Medium

Simra Husain

Pinned

In

Dev Genius

by

Simra Husain

·

Apr 20

Two Years After Google’s Flutter Layoffs, I’m Still Building With It. Here’s the Honest Answer.

Two years later, the layoffs look different than they did in April 2024. Not better. Not worse. Just different, and that distinction…

Two Years After Google’s Flutter Layoffs, I’m Still Building With It. Here’s the Honest Answer.

Pinned

In

Stackademic

by

Simra Husain

·

May 4

I’m a Senior Flutter Developer and I Don’t Know If I’ll Have a Job in 18 Months.

I tell myself the optimistic story on good days. I am the architect. AI is my cheap junior dev. The other days, I think about what happens…

I’m a Senior Flutter Developer and I Don’t Know If I’ll Have a Job in 18 Months.

Pinned

In

Dev Genius

by

Simra Husain

·

Nov 20, 2025

Flutter’s Biggest Upgrade in 10 Years: FFI Just Became a Superpower

Flutter’s Biggest Architectural Shift in a Decade — And Why FFI Just Became a Superpower

Flutter’s Biggest Upgrade in 10 Years: FFI Just Became a Superpower

Simra Husain

·

Oct 15

One Index Made Our List Endpoint 100x Faster and Our Dashboard 100x Slower

I reviewed both PRs. I did not catch the second thing. I approved it and then went and asked how it was even spotted, which tells you the…

One Index Made Our List Endpoint 100x Faster and Our Dashboard 100x Slower

Simra Husain

·

Oct 12

I Went to Check One Thing in Our Password Reset Flow and Found Three That Had Drifted

Host header was fine. Token was fine. The one time use step was commented out and the comment by the expiry said ten minutes when the code…

I Went to Check One Thing in Our Password Reset Flow and Found Three That Had Drifted

Simra Husain

·

Oct 8

I Opened Dev Tools on Our Own Production Site and Read My Own Comments Back

Source maps were on for our error tracker. The upload script worked fine. Nobody ever wrote the step that deletes them afterwards, so they…

I Opened Dev Tools on Our Own Production Site and Read My Own Comments Back

Simra Husain

·

Oct 5

Our CORS Config Was Correct. The Request Still Hit the Database.

I went hunting for the Access-Control-Allow-Origin reflection bug in our Express backend. Didn’t find it. Found something I liked less.

Our CORS Config Was Correct. The Request Still Hit the Database.

In

Dev Genius

by

Simra Husain

·

Oct 1

My WebView Bridge Had One Method. That Was the Only Thing Keeping It Safe.

Untrusted CDN script shared the WebView with my native bridge from day one. The bridge exposed one boring method, and that is the only…

My WebView Bridge Had One Method. That Was the Only Thing Keeping It Safe.

In

Level Up Coding

by

Simra Husain

·

Sep 28

A Valid JWT Signature Answers One Question. The Busiest Routes Had Stopped Asking the Rest.

The signature check was solid everywhere. The issuer, audience, and token type checks only existed on the first route anyone wrote.

A Valid JWT Signature Answers One Question. The Busiest Routes Had Stopped Asking the Rest.

In

Level Up Coding

by

Simra Husain

·

Sep 21

Your Server Sends Every Header Except the One That Stops XSS From Running. Here Is the Header.

Content Security Policy is a browser-enforced allowlist for what your page can execute. Without it, the one injected script you missed runs…

Your Server Sends Every Header Except the One That Stops XSS From Running. Here Is the Header.

Simra Husain

Simra Husain

5 years mobile, now backend. I show you what breaks in production, and how to check your own code. Subscribe for teardowns!

Following

Help

Status

About

Careers

Press

Blog

Store

Privacy

Rules

Terms

Text to speech