---
title: "Notes — Shreyansh Kumar Singh"
description: "Technical answers from his own projects."
url: https://www.shreyanshkumarsingh.com/notes
author: Shreyansh Kumar Singh
updated: 2026-10-08
---

# Technical notes by Shreyansh Kumar Singh — AI & full-stack engineering

## [How do autonomous penetration-testing tools avoid reporting false positives?](https://www.shreyanshkumarsingh.com/notes/ai-pentest-agent-false-positives)

By refusing to report anything they can't prove. A finding should only reach the report when the scanner has captured physical evidence of exploitation — a database error signature, an unencoded reflection of a unique payload, real command output, a known file signature, or a template expression that actually evaluated — and anything without that evidence should be discarded, not downgraded to 'possible'.

## [What does an honest security self-audit of an AI application look like, and how should findings be ranked P0 to P3?](https://www.shreyanshkumarsingh.com/notes/ai-app-security-self-audit-p0-p3)

Review your own system as an outsider would, write every finding down graded by consequence — P0 for security and data exposure, P1 for crashes, P2 for correctness and scale, P3 for polish — lead with the worst, and keep the document next to the fixes. For AI apps, the P0s are usually the same three: no authentication, prompt injection through user-controlled message history, and an unmetered paid model endpoint.

## [How can an AI agent verify that a bug is actually fixed rather than trusting the commit log?](https://www.shreyanshkumarsingh.com/notes/ai-agent-bug-fix-verification)

Make it re-run the bug, not read the diff: the agent reproduces the reported steps against the live QA environment, captures what the application actually does, and marks the bug fixed only if that evidence shows the defect is gone. If the evidence can't be produced, the result is 'not verified' — never 'probably fixed'.

## [How should a RAG pipeline be structured so each stage can be tested and replaced independently?](https://www.shreyanshkumarsingh.com/notes/modular-rag-pipeline-architecture)

Split it into four stages with explicit contracts — embedding (text in, vectors out), storage (vectors and their source passages), retrieval (question in, ranked passages out) and generation (question plus passages in, cited answer out) — and test each stage against its own fixed inputs. Then a weak stage shows up on its own scorecard instead of hiding behind a fluent final answer.

## [Why does blast damage radius scale with the cube root of yield?](https://www.shreyanshkumarsingh.com/notes/blast-radius-cube-root-scaling)

Because a blast's energy spreads through a volume, and volume grows with the cube of distance: to get the same overpressure at a larger distance R, you need energy proportional to R³, so R grows as the cube root of the energy. That's Hopkinson–Cranz scaling — a thousand times the yield moves any given overpressure contour only about ten times further out.

## [How do you reduce jitter in a React Three Fiber scene without raising the frame rate?](https://www.shreyanshkumarsingh.com/notes/react-three-fiber-raycast-throttling)

Find the per-frame work that changes what's on screen and run it less often. In Antarang's walkable 3D museum, the centre-screen raycast that decides which artwork you're focused on ran every frame; throttling it to about ten times a second made the gallery feel smoother than any frame-rate tuning did.

## [Is a canvas image sequence better than a video element for scroll-driven product animation in Next.js?](https://www.shreyanshkumarsingh.com/notes/canvas-image-sequence-vs-video-scroll-animation)

For animation scrubbed directly by the scroll bar, yes: a canvas image sequence maps each scroll position to one exact, already-decoded frame and draws it instantly in either direction, while seeking a compressed video — especially backwards — waits on the decoder and stutters. Use video when the clip plays on its own; use a frame sequence when the user's scroll is the playhead.

## [How do you load-test a mobile app's backend with k6 across several machines before a fixed launch date?](https://www.shreyanshkumarsingh.com/notes/distributed-k6-load-testing)

Run k6 as an agent on each machine, coordinate them from one controller that splits the target request rate and starts them together, script the real user journey rather than single endpoints, and merge the raw results instead of averaging per-machine summaries. For the Dada Udyogini launch, Shreyansh designed DadaLoad to do exactly that across up to ten Windows machines.


---

Shreyansh Kumar Singh — AI & Full-Stack Engineer, Pune, India. Contact: shreyanshkumarsingh208@gmail.com or https://www.shreyanshkumarsingh.com/contact (call and WhatsApp buttons). More: https://www.shreyanshkumarsingh.com/llms.txt · https://www.shreyanshkumarsingh.com/sitemap.xml