PHP & React Development Insights

Practical insights and guides on PHP/Symfony, React/Next.js, legacy modernization, and software architecture, drawn from 18+ years of building web applications for European businesses.

The Security Audit Checklist for AI-Generated PHP: 7 Vulnerability Patterns in Every Vibe-Coded Codebase

May 29, 2026

Every AI-assisted PHP project we audit surfaces the same seven vulnerability families: SQL injection adjacent to raw execute calls, missing CSRF tokens, user-controlled file paths, hardcoded secrets, over-privileged JWT claims, open redirects, and Symfony firewall bypasses. This post names each pattern, explains why LLMs generate it, and gives the GrumPHP, Rector, and PHPStan rules that catch it before merge.

PHP 8.4 Property Hooks in Symfony: What They Change for Entity Design, DTOs, and Form Objects

May 29, 2026

PHP 8.4 property hooks are the biggest change to PHP's object model since typed properties. Here's exactly how they interact with Doctrine, Symfony Forms, and API Platform — and which patterns will break your application.

Symfony Doctrine Multi-Tenant Database Architecture: Shared Schema vs Schema-Per-Tenant vs DB-Per-Tenant — a 2026 Decision Matrix

May 29, 2026

The multi-tenancy strategy you pick today is nearly impossible to reverse at scale. This guide maps all three Doctrine patterns against GDPR isolation, migration complexity, and connection-pool limits so you can choose once and choose right.

Selling Software Engineering Time Across the EU: VAT, Reverse-Charge, and Permanent-Establishment Rules That Decide Where You Owe Tax

May 28, 2026

A Berlin consultancy invoicing a French client, a German GmbH placing engineers on-site in Amsterdam — these trigger different VAT and permanent-establishment outcomes most founders only discover during a cross-border audit. Here is the practical map.

The Five npm Packages AI Coding Assistants Keep Recommending — and Why Each One Belongs Nowhere Near Production

May 28, 2026

Cursor, Copilot, and ChatGPT keep suggesting the same handful of npm packages — and five of them are deprecated, supply-chain risks, or production landmines. Here is what we find in real vibe-coded codebases, why each package is dangerous in 2026, and the modern replacements we install during every rescue.

Migrating 700K Lines of Doctrine 1.x: A Schema-First Path to Doctrine 3 Without a Code Freeze

May 27, 2026

A real-world migration playbook for large Doctrine 1.x codebases: schema-first entity generation, a dual-ORM bridge that keeps legacy controllers alive, a snapshot-based test harness, and the four-month cutover sequence that retired 700K lines without freezing feature work.

DORA for SaaS Vendors to European Banks: The Subcontractor Register, Exit Strategy, and Pen-Test Reports You Now Need

May 26, 2026

DORA is no longer just a bank problem. If you sell software to European financial institutions, you are an ICT third-party provider — and your contracts, runbooks, and pen-test cadence are now subject to supervisory scrutiny. Here is the vendor-side playbook.

Why Your RAG Pipeline Returns Confident Garbage: Chunk Sizing, Reranking, and the Eval Harness You Need Before Shipping

May 26, 2026

RAG demos look great — production RAG fails predictably. Here is what goes wrong with chunking and reranking, and the four-question eval harness that catches 80% of regressions before they reach users.

From Pricing Page to Stripe: The Engineering Decisions That Determine Whether Your Net Revenue Retention Cracks 110%

May 25, 2026

Most SaaS teams wire up Stripe in a weekend and call it done. The teams hitting 110%+ NRR make a different set of engineering decisions — on proration, upgrade flows, dunning, and metered billing — that compound quietly into millions of ARR.

LLM Agents on the Symfony Workflow Component: State Machines, Idempotent Steps, and Replayable Failures

May 25, 2026

Most production LLM agents fail not because the model is wrong, but because the orchestration layer cannot recover when one step times out. This post shows how the Symfony Workflow Component — built for business processes — makes an excellent agent loop runtime with explicit state, replayable transitions, and built-in audit traces.