Practical insights and guides on PHP/Symfony, React/Next.js, legacy modernization, and software architecture, drawn from 18+ years of building web applications for European businesses.
Enterprise buyers always ask for SAML SSO and SCIM. Most SaaS founders reach for WorkOS — then panic when the bill scales. Here is a lean, production-tested implementation with Symfony and Next.js that handles Okta, Entra ID, and Google Workspace without a recurring platform fee.
Read moreMost small SaaS teams waste months on SOC 2 controls auditors rarely test. This engineering-led checklist covers the access-review automations, change-management evidence, vendor-risk workflows, and monitoring gaps that show up as real findings — with concrete notes for Symfony and Next.js stacks.
Read moreDORA's ICT third-party risk obligations now cascade down to every SaaS vendor selling to EU financial institutions. Here are the concrete engineering deliverables you need to pass a bank's DORA audit without building a dedicated compliance team.
Read moreEHDS is forcing every European MedTech SaaS to expose patient data in standardized formats, support secondary-use consent flows, and integrate with national Health Data Access Bodies. Here is exactly what that means for your architecture — and how to phase the work without derailing your roadmap.
Read moreAI-generated SaaS codebases consistently ship with the same EU compliance gaps: cosmetic cookie banners, missing data subject request flows, no audit logs, and accessibility that fails WCAG 2.2 immediately. This checklist helps founders catch what vibe coding skips.
Read moreAI-generated test suites look impressive at a glance — high file counts, familiar patterns, green CI pipelines. This post catalogs the failure modes we actually find when auditing vibe-coded codebases: tests that never run the code they claim to cover, mocks that assert nothing real, and coverage numbers that measure files touched rather than logic exercised.
Read moreKubernetes is powerful — but for indie SaaS teams of 1–10, the operational overhead often outweighs the benefits. This guide compares Kamal, Coolify, and Dokploy against Kubernetes for real production deployments.
Read moreSoftware supply chain attacks are now routine. This guide covers SBOM generation in CI, dependency scanning with real triage, provenance attestation, and what to do when a dependency is compromised — built for small teams with NIS2 obligations.
Read moreMigrating from Symfony 2 or 3 to Symfony 7 in a single step is effectively a rewrite. This guide explains the realistic multi-version path — intermediate stops at 4.4 LTS and 6.4 LTS, key breaking changes at each boundary, and how to keep shipping features while the migration is in progress.
Read moreRunning a live Create React App or Pages Router codebase and want App Router benefits without a big-bang rewrite? Here is the realistic incremental path: parallel routing, shared auth, hydration gotchas, and the mistakes that force teams to roll back halfway through.
Read more