Gaurav Lodhi

Engineer who cares about the why, questions the what, figures out the how — builds, breaks, fixes, and learns.

[Gaurav Lodhi @WizardDev_10]

@ishita_here_ Interested [email protected] please send link

[Gaurav Lodhi @WizardDev_10]

@jarvisdotai I am backend developer with experience in kafka, auth, redis, queues and much more
And also build ci/cd pipeline in GitHub actions with all security and code quality check and auto roll back if the smoke test fails
https://t.co/rWtJwLf7IA

[Gaurav Lodhi @WizardDev_10]

@shashwatvalid I am available
https://t.co/bbyibG1CDx

[Gaurav Lodhi @WizardDev_10]

@mwolff Job

[Gaurav Lodhi @WizardDev_10]

Hello Ankit I am Gaurav 2025 passout from DTU and have 1+ year of experience in Backend engineering
https://t.co/0nCap4XNjx
I recently built a distributed Authentication service with event driven architecture deploy on AWS
And also create a complete Ci/CD pipeline to deploy it
With security and quality test and rollback of the smoke test failed
And it only deploy the things which changed
https://t.co/8Ig18kI7M4
This so my resume if my skills and experience match with your requirements I am happy to connect

[Gaurav Lodhi @WizardDev_10]

Hello Krishna I am Gaurav 2025 passout from DTU and have 1+ year of experience in Backend engineering
https://t.co/0nCap4XNjx
I recently built a distributed Authentication service with event driven architecture deploy on AWS
And also create a complete Ci/CD pipeline to deploy it
With security and quality test and rollback of the smoke test failed
And it only deploy the things which changed
https://t.co/8Ig18kI7M4
This so my resume if my skills and experience match with your requirements I am happy to connect

[Gaurav Lodhi @WizardDev_10]

@Bhavyaztwt hii bhavya

[Gaurav Lodhi @WizardDev_10]

@konig0000 I am interested
https://t.co/bbyibG2at5

[Gaurav Lodhi @WizardDev_10]

@AnkanXplorer Someone just forgot to put ! In if condition

[Gaurav Lodhi @WizardDev_10]

@AnkanXplorer This is nothing which I go through last night so i was applying for a job role and try to submit them got message that name cannot be a number guess what when I try with 11 it got submit
Man this was really pisses off

[Gaurav Lodhi @WizardDev_10]

@axhiii88547 The Goat Notepad++, I wrote my c++ program and did not know how to run it and googled then saved .cpp extension and run it and it gives output in terminal best feeling of that time

[Gaurav Lodhi @WizardDev_10]

@_pragmatic_dev Glad to connect

[Gaurav Lodhi @WizardDev_10]

Most developers use Claude as a chatbot.

They ask it to write a function, copy the code, paste it into their project, and hope everything works.

That's not how you get the most out of AI coding tools.

Treat Claude like a capable junior engineer working on your codebase, not a search engine that generates code.

Here's the workflow I'd follow to get significantly better results from Claude Code. 🧵

1. Stop writing vague prompts. Start writing proper engineering briefs.

Instead of saying:

"Add caching to this API."

Give Claude the actual engineering requirements:

• What problem are you trying to solve?
• Which files or modules can it modify?
• What constraints must it respect?
• What edge cases should it handle?
• How will you determine whether the implementation is correct?
For example, tell it to implement an in-memory cache for GET requests, use a configurable TTL, make it thread-safe, avoid new dependencies, preserve backward compatibility, and add unit tests.
The difference is simple: you're giving the AI a specification instead of asking it to guess your requirements.
2. Make it plan before it writes code.
One of the biggest mistakes developers make is allowing an AI coding agent to start editing a codebase immediately.

Use plan mode first.

Ask Claude to:
→ Explore the existing architecture.
→ Identify the files that need to change.
→ Explain its proposed implementation.
→ Identify potential edge cases and risks.
→ Wait for approval before implementing.

Review the plan and correct its assumptions before any code is written.

