Skip to content
GrallumaeTechnologies

[Blog]

Engineering notes, written down.

Notes on the actual work — architecture decisions, security reviews and the occasional bug we found before launch. Written up because the reasoning is more useful than the outcome.

LatestFamilyFolds· 7 min read

We found two P0 ledger bugs before FamilyFolds launched. Here they are.

An internal review of the FamilyFolds points ledger found that a client could mint arbitrary points, and that a negative value could break the never-negative invariant. Both were our fault, and both are the reason the reward store is not built yet.

Read the post
6 min read

We moved Mangofold off Firebase because of a bill. It was the right call.

A billing dispute forced a full rewrite of the authorisation layer — Firestore to Postgres, security rules to row-level security. Six months on, it is the best architectural decision in the project's history.

Mangofold · 14 September 2026
5 min read

How bottlemail routes an email to an inbox it cannot read

bottlemail addresses bottles by email address instead of a name. Encrypting the address and indexing a hash of it means the server can deliver a letter without ever holding the identity in plaintext.

bottlemail · 22 August 2026
Subscribe via RSS

[Get in touch]

Have something that needs building?

We take on a small number of contract projects — product builds, privacy-critical backend work, and taking an idea from zero to shipped. Tell us what you're working on.

Start a conversationSee what we do

Taking on select projects for 2026