https://devshakibio.web.app/blog Practical engineering writing on Flutter, Firebase, Dart, Cloud, DevOps and AI by K M Shahriar Hossain (devShakib). en devshakib015@gmail.com (K M Shahriar Hossain) devshakib015@gmail.com (K M Shahriar Hossain) Sun, 23 Aug 2026 15:26:02 +0000 https://devshakibio.web.app/icons/og-image.png https://devshakibio.web.app/blog https://devshakibio.web.app/blog/free-tools-as-a-growth-engine-what-98-browser-tools-taught-me-about-distribution https://devshakibio.web.app/blog/free-tools-as-a-growth-engine-what-98-browser-tools-taught-me-about-distribution K M Shahriar Hossain Startup Sun, 23 Aug 2026 15:26:02 +0000 What building 98 free browser tools and 32 games taught me about distribution: search-intent magnets, zero marginal cost, and the power law nobody mentions. https://devshakibio.web.app/blog/reviewing-ai-written-code-what-a-cto-actually-checks-in-a-generated-diff https://devshakibio.web.app/blog/reviewing-ai-written-code-what-a-cto-actually-checks-in-a-generated-diff K M Shahriar Hossain Leadership Fri, 21 Aug 2026 10:21:27 +0000 How I review AI-generated code as a CTO: the failure modes unique to it, why a clean analyzer proves nothing, adversarial verification, and who owns the bug. https://devshakibio.web.app/blog/firestore-security-rules-deny-by-default-then-open-the-narrowest-hole https://devshakibio.web.app/blog/firestore-security-rules-deny-by-default-then-open-the-narrowest-hole K M Shahriar Hossain Security Wed, 19 Aug 2026 10:31:37 +0000 The Firestore and Storage rules I actually ship, line by line: admin email claims, published-only reads, field whitelists, and the list denial that looks like a bug. https://devshakibio.web.app/blog/dart-records-and-pattern-matching-in-production-where-they-earn-their-keep https://devshakibio.web.app/blog/dart-records-and-pattern-matching-in-production-where-they-earn-their-keep K M Shahriar Hossain Dart Sun, 16 Aug 2026 15:06:42 +0000 Three years of shipping Dart 3 records and patterns: where they genuinely help, why positional fields turn into a trap, and why sealed classes are the real win. https://devshakibio.web.app/blog/shipping-a-macos-app-outside-the-app-store-code-signing-notarization-gatekeeper https://devshakibio.web.app/blog/shipping-a-macos-app-outside-the-app-store-code-signing-notarization-gatekeeper K M Shahriar Hossain DevOps Wed, 12 Aug 2026 12:03:21 +0000 Why your .dmg tells users the app is damaged, and the exact codesign, notarytool and stapler commands that make a macOS build open on a stranger's Mac. https://devshakibio.web.app/blog/registry-driven-feature-modules-flutter-130-features-one-parametric-route https://devshakibio.web.app/blog/registry-driven-feature-modules-flutter-130-features-one-parametric-route K M Shahriar Hossain Architecture Sun, 09 Aug 2026 10:41:47 +0000 How I keep 98 tools and 32 games in one Flutter app: metadata in a plain const list, builders in a deferred registry map, one parametric route, one test. https://devshakibio.web.app/blog/firestore-data-modelling-for-read-heavy-sites-denormalisation-projections-and-indexes https://devshakibio.web.app/blog/firestore-data-modelling-for-read-heavy-sites-denormalisation-projections-and-indexes K M Shahriar Hossain Firebase Fri, 07 Aug 2026 13:34:58 +0000 Firestore schema design for content-driven sites: denormalise for reads, slug as document ID, field projections when a listing blows the 2MB response cap. https://devshakibio.web.app/blog/flutter-web-seo-crawlable-content-json-ld-and-share-cards-for-a-canvas-app https://devshakibio.web.app/blog/flutter-web-seo-crawlable-content-json-ld-and-share-cards-for-a-canvas-app