# Writing

> Notes from practice: architecture, AI-assisted development, security and compliance, written by Dan Podina.

Practical insights from 20 years of building backend systems.

## Pages

- [Zero-Downtime PostgreSQL Migration: The Checklist From a 2M-Record Move](https://gqlteam.com/blog/zero-downtime-postgres-migration-checklist/index.md): Logical replication or dual writes, chunked backfill, checksum verification, a reversible cutover and a rollback you have actually tested. The full checklist.
- [PCI-DSS Level 1 on a Go Backend: The Architecture Decisions That Survive a QSA](https://gqlteam.com/blog/pci-dss-level-1-go-backend-architecture/index.md): Scope reduction, tokenization and segmentation: the architecture choices that decide a PCI-DSS Level 1 audit, plus the Go-specific ways card data leaks out.
- [GraphQL Federation on Go: When a Monolith Schema Should Split](https://gqlteam.com/blog/graphql-federation-go-when-to-split/index.md): Federation is a team-scaling tool, not a performance upgrade. The signals that justify splitting a Go GraphQL schema, what it costs, and the migration order.
- [Your AI Context Is Locked to One Tool. Here's How to Fix It.](https://gqlteam.com/blog/tool-agnostic-ai-context/index.md): Cursor rules, Claude instructions, Codex agents: every AI tool wants its own config. A practical guide to writing project context once and generating it for every platform.
- [Which OWASP ASVS Level Does Your App Actually Need?](https://gqlteam.com/blog/owasp-asvs-levels/index.md): OWASP ASVS has 3 security levels. Most teams pick wrong: either too little or way too much. A practical guide to choosing the right level.
- [Why Cursor Keeps Doing Something Else (And How to Fix It)](https://gqlteam.com/blog/make-cursor-work/index.md): After months of fighting Cursor's 'creative interpretations,' I figured out what actually works. Here's the Cursor 2.4 workflow that stopped the madness.