Building in public
Engineering notes
What we learn while building Lima: the bugs that made it to production, the fixes that stuck, and the decisions behind them.
integrationsbackend
Google OAuth Testing Mode: A Silent Token Expiry Bomb
How a Google integration silently flipped to EXPIRED with no error, leading to a database archaeology session. The fix involved logging the real cause.
· 5 min read
backendsecurity
Debugging the LGPD Export: From Opaque 409 to Clear Retry-After
Users reported LGPD data exports 'never arriving'. The culprit: an invisible one-hour cooldown, hidden behind an uninformative 409 error. We fixed it with clear 429 responses.
· 5 min read
testingbackend
How a Missing Plugin Silenced Our Pitest Gate for Months
Our weekly Pitest gate reported 0% for months, never running a single test. The fix exposed 40% mutation coverage and led to a targeted hardening effort.
· 5 min read
backendpostgres
When a Legacy TEXT Array Broke the Admin Dashboard
The entire Lima admin dashboard returned 500 errors because a pre-rebrand TEXT[] column storing dates was compared against timestamps, causing a query to fail.
· 5 min read
aiprocess
MoWave One: When AI Audit Agents Hit the Session Limit
Our multi-agent security audit for Lima hit a session rate limit, returning empty. We detail the fallback strategy and the importance of transparent coverage.
· 5 min read
backendaudit
MoWave One Audit: Unused FeatureGate.EXTERNAL_EVENTS_ACTIVE
An audit revealed FeatureGate.EXTERNAL_EVENTS_ACTIVE, a declared plan-limit gate with zero call sites, meaning its cap on Google Calendar events was never enforced.
· 5 min read
securitypostgres
Postgres RLS: Why 'Enabled, No Policy' is Deny-All for Backend Tables
We fixed a Supabase security flag by enabling RLS with no policies on backend-only tables. This secures sensitive data while maintaining backend access for Lima.
· 5 min read
growthbuild in public
How Lima reached 25,000 users without a marketing budget
No paid ads, no PR agency, no influencer deals. Lima grew to 25k active users entirely through organic channels, starting in the Spring Boot community and spreading from there.
· 7 min read
mobileflutter
Flutter or React Native: what we use and why
We build Lima in Flutter. Not because React Native is bad. The new architecture fixed most of what was wrong with it. Here's the actual reasoning behind the choice.
· 6 min read
backendperformance
Lima's Deep ETag Fix: Bypassing Envelope Timestamps for HTTP Caching
A response envelope timestamp was silently busting every ETag on Lima's hot endpoints. Here's the deep ETag approach that fixed it.
· 5 min read
whatsappbackend
The Brazilian ninth digit: how WhatsApp silently breaks your phone matching
Brazilian mobile numbers gained a ninth digit years ago, but WhatsApp still identifies many users by the old eight-digit form. If you match users by phone, this will bite you.
· 5 min read