K M Shahriar Hossain Web Wed, 05 Aug 2026 11:22:34 +0000 Flutter web paints to a canvas, so crawlers get an empty DOM. The crawlable article body, JSON-LD @graph, generated OG cards and honest sitemap that fixed it. https://devshakibio.web.app/blog/114-blog-posts-ten-months-engineering-career-retrospective https://devshakibio.web.app/blog/114-blog-posts-ten-months-engineering-career-retrospective K M Shahriar Hossain Career Sun, 02 Aug 2026 17:18:06 +0000 An honest retrospective on 114 technical posts in ten months: the compounding retrieval effect, the cadence that survived, and the traffic that never arrived. https://devshakibio.web.app/blog/multi-agent-ai-workflows-32-browser-games-kit-contract-adversarial-qa https://devshakibio.web.app/blog/multi-agent-ai-workflows-32-browser-games-kit-contract-adversarial-qa K M Shahriar Hossain AI Wed, 29 Jul 2026 13:44:08 +0000 How I shipped 32 browser games with one AI agent per game against a shared kit contract, an adversarial QA pass, and the prompt fix that killed high bugs. https://devshakibio.web.app/blog/flutter-web-feels-laggy-when-the-metrics-look-fine-five-fixes-that-worked https://devshakibio.web.app/blog/flutter-web-feels-laggy-when-the-metrics-look-fine-five-fixes-that-worked K M Shahriar Hossain Performance Sun, 26 Jul 2026 13:34:58 +0000 Good Lighthouse scores, syrupy scrolling. The five fixes that killed jank in my Flutter web app: BackdropFilter, fonts, a 1.9MB bundle, images, rebuild storms. https://devshakibio.web.app/blog/how-i-run-114-posts-98-tools-and-32-games-on-firebase-blaze-for-zero-a-month https://devshakibio.web.app/blog/how-i-run-114-posts-98-tools-and-32-games-on-firebase-blaze-for-zero-a-month K M Shahriar Hossain Firebase Wed, 22 Jul 2026 17:48:36 +0000 114 posts, 98 tools and 32 games on Firebase Blaze, billed at $0.00 a month. The exact rules: no Cloud Functions, no binaries in Storage, no per-play writes. https://devshakibio.web.app/blog/canvaskit-layout-traps-the-unbounded-constraint-bug-that-only-blanks-release-builds https://devshakibio.web.app/blog/canvaskit-layout-traps-the-unbounded-constraint-bug-that-only-blanks-release-builds K M Shahriar Hossain Flutter Sun, 19 Jul 2026 16:57:39 +0000 A roulette board rendered blank in production while flutter analyze stayed green. The CanvasKit unbounded-constraint trap, why release hides it, and how to catch it. https://devshakibio.web.app/blog/deferred-imports-in-dart-code-splitting-that-actually-splits https://devshakibio.web.app/blog/deferred-imports-in-dart-code-splitting-that-actually-splits K M Shahriar Hossain Dart Wed, 15 Jul 2026 14:45:15 +0000 Dart deferred imports compile fine and often split nothing. The eager-import rule, loadLibrary retries, a flash-free DeferredPage, and verifying from build output. https://devshakibio.web.app/blog/self-hosting-fonts-in-flutter-web-dropping-the-google-fonts-package https://devshakibio.web.app/blog/self-hosting-fonts-in-flutter-web-dropping-the-google-fonts-package K M Shahriar Hossain Web Sun, 12 Jul 2026 15:56:32 +0000 Self-host Inter, Space Grotesk and JetBrains Mono in Flutter web: the fonttools subsetting pipeline, the variable-font axis trap, and why ttf beats woff2 here. https://devshakibio.web.app/blog/flutter-web-code-splitting-with-deferred-imports-and-parametric-routes https://devshakibio.web.app/blog/flutter-web-code-splitting-with-deferred-imports-and-parametric-routes K M Shahriar Hossain Performance Thu, 09 Jul 2026 11:42:54 +0000 How I moved 98 Flutter tools and 32 games out of main.dart.js with deferred imports and one