<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
<url>
<loc>https://steve-johnson.dev</loc>
<changefreq>monthly</changefreq>
<priority>1</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog</loc>
<changefreq>daily</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/why-fractional-ctos-who-stay-in-standby-mode-fail-early-stage-engineering-teams</loc>
<lastmod>2026-10-23T17:41:22.333924+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/row-level-security-performance-overhead-in-multi-tenant-postgresql</loc>
<lastmod>2026-10-20T17:00:57.934646+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/scoping-api-keys-to-minimum-required-capabilities</loc>
<lastmod>2026-10-19T17:25:55.59058+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/using-load-tests-to-surface-bugs-before-production-traffic-does</loc>
<lastmod>2026-10-15T18:51:28.813764+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/runbook-maintenance-as-a-production-discipline</loc>
<lastmod>2026-10-12T17:21:29.867434+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/incident-runbooks-that-engineers-actually-use-during-an-outage</loc>
<lastmod>2026-10-09T18:01:48.24115+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/silent-webhook-failure-patterns-and-retry-architecture</loc>
<lastmod>2026-10-06T17:31:43.282862+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/catching-api-schema-drift-before-it-breaks-production</loc>
<lastmod>2026-10-05T17:26:30.480291+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/openapi-schema-drift-detection-in-ci-pipelines</loc>
<lastmod>2026-10-04T19:12:09.542383+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/byte-identical-parity-verification-for-large-scale-database-migrations</loc>
<lastmod>2026-10-02T17:55:11.784849+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/migrating-bcrypt-password-hashes-across-auth-providers</loc>
<lastmod>2026-10-01T17:45:51.425278+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/bcrypt-hash-migration-with-lazy-rehashing-in-production</loc>
<lastmod>2026-10-14T14:23:40.032214+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/the-metadata-format-that-wasn-t-a-valid-http-header</loc>
<lastmod>2026-09-24T03:04:32.912357+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/two-schemas-slowly-drifting-apart</loc>
<lastmod>2026-09-24T03:04:30.656293+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/the-importer-that-changed-its-own-shape-mid-build</loc>
<lastmod>2026-09-24T03:04:28.35418+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/why-i-stopped-writing-database-rows-one-at-a-time</loc>
<lastmod>2026-09-24T03:04:26.252413+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/the-import-that-accidentally-emailed-everyone-and-what-we-built-after</loc>
<lastmod>2026-09-24T03:04:23.857765+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/two-payment-systems-one-set-of-rules</loc>
<lastmod>2026-09-16T00:42:33.470138+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/why-we-rewrote-our-api-manifest-around-a-single-schema</loc>
<lastmod>2026-09-16T00:42:30.131667+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/a-privilege-escalation-path-hiding-in-a-profile-edit-endpoint</loc>
<lastmod>2026-09-16T00:42:26.083848+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/migrating-every-password-hash-without-logging-anyone-out</loc>
<lastmod>2026-09-16T00:42:21.613026+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/five-job-platforms-one-shared-core</loc>
<lastmod>2026-09-16T00:42:14.110857+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/a-feature-flag-that-outlived-the-migration-it-was-built-for</loc>
<lastmod>2026-10-12T05:08:51.199772+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/the-runbook-nobody-follows-because-it-s-already-stale</loc>
<lastmod>2026-10-12T05:08:49.738805+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/code-review-comments-that-catch-bugs-vs-comments-that-catch-style</loc>
<lastmod>2026-10-12T05:08:43.769751+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/an-api-that-returns-200-for-a-request-it-silently-dropped</loc>
<lastmod>2026-09-26T02:51:23.482138+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/debugging-an-incident-that-only-reproduces-under-load</loc>
<lastmod>2026-09-26T02:51:23.578183+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/the-password-migration-nobody-had-to-notice</loc>
<lastmod>2026-10-05T05:06:19.833392+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/the-path-that-pointed-at-two-different-files-depending-on-where-you-ran-it</loc>
<lastmod>2026-09-26T02:51:27.311137+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/the-subprocess-call-with-no-ceiling-an-hour-long-hang-and-the-fix-that-closed-it</loc>
<lastmod>2026-09-26T02:51:27.395626+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/a-cluster-of-403s-that-looked-like-an-auth-bug-was-actually-a-traffic-burst-limiter</loc>
<lastmod>2026-10-05T05:06:08.943919+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/squash-merges-leave-a-stale-branch-graveyard</loc>
<lastmod>2026-09-26T02:51:27.576159+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/a-payment-api-upgrade-silently-broke-my-subscription-reads</loc>
<lastmod>2026-10-04T05:07:17.978883+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/the-outage-that-wasn-t-how-a-2-second-checkpoint-stall-masquerades-as-a-db-crash</loc>
<lastmod>2026-10-04T05:07:19.691851+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/what-my-own-api-key-couldn-t-tell-me</loc>
<lastmod>2026-10-04T05:07:20.244903+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/two-ways-to-close-an-api-gap-and-why-i-used-both</loc>
<lastmod>2026-10-04T05:07:11.260878+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://steve-johnson.dev/blog/adding-a-blog-without-letting-the-cms-own-the-deployment</loc>
<lastmod>2026-09-26T02:51:29.588539+00:00</lastmod>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
</urlset>
