# Moayyad Faris > VP of Engineering & Software Architect. 20+ years designing microservice architectures at scale and AWS serverless systems. This site hosts technical guides, an engineering blog, a free browser-side developer tools platform, and the Arabic & RTL Web Adoption research project. - [Full Context Bundle](https://moayyadfaris.com/llms-full.txt): Comprehensive single-file text archive for deep ingestion: guide summaries, research benchmarks, and tool catalog - [OpenAPI 3.1 Spec](https://moayyadfaris.com/api/openapi.json): Machine-readable API definitions for AI agents and automated tools ## About - [About](https://moayyadfaris.com/about): Background, technical specializations, and leadership philosophy - [Experience](https://moayyadfaris.com/experience): Career timeline, 2006 to present - [Kuybi](https://moayyadfaris.com/open-source/kuybi): Open-source NestJS 11 enterprise backend framework maintained by the author - [The Anatomy of a Request](https://moayyadfaris.com/anatomy-of-a-request): Interactive scroll-driven walkthrough of the ~200ms between a click and a response: DNS, TCP, TLS 1.3, the kernel accept queue, the Node.js event loop, and a database round trip ## Developer Tools > 58 free, privacy-first browser-side developer tools across 7 categories. Most run entirely client-side — no server upload. - [All Tools](https://moayyadfaris.com/tools): Full tool catalog - [Arabic Developer Tools](https://moayyadfaris.com/tools/arabic): Arabic slugs, text and numeral normalization, RTL preview, and reusable web-development snippets. - [AWS and DevOps](https://moayyadfaris.com/tools/aws): ALB log parsing, CIDR calculation and other tools for AWS and DevOps workflows. - [JSON and Data](https://moayyadfaris.com/tools/json): Format, validate and convert JSON, YAML and CSV data. - [Web and SEO](https://moayyadfaris.com/tools/web): URL parsing, header inspection and SEO metadata tools. - [Security](https://moayyadfaris.com/tools/security): JWT decoding, hashing and security header analysis. - [Date and Time](https://moayyadfaris.com/tools/datetime): Unix timestamp conversion, time zones and cron expressions. - [Text Utilities](https://moayyadfaris.com/tools/text): Diffing, regex testing and text transformation tools. ## Guides - [Enterprise Strict Content Security Policy (CSP): The Production Guide for Next.js & Modern Web Apps](https://moayyadfaris.com/guides/strict-csp-nextjs-enterprise-guide): Production guide for implementing Strict Content Security Policy (CSP) with cryptographic nonces, 'strict-dynamic', Next.js App Router streaming SSR, and violation reporting. - [Best Arabic Web Fonts: A 20-Font Measured Performance Guide](https://moayyadfaris.com/guides/best-arabic-web-fonts): 20 Arabic web fonts measured by real WOFF2 byte size, not vendor claims: the full size ranking, why Naskh reading faces cost more, where variable fonts backfire, and how to load one without paying for Latin you don't use. - [AGENTS.md: What It Is, How It Differs From CLAUDE.md, and How to Write One](https://moayyadfaris.com/guides/agents-md): AGENTS.md explained: the open, tool-agnostic Markdown file for AI coding agent instructions, how it differs from CLAUDE.md, .cursorrules, and copilot-instructions.md, exactly how Claude Code handles it as of v2.1.234, and a step-by-step guide to writing and migrating to one. - [How to Build an OKF Bundle: A Step-by-Step Guide to Google's Open Knowledge Format](https://moayyadfaris.com/guides/how-to-build-an-okf-bundle): A step-by-step guide to building a spec-conformant Open Knowledge Format (OKF) bundle from scratch: writing your first concept file, adding v0.2's trust and lifecycle fields, cross-linking concepts into a graph, validating conformance with a copyable script, and wiring the bundle into an AI agent's context. - [Microservices Communication Patterns: Sync, Async, and the Saga Pattern](https://moayyadfaris.com/guides/microservices-communication-patterns): A deep dive into microservices communication design: when to use synchronous REST/gRPC versus asynchronous messaging, the transactional outbox pattern for reliable event publishing, orchestration vs choreography sagas for distributed transactions without two-phase commit, API gateway design, and distributed tracing across service boundaries. - [Arabic Web Development: The Complete Production Guide](https://moayyadfaris.com/guides/arabic-web-development): Build production-ready Arabic websites with correct RTL direction, BiDi isolation, logical CSS, Unicode normalization, accessible forms, Arabic SEO, fonts, numerals, and