This is especially useful in existing projects, where an apparently simple feature can have consequences across multiple modules.

3. Use Claude Code instead of limiting yourself to a chat window.

A chat-based workflow usually requires you to move code manually between the AI and your editor.
Claude Code can work directly with a repository, inspect files, execute commands, edit code, and help run tests within its configured permissions.
That changes how you approach development.
Instead of asking for individual code snippets, you can delegate a well-defined engineering task and review the resulting changes.
But remember: more autonomy also means more responsibility for controlling what the agent can do.
4. Give the model the right amount of reasoning effort.

Not every problem deserves the same amount of compute.

A straightforward DTO or simple transformation doesn't require the same level of reasoning as a difficult concurrency bug or a major architectural refactor.

Match the model and reasoning effort to the task.

Use a fast, economical option for straightforward work. Reserve more capable reasoning for problems where getting the answer wrong would cost significant debugging time or introduce serious design problems.

More thinking is not automatically better. The objective is to get a correct result at a reasonable cost.

5. Give it context, but don't dump your entire codebase into every conversation.

More context doesn't automatically produce better answers.

#ClaudeCode #AI #SoftwareEngineering #AITools #DevTools #Coding #BackendDevelopment #GenerativeAI #Programming #Tech

Provide the information relevant to the task:
• Architecture and module boundaries.
• Existing implementation patterns.
• API contracts and database schemas.
• Relevant tests and error logs.
• Technical constraints and acceptance criteria.

For recurring work, keep stable project documentation and conventions accessible.

The goal is to reduce the AI's guesswork, not overwhelm it with irrelevant information.

6. Connect AI to your actual development tools.

An AI agent becomes more useful when it can interact with the systems involved in the work.

Depending on the configured integrations, that could include GitHub issues, pull requests, CI pipelines, databases, browsers, and internal development tools.

MCP (Model Context Protocol) provides a standard way to connect compatible AI applications to external tools and data sources.

However, every integration introduces capabilities and potential risks.

Prefer narrowly scoped permissions, read-only access where appropriate, and explicit approval for destructive operations.

Never treat an AI agent's access to a tool as harmless just because the interface is conversational.
7. Review the diff, not just the AI's explanation.
This is probably the most important point.
AI-generated code can look convincing while containing subtle bugs.
The summary may say everything is complete. That doesn't mean the implementation is correct.
For every meaningful change:

→ Read the actual diff.
→ Check error handling and edge cases.
→ Run the relevant tests yourself.
→ Verify that existing behavior hasn't regressed.
→ Check performance and security implications.
→ Use an independent review pass for complex changes.

Pay particular attention to authentication, authorization, concurrency, database transactions, and persistence.

A successful compilation is not proof of correctness. Passing unit tests is not proof that every production scenario is safe.

8. Keep a way to recover from mistakes.

Use Git commits, branches, and checkpoints before significant changes.

Keep permissions appropriately restricted and inspect commands before approving risky operations.

An AI coding agent can save hours of work, but a poorly controlled agent can also introduce a large, confusing set of changes very quickly.

Fast execution is only useful when recovery is manageable.

9. Follow this workflow for a real feature.

Here's the process I'd use:

Define the task, constraints, and acceptance criteria.

Ask Claude to inspect the existing codebase.

Review and approve its implementation plan.

Let it implement the change within controlled permissions.

Run tests and inspect the diff.
Ask for an independent review if the change is complex.
Fix problems, rerun tests, and verify the final behavior.
Commit only after reviewing what will actually ship.
Notice what changes: you're spending less time manually generating boilerplate and more time defining problems, reviewing decisions, and verifying behavior.
That is where the engineering leverage comes from.

The biggest misconception about AI-assisted development is that better results come from discovering a magical prompt.

They don't.

Better results come from better specifications, relevant context, controlled tool access, deliberate planning, and rigorous verification.

AI can dramatically reduce the time spent implementing software. It does not eliminate the need to understand the software being implemented.

Especially as a backend engineer, I wouldn't trust an agent blindly with authentication flows, transaction boundaries, concurrency, or production infrastructure.

