Software Architecture & Technical Insights
86 articles on Software Architecture & Technical from the Creuto engineering and product team: practical guides, trends, and lessons from building real software.
Latest posts
More posts
Cryptographic inventory: deprecated after 2030, gone 2035
NIST's draft transition plan deprecates classical public-key cryptography after 2030 and disallows it after 2035. Finding every place you use it is the hard part, and an AI code scan only gets you partway.
Akash Mohapatra
Oct 1, 2026
Automated incident remediation: where the human stays
Cloudflare, Sentry and Datadog all now route production errors to a coding agent, and all three stop at a pull request. Here is what that loop fixes, what it cannot, and the permissions to grant.
Akash Mohapatra
Oct 1, 2026
Agent sandbox startup: 648ms is a median, not a floor
Cloudflare's rebuilt Containers start agent sandboxes in a 648ms median, down from 4.049 seconds. The p99 is 1129ms, the benchmark is a 100-sandbox burst, and the old Sandbox class dies on 31 December 2026.
Akash Mohapatra
Oct 1, 2026
AI refactoring legacy code: what 300K lines in 3 weeks proves
CodeScene's agents took a 300,000-line C codebase from Code Health 5.6 to 10.0 in three weeks for $4,000 in tokens. The result rests on a frame-by-frame oracle most legacy systems do not have.
Akash Mohapatra
Oct 1, 2026
AI spend monitoring: catch model overuse before the bill
Every provider cost API buckets by day, so your spend alert is already stale. What OpenAI, Anthropic, Google and AI gateways can actually enforce, and why we alert on tokens per request instead.
Akash Mohapatra
Oct 1, 2026
HTTP 402 Payment Required: charging agents per request
RFC 9110 calls 402 reserved for future use. Two Cloudflare products and the x402 specification now disagree. What the real header exchange looks like, and what you would have to build.
Akash Mohapatra
Sep 30, 2026
Artifactory vulnerability chain: patch now, assume breach
Three JFrog Artifactory CVEs are being exploited in the wild and all three are on CISA's KEV catalogue. Here is the per-branch patch matrix, the two-request escalation chain, and what to check once you have patched.
Akash Mohapatra
Sep 29, 2026
Post-quantum encryption check: what your domain uses
Cloudflare now surfaces the negotiated TLS key exchange group per request in Traffic Analytics, Log Explorer and Logpush. About 70% of browser traffic uses hybrid ML-KEM; about 15% of origins do. Here is how to read the gap.
Akash Mohapatra
Sep 29, 2026
Multi-tenant Prometheus: let teams query their own metrics
Adobe engineers published a tenant-aware pattern for shared clusters: RBAC at the door, PromQL rewritten below the query language, and a custom resource so teams declare their own access. Here is where it still breaks.
Akash Mohapatra
Sep 29, 2026
One Vision. One Team. One Creuto.
Whatever your challenge, we bring the expertise to build, scale, and transform your digital presence with technology that works.