Every API accumulates the same kind of glue. "This endpoint is public" gets written three times — once for auth, once for CSRF, once for rate limiting — and two of those are path strings that break the day someone renames a route. "Who is the curren...

I spent a while moving a large multi-tenant SaaS platform off Express 4 + Sequelize. The numbers going in: 54 apps, ~593 routes 241 tables across 434 migrations database-per-tenant — one Postgres database per customer organisation one 3,046-lin...