parametric route: 1.92MB to 1.08MB brotli, and what stayed put. https://devshakibio.web.app/blog/offline-first-without-corruption-outboxes-idempotency-and-conflict-resolution-that-actuall https://devshakibio.web.app/blog/offline-first-without-corruption-outboxes-idempotency-and-conflict-resolution-that-actuall K M Shahriar Hossain Architecture Mon, 06 Jul 2026 11:35:15 +0000 Build offline-first Flutter apps without data corruption: durable outbox pattern, idempotency keys, optimistic concurrency version checks, and safe conflict resolution. https://devshakibio.web.app/blog/you-are-the-architecture-system-design-when-the-team-is-just-you https://devshakibio.web.app/blog/you-are-the-architecture-system-design-when-the-team-is-just-you K M Shahriar Hossain Architecture Sat, 27 Jun 2026 10:06:00 +0000 Solo system design for one-person teams: minimize operational load, pick boring tech, buy before you build, and design failures to degrade instead of cascade. https://devshakibio.web.app/blog/shipping-ai-features-in-flutter-without-setting-your-api-bill-or-your-keys-on-fire https://devshakibio.web.app/blog/shipping-ai-features-in-flutter-without-setting-your-api-bill-or-your-keys-on-fire K M Shahriar Hossain AI Fri, 26 Jun 2026 10:10:00 +0000 Ship LLM features in Flutter without leaking API keys or blowing your bill: a thin backend proxy, token streaming, secure tool-use, and prompt caching that cuts cost. https://devshakibio.web.app/blog/motion-is-a-language-and-most-apps-are-mumbling https://devshakibio.web.app/blog/motion-is-a-language-and-most-apps-are-mumbling K M Shahriar Hossain Design Thu, 25 Jun 2026 09:35:00 +0000 Motion design is a communication channel, not decoration. Learn the three questions every UI animation must answer, easing curves vs spring physics, and Flutter motion patterns. https://devshakibio.web.app/blog/how-i-close-the-gap-between-a-figma-file-and-what-actually-ships https://devshakibio.web.app/blog/how-i-close-the-gap-between-a-figma-file-and-what-actually-ships K M Shahriar Hossain Design Mon, 22 Jun 2026 17:15:00 +0000 A practical Figma-to-Flutter design handoff system: read files as specs, map auto-layout to flexbox, sync design tokens, and use golden tests to kill UI drift. https://devshakibio.web.app/blog/choosing-state-management-for-a-large-flutter-app-in-2026-my-pragmatic-take https://devshakibio.web.app/blog/choosing-state-management-for-a-large-flutter-app-in-2026-my-pragmatic-take K M Shahriar Hossain Flutter Fri, 19 Jun 2026 09:56:00 +0000 Flutter state management for large apps in 2026: Riverpod vs Bloc vs Provider vs signals, with real decision criteria, code, and testing tradeoffs. https://devshakibio.web.app/blog/building-a-scalable-design-system-in-flutter-that-survives-growth https://devshakibio.web.app/blog/building-a-scalable-design-system-in-flutter-that-survives-growth K M Shahriar Hossain Design Thu, 18 Jun 2026 01:51:00 +0000 Build a scalable Flutter design system with semantic design tokens, ThemeExtension theming, intent-based component APIs, and lint rules that stop UI drift as teams grow. https://devshakibio.web.app/blog/my-knowledge-diary-is-a-system-not-a-habit https://devshakibio.web.app/blog/my-knowledge-diary-is-a-system-not-a-habit K M Shahriar Hossain Career Mon, 15 Jun 2026 12:25:00 +0000 A knowledge diary that compounds runs on a capture-to-publish pipeline, not willpower. Here's the exact system that turns raw dev notes into published atoms. https://devshakibio.web.app/blog/serverless-vs-containers-with-the-marketing-removed https://devshakibio.web.app/blog/serverless-vs-containers-with-the-marketing-removed