Practical insights and guides on PHP/Symfony, React/Next.js, legacy modernization, and software architecture, drawn from 18+ years of building web applications for European businesses.
Enterprise customers are starting to ask whether your product has an MCP server. Here is a practical, production-minded guide to building one in Symfony: SDK choice, tool design, OAuth, multi-tenant scoping, and the testing setup that keeps it safe.
Read morePure vector search misses exact terms, pure keyword search misses paraphrases. Here is how to combine pgvector with Postgres full-text ranking into one hybrid query, including Reciprocal Rank Fusion in plain SQL.
Read moreBuyers no longer file your Data Processing Agreement and forget it. Their security teams check whether the controls behind each clause actually exist. This post maps the common DPA commitments to the engineering evidence that proves them: subprocessor inventories, erasure workflows, breach runbooks, and audit-ready logs.
Read moreThe CRA vulnerability handling and reporting obligations apply from 11 September 2026, more than a year before CE marking. Here is how to build a coordinated disclosure process that satisfies Annex I, the 24-hour ENISA reporting duty, and the auditors who will eventually check both.
Read morePayment-adjacent SaaS teams often assume PSD-style rules stop at their partner bank. PSD3 and the Payment Services Regulation redraw that line. Here is how to test your scope and which architecture decisions to make before the rules apply.
Read moreTeams that build on third-party foundation models inherit GPAI transparency duties they rarely realise exist. Here is which disclosures apply to integrators versus model providers, and how to surface them without scaring users.
Read moreMost SaaS teams cannot tell whether their AI features fall under the EU AI Act's high-risk rules. This guide walks through Annex III scope checks, the conformity assessment route, Annex IV documentation, and CE marking — step by step.
Read moreNIS2 gives you 24 hours to file an early warning after detecting a significant incident. That clock is unforgiving if you design the process mid-crisis. Here is the runbook to build now.
Read moreMost Next.js performance problems are invisible until they hit production. This guide covers the measurement-first profiling workflow — using instrumentation hooks, bundle analyzer, and Lighthouse CI — then the four highest-impact optimizations for TTFB, JavaScript bundles, images, and database queries in Next.js 15.
Read moreChoosing a tech stack for your SaaS MVP is one of the few early decisions that echoes through every funding round and engineering hire that follows. Here is the structured framework that separates defensible choices from expensive regrets.
Read more