# Hasan Misbah

> Product engineer who builds the business-critical systems companies cannot afford to get wrong: licensing, subscriptions, payments, authentication, and backend infrastructure. Since 2018. Stack: Laravel, Vue.js, the WordPress plugin ecosystem, and Cloudflare-edge JavaScript.

## Site
- [Home](https://misbah.co): who Hasan is and what he builds
- [About](https://misbah.co/about): background, approach, and stack
- [Projects](https://misbah.co/projects): products built from scratch and contributed to
- [Writing](https://misbah.co/blog): essays on building durable, revenue-critical software
- [Bookmarks](https://misbah.co/bookmarks) (markdown: https://misbah.co/bookmarks.md): a reading log of other people's articles, each with a note on what it changed in practice. Notes are commentary; the articles belong to their authors and every entry links to the original
- [Contact](https://misbah.co/contact): get in touch

## Topics
- [Revenue-critical code](https://misbah.co/blog/pillars/revenue-critical-code) (4 essays): Essays on the code that moves money: payments, refunds, subscriptions, and licensing, and how to build it so the numbers stay honest.
- [Plugin modernization](https://misbah.co/blog/pillars/plugin-modernization) (4 essays): How to evolve a WordPress plugin with a large install base: safe migrations, staged rollouts, and version support you do not control.
- [Founder engineering](https://misbah.co/blog/pillars/founder-engineering) (6 essays): The engineering decisions founders cannot fully delegate: build vs buy, who owns billing, and the questions to ask before the code is written.
- [Products that last](https://misbah.co/blog/pillars/products-that-last) (5 essays): On building software that survives its authors: boring code, honest monitoring, and the strategy that keeps a product alive past this quarter.
- [Plugin reviews](https://misbah.co/blog/pillars/plugin-reviews) (1 essay): Hands-on reviews of WordPress plugins by an engineer who reads the code as well as the marketing page, with every relationship disclosed.

