Mohammd Benni Robotics &AutomationEngineer.

Instructors were losing income to recordings that leaked the day after class. Commercial DRM was priced far out of reach for a small platform.

• Video is transcoded to HLS and every segment is encrypted AES-128 at rest on Cloudflare R2.
• Keys are issued per session, short-lived, and bound to a JWT — a key that leaks is worthless within minutes.
• On Android the content key arrives wrapped and is unwrapped by an RSA private key generated inside the TrustZone-backed keystore, so the plaintext key never sits in memory the app can dump.
• Enrollment runs through a Telegram bot that mints access codes, so an instructor can sell a seat from their phone.

Encrypted HLS is not DRM and I do not pretend otherwise — a determined attacker with a rooted device can still capture output. It raises the cost of extraction from "one click" to "real work", at zero licensing cost and with full control of the pipeline. For this market that was the right trade.

A backend where the same models served both complex business rules and high-traffic list endpoints. Invariants leaked into query paths, and read performance was hostage to the write model.

• Bounded contexts with aggregates that own their invariants — nothing mutates state except through the domain.
• Commands write through the domain; queries bypass it entirely and read purpose-built projections.
• Hot paths profiled and reworked: N+1 query elimination, targeted indexes, and caching where the data tolerated staleness.
• API contracts documented and versioned so the front-end teams could move without waiting on us.

CQRS costs you a second model to keep in sync, and it is genuinely the wrong choice for simple CRUD. It paid for itself here because the read and write shapes had already diverged — we were paying the cost without getting the benefit.

Sync jobs and flaky mobile connections meant the same write could arrive twice, and reporting queries that were fine at a hundred rows fell over at a hundred thousand.

• Idempotent upserts keyed on a natural business key, so a retried sync converges instead of duplicating.
• Indexes chosen from the query shapes that actually run, then verified against the plan — not guessed from column names.
• Normalised where correctness matters, denormalised deliberately and documented where read latency mattered more.
• Migrations versioned and reversible; constraints enforced in the database, not only in application code.

Constraints in the database make some deploys harder and some writes slower. I take that trade every time — application code gets rewritten, and the data outlives it.