email. - [Deploying a Production Node.js API with Docker and Nginx](https://moayyadfaris.com/guides/docker-nginx-nodejs-production-deployment): A production-grade guide to deploying a Node.js API with Docker and Nginx: a hardened multi-stage Dockerfile, a database-aware health check endpoint, Docker Compose replicas vs PM2, free TLS via Certbot, and a GitHub Actions pipeline that redeploys without dropping requests. - [Hardening Docker & Nginx Production Workloads for High-Concurrency Next.js Applications](https://moayyadfaris.com/guides/docker-nginx-nextjs-hardening): Learn how to harden Next.js Docker containers and Nginx reverse proxies for production. Covers non-root multi-stage Dockerfiles, Nginx security headers, rate-limiting zones, and CloudFront origin secret validation. - [Next.js 16 Breaking Changes: What Actually Breaks (And How to Fix It)](https://moayyadfaris.com/guides/nextjs-16-breaking-changes-migration-guide): A practical Next.js 16 migration guide covering the async Request APIs removal, middleware→proxy rename, Turbopack-by-default build failures, next/image security defaults, revalidateTag's new required argument, and parallel routes requiring default.js — with working code for each. - [Hosting a Production Static Website on AWS S3, CloudFront & Route 53 with Free SSL](https://moayyadfaris.com/guides/aws-s3-cloudfront-website-hosting): Learn how to host a secure, high-performance static website on AWS S3 and CloudFront. Step-by-step guide covering S3 bucket security policy, CloudFront OAC, ACM custom SSL certificates, Route 53 alias records, and GitHub Actions CI/CD cache invalidation. - [Building Production-Ready Arabic & RTL Web Interfaces in Next.js](https://moayyadfaris.com/guides/nextjs-arabic-rtl-development): Master RTL web development in modern Next.js apps. Learn how to handle Arabic font rendering, layout mirroring with Tailwind CSS, text normalization, diacritics stripping, and SEO-friendly Arabic URL slugs. - [Mastering AWS ALB Access Logs: Debugging Latency, 5xx Errors, and Traffic Spikes](https://moayyadfaris.com/guides/aws-alb-log-analysis): Learn how to extract actionable performance metrics from AWS ALB access logs. Understand target processing time vs request time, debug 502/504 errors, and compute latency percentiles (P50, P95, P99). ## Blog - [Claude Opus 5.5: Why the Model Recommendation Just Changed](https://moayyadfaris.com/blog/claude-opus-5-5-changes-the-model-recommendation): What actually changed in Claude Opus 5.5 versus Opus 5: exact pricing, benchmark deltas, a default-effort change that silently affects existing code, and why it updates this site's earlier Fable 5.1 vs Opus 5 recommendation. - [The OpenAI Wiki Incident: What Actually Happened When Agents Turned a Wiki Into a Message Board](https://moayyadfaris.com/blog/openai-agent-wiki-incident-explained): A source-attributed breakdown of the OpenAI agent wiki incident: what's confirmed by Reuters, NBC, and OpenAI's own September 5 statement, what remains unconfirmed, and the practical lesson for teams building agentic systems, treat training and evaluation environments as untrusted, not just production. - [Claude Fable 5.1 vs Opus 5 vs Sonnet 5: Which Model Should You Actually Use?](https://moayyadfaris.com/blog/claude-fable-5-1-vs-opus-5-vs-sonnet-5): A source-grounded comparison of the current Claude lineup after the September 1, 2026 Fable 5.1 and Mythos 5.1 release: exact pricing, context windows, benchmark deltas versus Fable 5, and Anthropic's own guidance on when the higher-tier model actually earns its cost. - [The Modular Monolith Comeback: Why Teams Are Reversing Microservices Decisions](https://moayyadfaris.com/blog/modular-monolith-microservices-backlash): A source-grounded look at the modular monolith trend: what Amazon Prime Video's and Segment's well-documented architecture reversals show, Martin Fowler's MonolithFirst argument for why service boundaries are hard to get right early, and the concrete signals worth using before splitting a monolith into microservices. - [Defending Autonomous AI Agents Against Indirect Prompt Injection](https://moayyadfaris.com/blog/defending-ai-agents-against-prompt-injection): A source-grounded look at indirect prompt injection in autonomous AI agents: OWASP's direct-vs-indirect distinction, Simon Willison's lethal-trifecta model, and which agent architecture patterns — dual-LLM, CaMeL, plan-then-execute, context-minimization — hold up against untrusted content hijacking tool execution, with the honest tradeoffs each one makes. - [Google's Open Knowledge Format Doesn't