Lúmina W blog

There was a moment, in the middle of a debugging session at 1 a.m., when we realized something uncomfortable: we had solved the problem, but we had nowhere to write it down.

No document. No note. Just the knowledge floating in the head of whoever lived through it.

That doesn't scale, and it's exactly what this blog is here to fix.

The problem with learning and moving on

In a software startup, knowledge tends to pile up in silence. You learn why a migration fails in production, you figure out how to structure a module so it doesn't become impossible to maintain, you find a vulnerability in a pentesting lab, and all of it disappears.

Not because it doesn't matter. Because nobody wrote it down.

This blog is the space where we document what we build, what we break and what we learn, in real time, without editing out the mess.

Who we are

We're Lúmina W, a software studio in Medellín. We build digital products end to end: research, design, development and what comes after launch. Two of our products, TerraCore (agribusiness management) and OKroot, are the real ground where we test the technical decisions we write about here. This blog talks about them at the product level, what they do and how they're built, not how they're sold or their internal roadmap.

That means you'll read about why an offline-first system resolves a sync conflict a certain way, or how a module was designed to feel like part of a system instead of an isolated screen, but you won't read about pricing, specific customers or roadmap. We draw that line on purpose: the technical and design side is public domain; the commercial side stays out of this space.

What you'll find here

The blog is organized into five categories, all with the same promise: what we write, we lived first.

• AI, how we integrate AI models and tools into real products, with their limits and trade-offs.
• Product, how a product is thought through from scratch, how it's validated and how it evolves with real use.
• Design, interface and experience decisions, design systems and why a screen ends up looking the way it does.
• Development, real technical decisions, architecture, mistakes made and tools that actually work.
• Security, what we learn doing pentesting and how we think about the security of what we build.

Every post carries one of those five categories, whichever best describes its main topic.

How this blog works

This isn't a single-voice blog. Any account can write a post, and posts get published only after the editorial team reviews and approves them. That gives room for different people on the team to write about what they actually worked on, without losing a quality filter before publishing. A post that needs changes isn't rejected in silence: it goes back to whoever wrote it with a note on what to adjust.

The blog has accounts with their own profiles, so you can follow whoever writes what interests you and see everything else they published. Every post can be commented on, comments are threaded (you can reply to a specific comment, not just the post as a whole), and you can like it or save it to read later from your account. None of this requires you to be a writer: reading, commenting and following profiles is open to any registered account.

If you want new posts without checking the blog every day, there's a newsletter: subscribe once and the notice arrives on its own. We publish new content every week, at least two posts, so there's always something recent to read. And starting now, the blog exists in both Spanish and English: every new post has its translated version, so language isn't a barrier to sharing it outside Colombia.

No corporate filter

We're not going to write to look bigger than we are. We're a team solving real problems with limited resources, and that, oddly enough, is the most useful thing we can offer, because most people reading this are in the same situation.

If an article helps you, we're glad. If something is wrong or confusingly explained, write to us from luminaw.co. We prefer public correction over comfortable silence.

The first post

The first technical article is already published, and it's about something that had us thinking for days.

We fully compromised a server, from scratch, with no prior credentials, using only a comment someone left in the source code. The whole process is documented step by step in the writeup of DockerLabs' Forgotten_Portal lab.

Read the first post