<?xml version="1.0" encoding="UTF-8"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Ricardo Hernández · Writing</title><description>Lead full-stack software engineer. Payments, web performance and observability. Remote with U.S. teams since 2016.</description><link>https://ricardohernandez.dev/</link><language>en</language><atom:link href="https://ricardohernandez.dev/rss.xml" rel="self" type="application/rss+xml"/><item><title>Detecting fraudulent affiliate traffic by crossing data</title><link>https://ricardohernandez.dev/writing/affiliate-fraud/</link><guid isPermaLink="true">https://ricardohernandez.dev/writing/affiliate-fraud/</guid><description>How a CLS spike led me to popunders in our affiliate program, then to publishers buying their own Google Ads: the data I crossed, the keys that join it, the signals and the checks to run.</description><pubDate>Mon, 05 Oct 2026 00:00:00 GMT</pubDate></item></channel></rss>