Practical insights and guides on PHP/Symfony, React/Next.js, legacy modernization, and software architecture, drawn from 18+ years of building web applications for European businesses.
AI-generated code ships fast but breaks in predictable ways. This guide walks through the seven-dimension vibe code audit Wolf-Tech uses with clients to find architectural, security, and operational gaps before they become production incidents.
Read moreAI coding assistants write React components that pass code review and then leak memory in production. Here are the six most expensive patterns we find in vibe-coded frontends — and the TypeScript rules that prevent them.
Read moreThe practitioner's guide for engineering-led GmbH founders: when your software triggers BaFin licensing exposure, which three insurance products you need (and where the coverage gaps hide), and the contract clauses that cap scope creep on fixed-price engagements.
Read moreAPI Platform 4 generates OpenAPI specs automatically — but without contract tests, the spec and implementation silently diverge. Here's the full pipeline: Schemathesis, oasdiff, Prism, and GitHub Actions wired together.
Read moreEvery AI-assisted PHP project we audit surfaces the same seven vulnerability families: SQL injection adjacent to raw execute calls, missing CSRF tokens, user-controlled file paths, hardcoded secrets, over-privileged JWT claims, open redirects, and Symfony firewall bypasses. This post names each pattern, explains why LLMs generate it, and gives the GrumPHP, Rector, and PHPStan rules that catch it before merge.
Read morePHP 8.4 property hooks are the biggest change to PHP's object model since typed properties. Here's exactly how they interact with Doctrine, Symfony Forms, and API Platform — and which patterns will break your application.
Read moreThe multi-tenancy strategy you pick today is nearly impossible to reverse at scale. This guide maps all three Doctrine patterns against GDPR isolation, migration complexity, and connection-pool limits so you can choose once and choose right.
Read moreA Berlin consultancy invoicing a French client, a German GmbH placing engineers on-site in Amsterdam — these trigger different VAT and permanent-establishment outcomes most founders only discover during a cross-border audit. Here is the practical map.
Read moreCursor, Copilot, and ChatGPT keep suggesting the same handful of npm packages — and five of them are deprecated, supply-chain risks, or production landmines. Here is what we find in real vibe-coded codebases, why each package is dangerous in 2026, and the modern replacements we install during every rescue.
Read moreA real-world migration playbook for large Doctrine 1.x codebases: schema-first entity generation, a dual-ORM bridge that keeps legacy controllers alive, a snapshot-based test harness, and the four-month cutover sequence that retired 700K lines without freezing feature work.
Read more