Replace Vector Search — It Fixes What Embeddings Were Never Good At](https://moayyadfaris.com/blog/okf-vs-rag-vector-database): A source-grounded technical read of Google Cloud's Open Knowledge Format (OKF): the real conformance criteria from its GitHub spec, why 'replaces the vector database' misreads what OKF and RAG each solve, and a practical architecture for combining deterministic OKF lookups with vector search instead of picking one. - [The OpenAI–Hugging Face Incident Was Not a Rogue AI Attack. It Was a Containment Failure.](https://moayyadfaris.com/blog/openai-hugging-face-autonomous-ai-cyber-incident): A source-led engineering analysis of the July 2026 OpenAI–Hugging Face security incident, separating confirmed facts from the rogue-AI narrative and translating the failure into concrete controls for agent sandboxes, egress, credentials, detection, and incident response. - [State of Arabic and RTL Websites in 2026: A 220-Site Study](https://moayyadfaris.com/blog/state-of-arabic-rtl-websites-2026): A measured 2026 study of 220 ranked Arabic-region websites covering RTL markup, CSS logical properties, Arabic fonts, accessibility, SEO, countries, and frameworks. - [Designing Zero-Trust Enterprise Security Architectures for Next.js & NestJS API Platforms](https://moayyadfaris.com/blog/zero-trust-enterprise-security-nextjs-nestjs): Master Zero-Trust security in Next.js and NestJS enterprise backends. Learn how to implement RS256 JWKS verification, high-performance JWT revocation using Redis Bloom filters, CASL ABAC authorization, and Edge middleware guardrails. - [Building an SSRF-Safe URL Fetcher: DNS Pinning, Redirect Re-Validation, and Cloud Metadata Defense](https://moayyadfaris.com/blog/ssrf-safe-url-fetcher-dns-pinning): A first-party walkthrough of the SSRF protection layer built for moayyadfaris.com's Security Header Analyzer: structural URL validation, resolved-IP checking against private/reserved ranges, DNS-rebinding defense via connection pinning, and per-hop redirect re-validation — with the actual production TypeScript code. - [How Many Arabic Websites Implement RTL Correctly?](https://moayyadfaris.com/blog/how-many-arabic-websites-implement-rtl-correctly): How many Arabic websites actually set dir="rtl" correctly? A 220-site, country-stratified study of ranked Arabic-region homepages measures HTML language/direction adoption, conflicts, and CSS logical-vs-physical property choices. - [lang="ar" vs dir="rtl": What Each Attribute Does](https://moayyadfaris.com/blog/lang-ar-vs-dir-rtl-what-each-attribute-does): lang="ar" and dir="rtl" are not interchangeable. Learn what each HTML attribute actually controls, why a page can need one without the other, and how often real Arabic websites get this wrong. - [The Most Common RTL HTML and CSS Mistakes](https://moayyadfaris.com/blog/most-common-rtl-html-css-mistakes): The most common RTL implementation mistakes, ranked by measured frequency across a 220-site study of Arabic-region homepages: physical CSS properties, missing font fallbacks, incomplete direction declarations, and more. - [Architecting Enterprise NestJS Applications: Clean Architecture, Dynamic Caching, and Audit Logging](https://moayyadfaris.com/blog/enterprise-nestjs-architecture-kuybi): Explore the architectural patterns behind Kuybi — an open-source NestJS 11 backend foundation. Learn how to structure DDD modules, isolate worker queues, enforce fine-grained RBAC/ABAC security, and achieve sub-millisecond API caching. - [Architecting Production Pipelines for Autonomous AI Coding Agents: Lessons from the Engineering Frontline](https://moayyadfaris.com/blog/architecting-autonomous-ai-agent-pipelines): Learn how engineering leaders build reliable pipelines for AI coding agents. Explore context collection, prompt engineering, containerized sandboxes, automated evaluation loops, and security guardrails. - [Running Small Language Models (SLMs) on Edge & Browser Runtimes: WebAssembly, WebGPU, and Local Inference](https://moayyadfaris.com/blog/local-slm-browser-inference-webgpu): Explore the technical shift towards local browser AI inference using Small Language Models (SLMs). Learn how WebGPU acceleration, quantization tradeoffs, on-device model caching, and hybrid cloud fallback routing achieve low-latency execution with 100% data privacy. ## Research - [Framework Core Web Vitals & INP Index](https://moayyadfaris.com/web-performance-index): Real-world INP, LCP, CLS, and TTFB field data per framework (Next.js, SvelteKit, Nuxt.js, Remix, Laravel, WordPress) from the Google Chrome UX Report, plus