K M Shahriar Hossain DevOps Sun, 14 Jun 2026 15:50:00 +0000 Serverless vs. containers without the hype: cold starts, cost curves, Kubernetes operational overhead, lock-in, and a five-question decision tree for small teams. https://devshakibio.web.app/blog/flutter-on-the-web-in-2026-wasm-canvaskit-seo-and-when-to-actually-ship-it https://devshakibio.web.app/blog/flutter-on-the-web-in-2026-wasm-canvaskit-seo-and-when-to-actually-ship-it K M Shahriar Hossain Web Fri, 12 Jun 2026 09:19:00 +0000 Flutter web in 2026: WASM vs CanvasKit renderers, why canvas apps break SEO and link previews, and a decision checklist for when to actually ship Flutter web. https://devshakibio.web.app/blog/my-first-90-days-as-cto-were-mostly-deleting-things https://devshakibio.web.app/blog/my-first-90-days-as-cto-were-mostly-deleting-things K M Shahriar Hossain Startup Tue, 09 Jun 2026 15:30:00 +0000 A new CTO's first 90 days: why subtraction beats a week-one roadmap. Delete inherited complexity, freeze the critical system, and rebuild team trust. https://devshakibio.web.app/blog/treating-prompt-injection-like-the-sql-injection-of-this-decade https://devshakibio.web.app/blog/treating-prompt-injection-like-the-sql-injection-of-this-decade K M Shahriar Hossain AI Mon, 08 Jun 2026 18:21:00 +0000 Prompt injection is the SQL injection of the LLM era. A practical guide to threat modeling, least-privilege tools, content isolation, allowlists, and defense in depth. https://devshakibio.web.app/blog/dart-3-in-practice-records-patterns-and-sealed-classes-that-actually-pay-off https://devshakibio.web.app/blog/dart-3-in-practice-records-patterns-and-sealed-classes-that-actually-pay-off K M Shahriar Hossain Dart Sun, 07 Jun 2026 22:58:00 +0000 Dart 3 records, pattern matching, and sealed classes in production Flutter: real before/after refactors, exhaustive switches, if-case JSON parsing, and when to stop. https://devshakibio.web.app/blog/core-web-vitals-for-canvaskit-flutter-web-what-you-can-actually-move https://devshakibio.web.app/blog/core-web-vitals-for-canvaskit-flutter-web-what-you-can-actually-move K M Shahriar Hossain Performance Fri, 05 Jun 2026 15:01:00 +0000 Core Web Vitals for CanvasKit Flutter Web are broken by design. Learn why LCP, CLS and INP mislead, and exactly which loading, layout and frame levers you can move. https://devshakibio.web.app/blog/by-2050-nobody-writes-code-but-somebody-still-has-to-be-right https://devshakibio.web.app/blog/by-2050-nobody-writes-code-but-somebody-still-has-to-be-right K M Shahriar Hossain Future Wed, 03 Jun 2026 20:56:00 +0000 By 2050 AI writes the code and verification becomes the job. Why specs, invariants, and telling correct from plausible are the engineering skills that survive. https://devshakibio.web.app/blog/rotate-keys-without-the-2-a-m-outage https://devshakibio.web.app/blog/rotate-keys-without-the-2-a-m-outage K M Shahriar Hossain Security Tue, 02 Jun 2026 15:48:57 +0000 Rotate secrets without downtime: use short-lived identity-based credentials, a TTL-cached secret accessor, and an additive overlap-window runbook for GCP and AWS. https://devshakibio.web.app/blog/keeping-a-human-in-the-loop-without-making-them-the-bottleneck https://devshakibio.web.app/blog/keeping-a-human-in-the-loop-without-making-them-the-bottleneck K M Shahriar Hossain AI Mon, 01 Jun 2026 14:08:00 +0000 Human-in-the-loop AI done right: route by reversibility and blast radius, build real confidence signals, design review UIs that stop rubber-stamping. https://devshakibio.web.app/blog/modern-flutter-for-production-what-i-actually-reach-for-and-what-i-skip