I'd delegate the implementation, then verify the result.

Delegate aggressively. Verify relentlessly. Own what you ship.

That's how I'd approach AI-assisted software engineering.

What part of your development workflow have you actually delegated to AI, and what do you still insist on doing yourself?

#ClaudeCode #AI #SoftwareEngineering #AITools #DevTools #Coding #BackendDevelopment #GenerativeAI #Programming #Tech

[Gaurav Lodhi @WizardDev_10]

Most developers use Claude as a chatbot.

They ask it to write a function, copy the code, paste it into their project, and hope everything works.

That's not how you get the most out of AI coding tools.

Treat Claude like a capable junior engineer working on your codebase, not a search engine that generates code.

Here's the workflow I'd follow to get significantly better results from Claude Code. 🧵

1. Stop writing vague prompts. Start writing proper engineering briefs.

Instead of saying:

"Add caching to this API."

Give Claude the actual engineering requirements:

• What problem are you trying to solve?
• Which files or modules can it modify?
• What constraints must it respect?
• What edge cases should it handle?
• How will you determine whether the implementation is correct?
For example, tell it to implement an in-memory cache for GET requests, use a configurable TTL, make it thread-safe, avoid new dependencies, preserve backward compatibility, and add unit tests.
The difference is simple: you're giving the AI a specification instead of asking it to guess your requirements.
2. Make it plan before it writes code.
One of the biggest mistakes developers make is allowing an AI coding agent to start editing a codebase immediately.

Use plan mode first.

Ask Claude to:
→ Explore the existing architecture.
→ Identify the files that need to change.
→ Explain its proposed implementation.
→ Identify potential edge cases and risks.
→ Wait for approval before implementing.

Review the plan and correct its assumptions before any code is written.

This is especially useful in existing projects, where an apparently simple feature can have consequences across multiple modules.

3. Use Claude Code instead of limiting yourself to a chat window.

A chat-based workflow usually requires you to move code manually between the AI and your editor.
Claude Code can work directly with a repository, inspect files, execute commands, edit code, and help run tests within its configured permissions.
That changes how you approach development.
Instead of asking for individual code snippets, you can delegate a well-defined engineering task and review the resulting changes.
But remember: more autonomy also means more responsibility for controlling what the agent can do.
4. Give the model the right amount of reasoning effort.

Not every problem deserves the same amount of compute.

A straightforward DTO or simple transformation doesn't require the same level of reasoning as a difficult concurrency bug or a major architectural refactor.

Match the model and reasoning effort to the task.

Use a fast, economical option for straightforward work. Reserve more capable reasoning for problems where getting the answer wrong would cost significant debugging time or introduce serious design problems.

More thinking is not automatically better. The objective is to get a correct result at a reasonable cost.

5. Give it context, but don't dump your entire codebase into every conversation.

More context doesn't automatically produce better answers.

#ClaudeCode #AI #SoftwareEngineering #AITools #DevTools #Coding #BackendDevelopment #GenerativeAI #Programming #Tech

Provide the information relevant to the task:
• Architecture and module boundaries.
• Existing implementation patterns.
• API contracts and database schemas.
• Relevant tests and error logs.
• Technical constraints and acceptance criteria.

For recurring work, keep stable project documentation and conventions accessible.

The goal is to reduce the AI's guesswork, not overwhelm it with irrelevant information.

6. Connect AI to your actual development tools.

An AI agent becomes more useful when it can interact with the systems involved in the work.

Depending on the configured integrations, that could include GitHub issues, pull requests, CI pipelines, databases, browsers, and internal development tools.

MCP (Model Context Protocol) provides a standard way to connect compatible AI applications to external tools and data sources.

However, every integration introduces capabilities and potential risks.

Prefer narrowly scoped permissions, read-only access where appropriate, and explicit approval for destructive operations.