a live single-domain CrUX auditor - [Arabic Font Statistics](https://moayyadfaris.com/arabic-web-stats): Live Arabic font package-demand and upstream-family statistics with selection guidance - [Arabic Web Font Performance Benchmark 2026](https://moayyadfaris.com/arabic-web-stats/font-performance): Reproducible Arabic-subset WOFF2 size benchmark with interactive previews and JSON/CSV data - [Arabic & RTL Web Adoption Dataset](https://moayyadfaris.com/arabic-web-stats/rtl-adoption): A reproducible, country-stratified measurement of how ranked Arabic-region websites implement Arabic and RTL support — HTML, CSS, fonts, accessibility, and framework distribution - [RTL Adoption Trends](https://moayyadfaris.com/arabic-web-stats/rtl-adoption/trends): Methodology-safe time series tracking the dataset across recurring monthly measurements - [Embeddable RTL Adoption Charts](https://moayyadfaris.com/arabic-web-stats/rtl-adoption/embed): Responsive, attributed iframe charts for overview, country comparison, and trend data - [State of Arabic and RTL Websites in 2026](https://moayyadfaris.com/blog/state-of-arabic-rtl-websites-2026): Definitive 220-site research article with measured findings, country benchmarks, recommendations, and a downloadable PDF edition - [State of Arabic and RTL Websites 2026 (PDF)](https://moayyadfaris.com/reports/state-of-arabic-rtl-websites-2026.pdf): Citation-ready downloadable edition of the 220-site study - [Algeria Arabic & RTL Website Statistics](https://moayyadfaris.com/arabic-web-stats/rtl-adoption/algeria): Country report measuring HTML direction, Arabic metadata, logical CSS, fonts, and SEO across ranked .dz homepages - [Bahrain Arabic & RTL Website Statistics](https://moayyadfaris.com/arabic-web-stats/rtl-adoption/bahrain): Country report measuring HTML direction, Arabic metadata, logical CSS, fonts, and SEO across ranked .bh homepages - [Egypt Arabic & RTL Website Statistics](https://moayyadfaris.com/arabic-web-stats/rtl-adoption/egypt): Country report measuring HTML direction, Arabic metadata, logical CSS, fonts, and SEO across ranked .eg homepages - [Iraq Arabic & RTL Website Statistics](https://moayyadfaris.com/arabic-web-stats/rtl-adoption/iraq): Country report measuring HTML direction, Arabic metadata, logical CSS, fonts, and SEO across ranked .iq homepages - [Jordan Arabic & RTL Website Statistics](https://moayyadfaris.com/arabic-web-stats/rtl-adoption/jordan): Country report measuring HTML direction, Arabic metadata, logical CSS, fonts, and SEO across ranked .jo homepages - [Kuwait Arabic & RTL Website Statistics](https://moayyadfaris.com/arabic-web-stats/rtl-adoption/kuwait): Country report measuring HTML direction, Arabic metadata, logical CSS, fonts, and SEO across ranked .kw homepages - [Lebanon Arabic & RTL Website Statistics](https://moayyadfaris.com/arabic-web-stats/rtl-adoption/lebanon): Country report measuring HTML direction, Arabic metadata, logical CSS, fonts, and SEO across ranked .lb homepages - [Oman Arabic & RTL Website Statistics](https://moayyadfaris.com/arabic-web-stats/rtl-adoption/oman): Country report measuring HTML direction, Arabic metadata, logical CSS, fonts, and SEO across ranked .om homepages - [Palestine Arabic & RTL Website Statistics](https://moayyadfaris.com/arabic-web-stats/rtl-adoption/palestine): Country report measuring HTML direction, Arabic metadata, logical CSS, fonts, and SEO across ranked .ps homepages - [Saudi Arabia Arabic & RTL Website Statistics](https://moayyadfaris.com/arabic-web-stats/rtl-adoption/saudi-arabia): Country report measuring HTML direction, Arabic metadata, logical CSS, fonts, and SEO across ranked .sa homepages - [Syria Arabic & RTL Website Statistics](https://moayyadfaris.com/arabic-web-stats/rtl-adoption/syria): Country report measuring HTML direction, Arabic metadata, logical CSS, fonts, and SEO across ranked .sy homepages - [RTL Website Checker](https://moayyadfaris.com/tools/arabic/rtl-website-checker): Free tool to check any public Arabic page against the measured dataset benchmark - [Dataset API (JSON)](https://moayyadfaris.com/api/rtl-adoption-stats): Full machine-readable dataset - [Dataset (CSV)](https://moayyadfaris.com/api/rtl-adoption-stats/csv): Per-site anonymized data export - [Methodology (Markdown)](https://moayyadfaris.com/api/rtl-adoption-stats/methodology): Sampling methodology and detection rules ## Optional - [RSS Feed](https://moayyadfaris.com/feed.xml): All guides and blog posts, newest first - [Privacy Policy](https://moayyadfaris.com/privacy) - [Terms of Service](https://moayyadfaris.com/terms)