Practical insights and guides on PHP/Symfony, React/Next.js, legacy modernization, and software architecture, drawn from 18+ years of building web applications for European businesses.
The practitioner's guide for engineering-led GmbH founders: when your software triggers BaFin licensing exposure, which three insurance products you need (and where the coverage gaps hide), and the contract clauses that cap scope creep on fixed-price engagements.
Read moreAPI Platform 4 generates OpenAPI specs automatically — but without contract tests, the spec and implementation silently diverge. Here's the full pipeline: Schemathesis, oasdiff, Prism, and GitHub Actions wired together.
Read moreEvery AI-assisted PHP project we audit surfaces the same seven vulnerability families: SQL injection adjacent to raw execute calls, missing CSRF tokens, user-controlled file paths, hardcoded secrets, over-privileged JWT claims, open redirects, and Symfony firewall bypasses. This post names each pattern, explains why LLMs generate it, and gives the GrumPHP, Rector, and PHPStan rules that catch it before merge.
Read morePHP 8.4 property hooks are the biggest change to PHP's object model since typed properties. Here's exactly how they interact with Doctrine, Symfony Forms, and API Platform — and which patterns will break your application.
Read moreThe multi-tenancy strategy you pick today is nearly impossible to reverse at scale. This guide maps all three Doctrine patterns against GDPR isolation, migration complexity, and connection-pool limits so you can choose once and choose right.
Read moreA Berlin consultancy invoicing a French client, a German GmbH placing engineers on-site in Amsterdam — these trigger different VAT and permanent-establishment outcomes most founders only discover during a cross-border audit. Here is the practical map.
Read moreCursor, Copilot, and ChatGPT keep suggesting the same handful of npm packages — and five of them are deprecated, supply-chain risks, or production landmines. Here is what we find in real vibe-coded codebases, why each package is dangerous in 2026, and the modern replacements we install during every rescue.
Read moreA real-world migration playbook for large Doctrine 1.x codebases: schema-first entity generation, a dual-ORM bridge that keeps legacy controllers alive, a snapshot-based test harness, and the four-month cutover sequence that retired 700K lines without freezing feature work.
Read moreDORA is no longer just a bank problem. If you sell software to European financial institutions, you are an ICT third-party provider — and your contracts, runbooks, and pen-test cadence are now subject to supervisory scrutiny. Here is the vendor-side playbook.
Read moreRAG demos look great — production RAG fails predictably. Here is what goes wrong with chunking and reranking, and the four-question eval harness that catches 80% of regressions before they reach users.
Read more