Never treat an AI agent's access to a tool as harmless just because the interface is conversational.
7. Review the diff, not just the AI's explanation.
This is probably the most important point.
AI-generated code can look convincing while containing subtle bugs.
The summary may say everything is complete. That doesn't mean the implementation is correct.
For every meaningful change:

→ Read the actual diff.
→ Check error handling and edge cases.
→ Run the relevant tests yourself.
→ Verify that existing behavior hasn't regressed.
→ Check performance and security implications.
→ Use an independent review pass for complex changes.

Pay particular attention to authentication, authorization, concurrency, database transactions, and persistence.

A successful compilation is not proof of correctness. Passing unit tests is not proof that every production scenario is safe.

8. Keep a way to recover from mistakes.

Use Git commits, branches, and checkpoints before significant changes.

Keep permissions appropriately restricted and inspect commands before approving risky operations.

An AI coding agent can save hours of work, but a poorly controlled agent can also introduce a large, confusing set of changes very quickly.

Fast execution is only useful when recovery is manageable.

9. Follow this workflow for a real feature.

Here's the process I'd use:

Define the task, constraints, and acceptance criteria.

Ask Claude to inspect the existing codebase.

Review and approve its implementation plan.

Let it implement the change within controlled permissions.

Run tests and inspect the diff.
Ask for an independent review if the change is complex.
Fix problems, rerun tests, and verify the final behavior.
Commit only after reviewing what will actually ship.
Notice what changes: you're spending less time manually generating boilerplate and more time defining problems, reviewing decisions, and verifying behavior.
That is where the engineering leverage comes from.

The biggest misconception about AI-assisted development is that better results come from discovering a magical prompt.

They don't.

Better results come from better specifications, relevant context, controlled tool access, deliberate planning, and rigorous verification.

AI can dramatically reduce the time spent implementing software. It does not eliminate the need to understand the software being implemented.

Especially as a backend engineer, I wouldn't trust an agent blindly with authentication flows, transaction boundaries, concurrency, or production infrastructure.

I'd delegate the implementation, then verify the result.

Delegate aggressively. Verify relentlessly. Own what you ship.

That's how I'd approach AI-assisted software engineering.

What part of your development workflow have you actually delegated to AI, and what do you still insist on doing yourself?

#ClaudeCode #AI #SoftwareEngineering #AITools #DevTools #Coding #BackendDevelopment #GenerativeAI #Programming #Tech

[Gaurav Lodhi @WizardDev_10]

Forced re-login across the board. No parallel v1 path.

v1 tokens had no iss/aud. Keeping a dual-validation window would mean keeping the weaker check alive in prod, which is the exact thing v2 was meant to kill. At my scale a re-login is cheap. At a real company I'd do the window.

The part your question made me think harder about: auto-rollback across the v1→v2 boundary. Rolling back the code means v2-issued tokens hit the old validation. So the major-version rollback isn't as clean as the patch-level ones.

[Gaurav Lodhi @WizardDev_10]

I shipped a release that logs out every single user.

On purpose.

AuthVolt v2.0.0 is live: a distributed, event-driven auth system in Spring Boot.

Here are the 6 system design trade-offs I made, and what each one cost me 👇

1. Kafka between auth and notifications
Login never waits on a notification. Notification service dies → auth keeps running.
Cost: eventual consistency + duplicate events.
Honest note: my 2-node KRaft cluster is a learning setup. Real quorum needs 3.

2. Stateless JWT + Redis blacklist
JWTs scale because they're stateless. That also means you can't really log someone out.
So every request checks a Redis blacklist → real logout + logout-all.
Cost: auth now depends on Redis being up.

3. Refresh token in an HttpOnly cookie
JS can't read it → XSS can't steal it.
Cost: cookies bring CSRF. So I added double-submit with an X-XSRF-TOKEN header.
You never remove attack surface. You trade one for another.

4. HS512 over RS256
One issuer, one secret. Fast and simple.
Cost: every service that verifies tokens needs that secret.
RS256 + JWKS is the v3 move.

