The blog
What we've been building, breaking and thinking about. Written by the people doing the work.
12 Questions That Reveal If Your AI App Is a Time Bomb
Twelve plain questions on security, data, scale and upkeep that show whether your AI-built app is in trouble, and no technical knowledge needed.
Claude Code's 'Don't Ask Again' Can Save Your Passwords
What Claude Code's 'don't ask again' button writes into your project, how passwords ended up on GitHub, and the checks to run on your own code today.
Shopify Now Wants Bulk Operations Switched On. Is Yours?
Shopify apps built by a Partner now need bulk operations enabled first, so here is who is affected, the 31-day catch and how to check your integration.
A Very Long Password Can Get Root on Some Alpine Servers
What the OpenSSH 10.6p2 fix for musl systems is about, which servers and containers are exposed, and the two-minute change that closes it.
PHP2Shell Was Patched. Old PHP Apps Are Still the Problem
What PHP2Shell means if your business runs an old PHP app, why the patch only helps on supported versions, and how to get off an end of life PHP branch.
Stolen AI Keys Can Cost $100,000 a Day. Is Yours Safe?
Google's new LLMjacking report shows how stolen AI and cloud keys run up huge bills, and the practical checks to make on any app that calls an AI model.
Most of Your AI Agent's Steps Don't Need a Frontier Model
What Gartner's research on open-weight models means for apps with AI agents, and how to find which steps could run cheaper and closer to home.
Linux Moved Its AI Bug Fixes Earlier. Your Code Should Too
What the Linux 7.4 merge window shows about using AI to find bugs, and how to fit AI review and human sign-off into your own software process.
So You Built It on Lovable. Now What?
You shipped something on Lovable and you're not sure what's underneath. Here's how to tell if there's a problem, and a five-minute test to run yourself.
If the AI Bubble Bursts, What Happens to Your App?
What a burst AI bubble would mean for tools like Lovable and Copilot, why the cheap prices may not last, and how to protect software built with them.
That Linux TCP Flaw: Your Go App May Change the Risk
A critical Linux TCP flaw has a claimed remote root exploit that needs multipath TCP, and Go apps can turn that on by default, so here's what to check.
If Your Software Supplier Went Bust, What Would You Do?
A GP website supplier's collapse has left practices hunting for replacements. Five things any small firm can check now about the suppliers it relies on.
Shopify Changed Who Counts as a Customer With an Account
A customer's first Shopify sign-in now sets them to ENABLED and fires webhooks. What changed, who it affects and what to check in custom apps and themes.
What Does AI Tell Shoppers About Your Shopify Store?
Shopify's Knowledge base holds the facts AI agents use to answer shoppers. Here's what changed, what to check, and why to do it before Black Friday.
Your Custom Shopify App Can Now Report Into Analytics
Custom Shopify apps can now send their activity into Shopify Analytics. Here's what changed, the small print, and whether it's worth doing.
Shopify Can Now Lock Your App's Token to Your Servers
Shopify now lets you lock an app's Admin API token to your own servers. Here's what it does, who can use it and how to avoid locking yourself out.
AI Models Got Cheaper. Your App Might Not Have Noticed
AI models have got much cheaper, but your app keeps paying for the old one until someone changes it. Here's what to check and how to switch safely.
Should You Build Your MVP With AI? An Honest Answer.
Yes for prototypes and internal tools, but be careful once it holds sensitive data or has to last. Here's a rule of thumb you can actually use.
Shopify Polaris 2.0 Is Out. Your Custom App Won't Move
Polaris 2.0 is stable, but your custom Shopify app won't move on its own. Here's what changed, what the update involves and what I'd do this week.
Shopify App Tokens Are Going to Expire. Is Yours Ready?
Shopify app tokens must move to expiring access by 1 January 2027. Here's what the migration involves and what I'd do this week if I had an app.
Tell us what you've got
It goes straight to Rob and Jase. You'll hear back from one of us, usually the same day, and we'll tell you honestly whether we're the right people.