Nitin Nair

I used to think API security was mostly covered by auth middleware and HTTPS. If the token is valid, everything is good — right? Wrong. A few years ago, I was working on an API flow that looked solid on paper: Auth Role checks Clean endpoints Tests passing Then a production issue came in. Not a crash. Not downtime. Something worse. Data was being accessed… correctly. But by the wrong people. The endpoints were protected. The logic behind them wasn’t. We hadn’t violated rules. We had violated assumptions.

In a recent sprint, one of my junior developers asked me how *LaunchDarkly * actually fits into our React-Native-Web codebase. Not just the syntax — but the system around it. It turned into one of my best mentoring sessions this year.

Every React developer thinks performance issues come from the backend—until they learn the truth. I learned mine in the middle of a sprint where the backend team kept saying, “API is fast… the UI isn’t.” They were right. The Moment of Realization A junior dev pinged me: “Why does our UI freeze if the API is super fast?” I opened the Profiler. One component—just one—was re-rendering 19 times for one change. We didn’t have a slow API. We had unnecessary work.