Practical insights and guides on PHP/Symfony, React/Next.js, legacy modernization, and software architecture, drawn from 18+ years of building web applications for European businesses.
Choosing a tech stack for your SaaS MVP is not a technical question — it is a business risk decision. This framework covers the four constraints that actually determine the right stack, five MVP archetypes with concrete recommendations, and the red flags that lead to expensive rewrites at Series A.
Read moreA five-phase process for modernising a Symfony 2 or 3 codebase to Symfony 7 — without the risk and cost of a full rewrite. Covering baseline measurement, upgrade paths, test-first strategies, Rector automation, and safe cutover.
Read moreChoosing the wrong authentication library costs you weeks of refactoring. Here is how Auth.js v5, Clerk, Better Auth, and Lucia stack up for multi-tenant B2B SaaS built on Next.js 15.
Read moreFrance is Europe's second-largest RegTech market, but its compliance landscape — ACPR, AMF, CNIL, and data residency mandates — creates barriers that catch foreign SaaS vendors off-guard. This guide maps the French RegTech landscape and what you need to know before you pitch.
Read moreA phase-by-phase checklist for wiring Prometheus, Grafana, OpenTelemetry, and Sentry into a single coherent observability stack — covering collector config, SDK instrumentation in Symfony and Next.js, Grafana datasource wiring, alert routing, and the three integration mistakes that cause phantom alerts.
Read moreAI-generated code ships fast but breaks in predictable ways. This guide walks through the seven-dimension vibe code audit Wolf-Tech uses with clients to find architectural, security, and operational gaps before they become production incidents.
Read moreAI coding assistants write React components that pass code review and then leak memory in production. Here are the six most expensive patterns we find in vibe-coded frontends — and the TypeScript rules that prevent them.
Read moreThe practitioner's guide for engineering-led GmbH founders: when your software triggers BaFin licensing exposure, which three insurance products you need (and where the coverage gaps hide), and the contract clauses that cap scope creep on fixed-price engagements.
Read moreAPI Platform 4 generates OpenAPI specs automatically — but without contract tests, the spec and implementation silently diverge. Here's the full pipeline: Schemathesis, oasdiff, Prism, and GitHub Actions wired together.
Read moreEvery AI-assisted PHP project we audit surfaces the same seven vulnerability families: SQL injection adjacent to raw execute calls, missing CSRF tokens, user-controlled file paths, hardcoded secrets, over-privileged JWT claims, open redirects, and Symfony firewall bypasses. This post names each pattern, explains why LLMs generate it, and gives the GrumPHP, Rector, and PHPStan rules that catch it before merge.
Read more