
Frontend shows a blank page.
Monitoring says everything is healthy.
Nobody gets an alert.
Same endpoint. Same code.
Zero errors anywhere.
Whatâs wrong? đ€
Vikash Singh Tomar retweeted
Everyoneâs building AI features.
Almost nobody is testing them.
With normal code, a test passes or fails.
With AI:
-> Same input, different output.
-> âWorksâ depends on whoâs reading it.
-> Itâs fine in the demo, wrong in production.
If you canât measure whether your AI feature got better or worse after a change, youâre not engineering it.
Youâre hoping.
Everyoneâs building AI features.
Almost nobody is testing them.
With normal code, a test passes or fails.
With AI:
-> Same input, different output.
-> âWorksâ depends on whoâs reading it.
-> Itâs fine in the demo, wrong in production.
If you canât measure whether your AI feature got better or worse after a change, youâre not engineering it.
Youâre hoping.
Vikash Singh Tomar retweeted
(1/3) - AIBEAT
An open-source framework for testing LLM security and agent behavior, with PromptBeat for adversarial testing and AgentBeat for tracing what actually happens during execution.
Vikash Singh Tomar retweeted
Backend developers donât get paid for writing code.
They get paid for what happens when the code meets reality.
Reality is:
â Users who click twice.
â Networks that drop mid-request.
â Data nobody told you could be empty.
â Traffic nobody planned for.
Anyone can write the happy path.
The job is everything else.
Backend developers donât get paid for writing code.
They get paid for what happens when the code meets reality.
Reality is:
â Users who click twice.
â Networks that drop mid-request.
â Data nobody told you could be empty.
â Traffic nobody planned for.
Anyone can write the happy path.
The job is everything else.
Vikash Singh Tomar retweeted
Same paste. Two outcomes.
Left: your API key goes straight to an AI tool.
Right: SecureIntent catches it before you hit send.
On-device detection. Chrome & Firefox. Free to start.
Which developer are you? đ
secureintent.ai
Vikash Singh Tomar retweeted
Me: let's build an AI agent to save 10 hours a week
The agent: reads .env, prints my API key, pushes it to logs
Me: spends 12 hours rotating credentials and investigating the incident
AI is incredible đ
Vikash Singh Tomar retweeted
Your Tech Lead says:
We don't need Redis. The database can handle the traffic.
What's your response? đ
Your Tech Lead says:
We don't need Redis. The database can handle the traffic.
What's your response? đ
Vikash Singh Tomar retweeted
Junior dev: "I'll just quickly fix this bug."
3 hours later
git commit -m "fix"
git commit -m "fix again"
git commit -m "actually fixed"
git commit -m "ok NOW it's fixed"
git commit -m "please work"
git commit -m "I give up"
git commit -m "found it, it was a typo"
The bug: usre.name instead of user.name.
Seven commits. One missing letter. đ
Junior dev: "I'll just quickly fix this bug."
3 hours later
git commit -m "fix"
git commit -m "fix again"
git commit -m "actually fixed"
git commit -m "ok NOW it's fixed"
git commit -m "please work"
git commit -m "I give up"
git commit -m "found it, it was a typo"
The bug: usre.name instead of user.name.
Seven commits. One missing letter. đ
Vikash Singh Tomar retweeted
Your environment variables are encrypted.
Your deployment platform gets compromised.
Some secrets may still be exposed.
Railway's latest security incident is a reminder:
Encryption matters. But credential security doesn't end there.
If you use Railway, rotate your secrets and review your API usage.
Don't wait for an unexpected bill to find out your key was exposed.
Official source: blog.railway.com/p/security-âŠ