https://devshakibio.web.app/blog/modern-flutter-for-production-what-i-actually-reach-for-and-what-i-skip K M Shahriar Hossain Flutter Sun, 31 May 2026 04:44:00 +0000 Modern Flutter for production: a field guide to Impeller rendering, adaptive UI with LayoutBuilder, DevTools profiling, and the packages I reach for vs. skip. https://devshakibio.web.app/blog/flutter-performance-in-practice-impeller-jank-hunting-and-hitting-120fps https://devshakibio.web.app/blog/flutter-performance-in-practice-impeller-jank-hunting-and-hitting-120fps K M Shahriar Hossain Performance Sat, 30 May 2026 07:51:00 +0000 Flutter performance guide: profile jank in DevTools, read UI vs raster threads, tame Impeller, cut rebuilds, optimize lists and images, and reliably hit 120fps. https://devshakibio.web.app/blog/the-three-screens-that-decide-trust-empty-loading-error https://devshakibio.web.app/blog/the-three-screens-that-decide-trust-empty-loading-error K M Shahriar Hossain Design Fri, 29 May 2026 20:08:20 +0000 Empty, loading, and error states decide whether users trust your app. Learn to design UI states first with Dart sealed classes, skeleton screens, and retry-safe error handling. https://devshakibio.web.app/blog/the-1-1-is-not-a-status-meeting-and-treating-it-like-one-wastes-both-of-you https://devshakibio.web.app/blog/the-1-1-is-not-a-status-meeting-and-treating-it-like-one-wastes-both-of-you K M Shahriar Hossain Leadership Thu, 28 May 2026 10:56:00 +0000 How to run 1:1 meetings that build trust and retain engineers instead of wasting them on status updates: agenda ownership, hard feedback, career growth, follow-through. https://devshakibio.web.app/blog/the-security-work-that-actually-matters-when-you-re-a-team-of-three https://devshakibio.web.app/blog/the-security-work-that-actually-matters-when-you-re-a-team-of-three K M Shahriar Hossain Security Wed, 27 May 2026 20:30:00 +0000 Startup security for a team of three: the 5 controls that actually stop breaches — MFA, secret scanning, Firebase rules, least-privilege, tested backups. Skip the theater. https://devshakibio.web.app/blog/what-actually-shrinks-a-flutter-app-split-per-abi-deferred-components-and-reading-the-size https://devshakibio.web.app/blog/what-actually-shrinks-a-flutter-app-split-per-abi-deferred-components-and-reading-the-size K M Shahriar Hossain Flutter Tue, 26 May 2026 11:34:01 +0000 Reduce Flutter app size for real: App Bundles, split-per-ABI, icon tree-shaking, deferred components, and reading the DevTools size report to measure every megabyte. https://devshakibio.web.app/blog/a-free-practical-cicd-pipeline-for-flutter-web-on-firebase-hosting https://devshakibio.web.app/blog/a-free-practical-cicd-pipeline-for-flutter-web-on-firebase-hosting K M Shahriar Hossain DevOps Mon, 25 May 2026 09:11:00 +0000 Build a free Flutter web CI/CD pipeline with GitHub Actions and Firebase Hosting: per-PR preview URLs, service-account auth, aggressive caching, $0/month deploys. https://devshakibio.web.app/blog/the-engineering-strategy-doc-that-ends-in-decisions-not-a-wiki-graveyard https://devshakibio.web.app/blog/the-engineering-strategy-doc-that-ends-in-decisions-not-a-wiki-graveyard K M Shahriar Hossain Leadership Sat, 23 May 2026 22:21:19 +0000 A CTO's template for engineering strategy docs that force real decisions instead of dying in a wiki. Use tradeoffs, owners, and revisit conditions that stick. https://devshakibio.web.app/blog/running-a-remote-team-across-five-time-zones-without-losing-the-thread https://devshakibio.web.app/blog/running-a-remote-team-across-five-time-zones-without-losing-the-thread