5. Flyway over ddl-auto: update
Every schema change is versioned and reviewed.
Cost: my pipeline auto-rolls back code, not the database. So every migration has to stay backward compatible.

6. Breaking change over a migration window
New token format with iss + aud. Every v1 token is dead.
Cost: every user logs in again. For auth, I'd make that trade every time.

The pipeline that makes it all shippable:
Tests → Trivy → SonarCloud → push only changed services → deploy → smoke test the live URL.
Smoke test fails → auto-rollback + a revert PR opened for me.
Nobody needs to be awake at 2 AM.

The lesson: there's no "best" architecture. Only trade-offs you chose on purpose, and ones you didn't notice.

I'm learning system design by building real systems, not just reading about them. Follow for more breakdowns like this.

Now tell me: Kafka in an auth service, smart or overkill? 👇

#SystemDesign #buildinpublic

[Gaurav Lodhi @WizardDev_10]

I shipped a release that logs out every single user.

On purpose.

AuthVolt v2.0.0 is live: a distributed, event-driven auth system in Spring Boot.

Here are the 6 system design trade-offs I made, and what each one cost me 👇

1. Kafka between auth and notifications
Login never waits on a notification. Notification service dies → auth keeps running.
Cost: eventual consistency + duplicate events.
Honest note: my 2-node KRaft cluster is a learning setup. Real quorum needs 3.

2. Stateless JWT + Redis blacklist
JWTs scale because they're stateless. That also means you can't really log someone out.
So every request checks a Redis blacklist → real logout + logout-all.
Cost: auth now depends on Redis being up.

3. Refresh token in an HttpOnly cookie
JS can't read it → XSS can't steal it.
Cost: cookies bring CSRF. So I added double-submit with an X-XSRF-TOKEN header.
You never remove attack surface. You trade one for another.

4. HS512 over RS256
One issuer, one secret. Fast and simple.
Cost: every service that verifies tokens needs that secret.
RS256 + JWKS is the v3 move.

5. Flyway over ddl-auto: update
Every schema change is versioned and reviewed.
Cost: my pipeline auto-rolls back code, not the database. So every migration has to stay backward compatible.

6. Breaking change over a migration window
New token format with iss + aud. Every v1 token is dead.
Cost: every user logs in again. For auth, I'd make that trade every time.

The pipeline that makes it all shippable:
Tests → Trivy → SonarCloud → push only changed services → deploy → smoke test the live URL.
Smoke test fails → auto-rollback + a revert PR opened for me.
Nobody needs to be awake at 2 AM.

The lesson: there's no "best" architecture. Only trade-offs you chose on purpose, and ones you didn't notice.

I'm learning system design by building real systems, not just reading about them. Follow for more breakdowns like this.

Now tell me: Kafka in an auth service, smart or overkill? 👇

#SystemDesign #buildinpublic

[Gaurav Lodhi @WizardDev_10]

@devXritesh That's a tough question to answer!

[Gaurav Lodhi @WizardDev_10]

@arzoo_Deziner https://t.co/bbyibG2at5

[Gaurav Lodhi @WizardDev_10]

It was 6:47 PM on a Friday.

I pushed a "tiny" config change to our Spring Boot service. One line. What could go wrong?

7:02 PM: Alerts started firing.
7:05 PM: The incident channel woke up.
7:09 PM: I realised my "one line" had never been tested outside my machine.

No pipeline caught it, because there wasn't a real pipeline. Just me, a Docker build, and confidence.

We rolled back by hand. It took 40 minutes and three people.

What I changed after that night:

→ Every PR runs tests + a build in CI. No green, no merge.
→ The same Docker image goes from staging to prod. No "rebuild for prod."
→ Config changes go through the pipeline too. Config is code.
→ Rollback is one click, not a group call.
→ No Friday evening deploys. (Still controversial in my team 😅)

CI/CD isn't about tools. It's about not depending on someone being careful at 7 PM on a Friday.

Now I'm curious 👇
What's the one CI/CD lesson you learned the hard way?
And be honest: do you deploy on Fridays?

#DevOps #CICD