## Writing
- [Ink Player: the modern WordPress video player walkthrough](https://misbah.co/blog/ink-player-review) (markdown: https://misbah.co/blog/ink-player-review.md): A hands-on review of Ink Player, the WordPress video player built around a media library rather than page embeds. Nine sources, real limits, and who should skip it.
- [Shift left assumes there is someone on your left](https://misbah.co/blog/shift-left-assumes-someone-on-your-left) (markdown: https://misbah.co/blog/shift-left-assumes-someone-on-your-left.md): Rachel Laycock says shift code review left. Brian Houck says fix it first. Both assume a team. Here is review by exception when you are the only reviewer.
- [Cognitive debt is cheap until the code takes money](https://misbah.co/blog/cognitive-debt-is-cheap-until-the-code-takes-money) (markdown: https://misbah.co/blog/cognitive-debt-is-cheap-until-the-code-takes-money.md): Cognitive debt costs you a slow refactor in most code and a wrong payment in billing code. How to scale AI review to what breaks when you are wrong.
- [Rubber duck debugging in PHP: narrate the sequence, not the lines](https://misbah.co/blog/rubber-duck-debugging-in-php) (markdown: https://misbah.co/blog/rubber-duck-debugging-in-php.md): Narrate the execution, not the file: what fires, in what order, in whose process. The four questions that find hook, observer and queue bugs in WordPress and Laravel.
- [When to automate refunds, and when to keep them manual](https://misbah.co/blog/when-to-automate-refunds) (markdown: https://misbah.co/blog/when-to-automate-refunds.md): Automating refunds is easy, and early on it deletes your best customer feedback. Why manual refunds pay, and the four signals it is time to automate.
- [Cost cutting is motion, not a strategy](https://misbah.co/blog/cost-cutting-is-motion-not-a-strategy) (markdown: https://misbah.co/blog/cost-cutting-is-motion-not-a-strategy.md): Cutting costs moves the numbers, not the company. The long game goes to people who stay to hold context and balance operators with entrepreneurs.
- [Store money as integer cents, never a float](https://misbah.co/blog/store-money-as-integer-cents-never-a-float) (markdown: https://misbah.co/blog/store-money-as-integer-cents-never-a-float.md): An opinionated rule for money code: store amounts as integer minor units, never a binary float, and never divide a total to get its parts.
- [The refund path is where I read a codebase's soul](https://misbah.co/blog/the-refund-path-is-where-i-read-a-codebases-soul) (markdown: https://misbah.co/blog/the-refund-path-is-where-i-read-a-codebases-soul.md): Checkout code is easy. Refunds, proration, and failed webhooks are where I can tell if a payments codebase was built by someone senior.
- [You don't rewrite a plugin with a big install base](https://misbah.co/blog/you-dont-rewrite-a-plugin-with-a-big-install-base) (markdown: https://misbah.co/blog/you-dont-rewrite-a-plugin-with-a-big-install-base.md): How I evolve a WordPress plugin with a large install base without breaking users mid-update: a strangler-fig approach with real PHP and version gates.
- [The first hire who touches your billing should be boring](https://misbah.co/blog/the-first-hire-who-touches-your-billing-should-be-boring) (markdown: https://misbah.co/blog/the-first-hire-who-touches-your-billing-should-be-boring.md): The engineer who owns revenue early should reach for idempotency, audit logs, and reconciliation by reflex. How to screen for it and reject the rest.
- [Boring code is a feature you ship to your future self](https://misbah.co/blog/boring-code-is-a-feature-you-ship-to-your-future-self) (markdown: https://misbah.co/blog/boring-code-is-a-feature-you-ship-to-your-future-self.md): Boring code wins on systems that have to last. Why the durable choice looks unimpressive, how to defend it in review, and when to delete clever code.
- [Six payments edge cases that bite at 2am](https://misbah.co/blog/six-payments-edge-cases-that-bite-at-2am) (markdown: https://misbah.co/blog/six-payments-edge-cases-that-bite-at-2am.md): Partial refunds, duplicate webhooks, currency rounding, retries, chargebacks, and clock skew: the payments edge cases that page you, with the fix for each.
- [Shipping a feature into a five-year-old plugin](https://misbah.co/blog/shipping-a-feature-into-a-five-year-old-plugin) (markdown: https://misbah.co/blog/shipping-a-feature-into-a-five-year-old-plugin.md): Real tactics for shipping into an old WordPress plugin: feature flags, backward-compatible DB migrations, and staged rollouts across a live install base.
- [Three questions I ask before I write billing code](https://misbah.co/blog/three-questions-before-i-write-billing-code) (markdown: https://misbah.co/blog/three-questions-before-i-write-billing-code.md): Three questions to answer before you build billing: what is the source of truth, what happens when this runs twice, and how do we reconstruct it later.
- [Subscriptions are licensing that bills on time](https://misbah.co/blog/subscriptions-are-licensing-that-bills-on-time) (markdown: https://misbah.co/blog/subscriptions-are-licensing-that-bills-on-time.md): A subscription is a state machine bolted to a billing clock. Dunning, grace periods, and proration are where it leaks money. Here is how I model each.
- [Backward-compatible migrations on a big install base](https://misbah.co/blog/backward-compatible-migrations-on-an-install-base) (markdown: https://misbah.co/blog/backward-compatible-migrations-on-an-install-base.md): The migration rules I hold on a live WordPress install base: additive columns only, no destructive deploys, version gates, and a rollback plan.
- [Build vs buy for billing: when Stripe is enough](https://misbah.co/blog/build-vs-buy-for-billing) (markdown: https://misbah.co/blog/build-vs-buy-for-billing.md): For most early products a hosted processor like Stripe is enough. It stops at four: global tax, usage-based pricing, marketplaces, and provider limits.
- [Why I run uptime checks at the edge, not one server](https://misbah.co/blog/why-i-run-uptime-checks-at-the-edge) (markdown: https://misbah.co/blog/why-i-run-uptime-checks-at-the-edge.md): A single VPS in one region tells you about its own path, not your users'. Here is how I built edge uptime checks on Cloudflare Workers and why.
- [Supporting a plugin across WordPress versions you don't own](https://misbah.co/blog/supporting-a-plugin-across-wordpress-versions) (markdown: https://misbah.co/blog/supporting-a-plugin-across-wordpress-versions.md): A compatibility strategy for WordPress and PHP versions you don't control: function_exists and capability checks, graceful degradation, a support matrix.
- [Auth mistakes in early products, and how to fix each](https://misbah.co/blog/authentication-mistakes-in-early-products) (markdown: https://misbah.co/blog/authentication-mistakes-in-early-products.md): The same auth bugs show up in early products: session fixation, weak hashing, no rate limiting, tokens in the wrong place. Here is the fix for each.