K M Shahriar Hossain Leadership Thu, 21 May 2026 17:39:00 +0000 Run a distributed engineering team across time zones with async-first defaults, ruthless overlap hours, engineered handoffs, and accountability that measures work. https://devshakibio.web.app/blog/what-leading-engineering-teams-taught-me-about-senior-engineers https://devshakibio.web.app/blog/what-leading-engineering-teams-taught-me-about-senior-engineers K M Shahriar Hossain Career Wed, 20 May 2026 02:00:00 +0000 Senior software engineers aren't defined by coding speed but by judgment under ambiguity. A CTO's lessons on hiring, mentoring, technical vision, and code review. https://devshakibio.web.app/blog/build-flavors-done-right-before-the-third-environment-bites-you https://devshakibio.web.app/blog/build-flavors-done-right-before-the-third-environment-bites-you K M Shahriar Hossain Flutter Tue, 19 May 2026 13:46:00 +0000 Flutter build flavors done right: compile-time environment config with dart-define-from-file, Android product flavors, iOS schemes, per-flavor Firebase, and CI. https://devshakibio.web.app/blog/shipping-to-everyone-at-once-is-a-choice-and-usually-the-wrong-one https://devshakibio.web.app/blog/shipping-to-everyone-at-once-is-a-choice-and-usually-the-wrong-one K M Shahriar Hossain DevOps Sun, 17 May 2026 16:38:00 +0000 Feature flags separate deploy from release: ramp progressive rollouts by percentage, gate on metrics, and roll back in seconds with a kill switch, no redeploy. https://devshakibio.web.app/blog/forms-at-scale-in-flutter-without-a-form-package https://devshakibio.web.app/blog/forms-at-scale-in-flutter-without-a-form-package K M Shahriar Hossain Flutter Fri, 15 May 2026 11:28:26 +0000 Build large, scalable Flutter forms without a form package. Master Form, FormField, validators, async validation, focus traversal and submission state in pure Dart. https://devshakibio.web.app/blog/event-driven-architecture-without-the-kafka-cargo-cult https://devshakibio.web.app/blog/event-driven-architecture-without-the-kafka-cargo-cult K M Shahriar Hossain Architecture Thu, 14 May 2026 17:58:00 +0000 Event-driven architecture without Kafka: use the transactional outbox pattern with a Postgres or Firestore table, idempotency keys, and a worker to decouple your backend. https://devshakibio.web.app/blog/bridging-swift-and-kotlin-with-pigeon-type-safe-flutter-plugins-done-right https://devshakibio.web.app/blog/bridging-swift-and-kotlin-with-pigeon-type-safe-flutter-plugins-done-right K M Shahriar Hossain Flutter Tue, 12 May 2026 09:14:00 +0000 Pigeon generates type-safe Flutter platform channels across Dart, Swift, and Kotlin — killing MethodChannel runtime crashes. Learn setup, HostApi vs FlutterApi, and facade architecture. https://devshakibio.web.app/blog/agentic-coding-changed-my-workflow-how-i-actually-use-ai-coding-agents-day-to-day https://devshakibio.web.app/blog/agentic-coding-changed-my-workflow-how-i-actually-use-ai-coding-agents-day-to-day K M Shahriar Hossain AI Mon, 11 May 2026 00:45:00 +0000 How I actually use AI coding agents day to day as a Flutter dev: plan-first prompts, migrations, agent code review, guardrails, CLAUDE.md, and honest productivity gains. https://devshakibio.web.app/blog/firestore-security-rules-deserve-unit-tests-not-hope https://devshakibio.web.app/blog/firestore-security-rules-deserve-unit-tests-not-hope K M Shahriar Hossain Firebase Sun, 10 May 2026 10:49:51 +0000 Test Firestore security rules like real code with the Firebase Emulator Suite, @firebase/rules-unit-testing, assertSucceeds/assertFails cases, and CI gating.