Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Structured Output with LLMs: JSON Mode, JSON Schema and GetResponseAsync<T>
We see why parsing free text with a regex breaks, why JSON mode is not enough and how a JSON schema pins the format. We use Zod in TypeScript and GetResponseAsync<T> in C#, catch an answer that matches the schema but is wrong, and build two layers of validation.
Writing Prompts for LLMs (2): Step-by-Step Thinking and Reasoning Models
Does saying think step by step guarantee the right answer? We ask gemma3:4b a tricky order calculation in three ways, separate the thinking from the answer with qwen3:4b's think parameter, use ReasoningOptions in C# and measure what thinking costs in tokens and time.
Writing Prompts for LLMs (1): Clear Instructions, Delimiters and Few-shot
A prompt is a specification: context, task, input, format and constraints. We compare a bad and a good prompt on the same review with token counts, separate instructions from data with delimiters, and see with real gemma3:4b output how few-shot examples fix a classifier and how they mislead it.
Streaming LLM Responses: NDJSON, IAsyncEnumerable and Time to First Token
Streaming does not make the answer faster, it makes the wait shorter. We look at Ollama's NDJSON and OpenAI-compatible SSE streams with curl, read the answer with GetStreamingResponseAsync in C# and an async iterator in TypeScript, measure the time to first token, and cancel the stream in two SDKs to see how they differ.
Sampling in LLMs: Temperature, Top-p, Top-k and Seed
Why does the same question get different answers? We look at the model's candidate tokens with logprobs, calculate how temperature, top-k and top-p reshape that distribution, and see the promise and the limits of a seed, num_predict and stop sequences with real output from gemma3:4b.
LLM Message Roles and the System Prompt: Giving the Bookstore Assistant an Identity
What are the system, user and assistant roles for, and how does Gemma 3's chat template carry them to the model? We write a system prompt for the Bookstore assistant, look at the parts of a good system prompt, and use real output to see how a forged assistant message from the client fools the model and how far separating user text from instructions helps as a first step against prompt injection.
The LLM Context Window: What the Model Remembers and What It Silently Cuts
LLM APIs are stateless; you send the chat history with every request and every turn grows the bill. Even though Gemma 3 supports 128K tokens, Ollama allocates a 4096-token window by default and cuts a 4498-token prompt down to 2051 tokens without any error. We set num_ctx in C# and TypeScript and try managing history with trimming and summarizing, using real output.
Tokens and Tokenizers in LLMs: Why Does Turkish Take More Tokens?
What is a token, and how do BPE and SentencePiece split text? Using Ollama's prompt_eval_count counter we measure the same sentence in Turkish and English with the gemma3:4b and qwen3:4b tokenizers, then see with real numbers how many tokens numbers, GUIDs, JSON and code take, the hidden tokens of the chat template and how tokens affect cost, limits and speed.
Your First LLM Request: The First Answer with Ollama, C# and TypeScript
We get to know Ollama, look at models with ollama list and ollama ps, and send the first request to the /api/chat endpoint with curl. Then we repeat it in C# with Microsoft.Extensions.AI and OllamaSharp and in TypeScript with the ollama package, and use real output to read the token counts, the nanosecond durations and why the first request is slow.
What Is an LLM? Large Language Models from a Developer's Point of View
A large language model is a function that predicts the next token. We build that loop token by token with a local gemma3:4b, look at training versus inference, base versus instruct, open-weight versus closed and local versus cloud, and use real outputs to see where the model goes wrong on dates, arithmetic and order questions.
OWASP Beyond the Top 10: API Security, LLM Top 10, ASVS and the Cheat Sheet Series
We step outside the Top 10: the API Security Top 10 (2023) and the split between BOLA, BOPLA and BFLA, preventing property-level data exposure with a response DTO, the Top 10 for LLM Applications (2025), ASVS 5.0 and the Cheat Sheet Series. We also talk about how the series continues with new Top 10 editions and which security series come next.
OWASP Top 10: What Changed from 2021 to 2025 and Updating Old Documents
SSRF joining A01, the components problem growing into Software Supply Chain Failures, Security Misconfiguration rising to second place, the new A10 Mishandling of Exceptional Conditions and three renames. We read the 2025 methodology with its numbers and write a small .NET tool that finds old and year-less category numbers and suggests their 2025 counterparts.