The First Performance Fix Is Usually a Measurement
Before changing a slow page, find out which users are waiting, what they are waiting for, and where the time goes.
Insights
Notes From the Build Process
What we've learned building and running software for clients, and notes from our studio.
What We Ask Before Quoting a Project
A useful estimate starts with scope, constraints, and ownership. Here are the questions worth answering before a number appears.
When a Monolith Is the Right Architecture
A single deployable application can be easier to change and operate than a fleet of services. The boundaries inside it still matter.
Design the Form Around the Answer You Need
Every extra field costs attention. Ask only what changes the next step, and make errors easy to repair.
The EU AI Act for Small Product Teams: Dates That Matter
The AI Act's transparency rules started applying in August 2026. If you sell to EU users and your product talks to people or generates content, you have work to do.
An API Contract Is More Than a List of Endpoints
Good integrations agree on errors, retries, ownership, and change rules before the first request reaches production.
Accessibility Is Part of the First Design Review
Catching access problems in the first review is cheaper than rebuilding a finished component.
How We Choose Technology for a Client Project
The best stack is one the client can run, hire for, and change after handover.
Why We Default to Security Hardening From Day One
Security work gets expensive when you schedule it for the end. We build it into the first sprint, and it costs less there.
Migrating to Cloud-Native: What Breaks
Migration guides skip the messy parts. These are the failures we see when a team moves an older app to the cloud, and how we plan around them.
What Makes an AI Support Assistant Useful
AI chat widgets frustrate users when they try to answer everything. The ones that work have a narrow job, good sources and a fast way to reach a person.
Handing a Product Over Without Handing Over a Mystery
A good handover lets the next team deploy, diagnose, and change the product without relying on its original builders.
Alerts Worth Waking Up For
If your team ignores alerts, you have too many. We keep a short list tied to what users feel, and we delete the rest.
How We Test LLM Features Before Launch
You can't unit-test a language model the way you test a function. You can build an evaluation set, score it on every change and catch regressions before users do.
What the OWASP Top 10:2025 Changes Mean for Your Web App
OWASP reshuffled its list in 2025. Two changes deserve your attention: supply chain failures moved up, and error handling got its own category.
Zero-Downtime Deploys Without Kubernetes
You don't need a cluster to ship updates without taking your site down. A load balancer, two app instances and a migration rule get you most of the way.
Designing Around Prompt Injection
Prompt injection tops OWASP's list of LLM risks for 2025. You can't filter it away, so we design systems where a hijacked model can't do much damage.
Keeping LLM Costs Predictable
AI features bill per token, so a popular feature or a runaway loop can double your costs overnight. We budget for them the same way we budget for servers.
Keep Secrets Out of Git: The Setup We Use on Every Project
GitGuardian found 23.8 million secrets pushed to public GitHub in 2024. A few habits and two tools keep your keys out of that number.
Cutting Your Cloud Bill Without a Rewrite
The FinOps Foundation's 2025 survey ranked waste reduction as teams' top priority. Most savings come from a few boring changes you can make this month.
Building a RAG Search Your Team Will Trust
Retrieval-augmented generation lets staff ask questions of your own documents. Trust depends on retrieval quality, citations and saying "I don't know".
Adding Passkeys to Your Customer Login
Passkeys cut failed sign-ins and remove the password database as a target. You can add them next to your current login without forcing anyone to switch.
Test Your Backups by Restoring Them
A backup job that reports success tells you a file was written. Only a restore tells you the data comes back. We schedule restore drills for every client system.
Hardening a WordPress Site Before Launch
WordPress runs a large share of the web, which makes it a large target. Our pre-launch checklist covers the settings attackers probe first.
Terraform for Small Teams: Where It Pays Off
Infrastructure as code sounds like overhead for a three-person team. It pays for itself the first time you need to rebuild or copy an environment.
After Shai-Hulud: How We Lock Down npm Dependencies
A self-spreading worm hit hundreds of npm packages in September 2025. Here is a practical checklist for JavaScript projects.