Practical insights and guides on PHP/Symfony, React/Next.js, legacy modernization, and software architecture, drawn from 18+ years of building web applications for European businesses.
A five-phase process for modernising a Symfony 2 or 3 codebase to Symfony 7, without the risk and cost of a full rewrite. Covering baseline measurement, upgrade paths, test-first strategies, Rector automation, and safe cutover.
Read moreChoosing the wrong authentication library costs you weeks of refactoring. Auth.js is in maintenance mode, Lucia is deprecated, Better Auth now belongs to Vercel, and Clerk changed its pricing. Here is how the options stack up for multi-tenant B2B SaaS on Next.js 16 in late 2026.
Read moreFrance is Europe's second-largest RegTech market, but its compliance landscape (ACPR, AMF, CNIL, and data residency mandates) creates barriers that catch foreign SaaS vendors off-guard. This guide maps the French RegTech landscape and what you need to know before you pitch.
Read moreA phase-by-phase checklist for wiring Prometheus, Grafana, OpenTelemetry, and Sentry into a single coherent observability stack, covering collector config, SDK instrumentation in Symfony and Next.js, Grafana datasource wiring, alert routing, and the three integration mistakes that cause phantom alerts.
Read moreAI-generated code ships fast but breaks in predictable ways. This guide walks through the seven-dimension vibe code audit Wolf-Tech uses with clients to find architectural, security, and operational gaps before they become production incidents.
Read moreAI coding assistants write React components that pass code review and then leak memory in production. Here are the six most expensive patterns we find in vibe-coded frontends, and the TypeScript rules that prevent them.
Read moreThe practitioner's guide for engineering-led GmbH founders: when your software triggers BaFin licensing exposure, which three insurance products you need (and where the coverage gaps hide), and the contract clauses that cap scope creep on fixed-price engagements.
Read moreAPI Platform 4 generates OpenAPI specs automatically, but without contract tests, the spec and implementation silently diverge. Here's the full pipeline: Schemathesis, oasdiff, Prism, and GitHub Actions wired together.
Read moreEvery AI-assisted PHP project we audit surfaces the same seven vulnerability families: SQL injection adjacent to raw execute calls, missing CSRF tokens, user-controlled file paths, hardcoded secrets, over-privileged JWT claims, open redirects, and Symfony firewall bypasses. This post names each pattern, explains why LLMs generate it, and gives the GrumPHP, Rector, and PHPStan rules that catch it before merge.
Read morePHP 8.4 property hooks are the biggest change to PHP's object model since typed properties. Here's exactly how they interact with Doctrine, Symfony Forms, and API Platform, and which patterns will break your application.
Read more