The blog
What we've been building, breaking and thinking about. Written by the people doing the work.
Shopify Now Sends Erasure Requests After 5 Days
Shopify now passes customer erasure requests to apps after 5 days, not 10, so here is how to check your custom app and integrations really delete the data.
PostgreSQL Fixed 52 Security Bugs. Version 14 Is Done
What PostgreSQL's 12 November release and its 52 security fixes mean for the database behind your custom software, and what to do if you're still on 14.
A Critical Apache Flaw Was Fixed. Check Your Server
What the critical Apache HTTP/2 flaw fixed in 2.4.71 means for servers running your custom software, how to check yours and what to do if you can't patch yet.
.NET 8 Went Out of Support Yesterday. Now What?
Microsoft stopped patching .NET 8 and 9 on 10 November 2026, so here is how to check what your app runs on and choose between .NET 10 and .NET 11.
12 Questions That Reveal If Your AI App Is a Time Bomb
Twelve plain questions on security, data, scale and upkeep that show whether your AI-built app is in trouble, and no technical knowledge needed.
Claude Code's 'Don't Ask Again' Can Save Your Passwords
What Claude Code's 'don't ask again' button writes into your project, how passwords ended up on GitHub, and the checks to run on your own code today.
Shopify Now Wants Bulk Operations Switched On. Is Yours?
Shopify apps built by a Partner now need bulk operations enabled first, so here is who is affected, the 31-day catch and how to check your integration.
A Very Long Password Can Get Root on Some Alpine Servers
What the OpenSSH 10.6p2 fix for musl systems is about, which servers and containers are exposed, and the two-minute change that closes it.
PHP2Shell Was Patched. Old PHP Apps Are Still the Problem
What PHP2Shell means if your business runs an old PHP app, why the patch only helps on supported versions, and how to get off an end of life PHP branch.
Stolen AI Keys Can Cost $100,000 a Day. Is Yours Safe?
Google's new LLMjacking report shows how stolen AI and cloud keys run up huge bills, and the practical checks to make on any app that calls an AI model.
Most of Your AI Agent's Steps Don't Need a Frontier Model
What Gartner's research on open-weight models means for apps with AI agents, and how to find which steps could run cheaper and closer to home.
Linux Moved Its AI Bug Fixes Earlier. Your Code Should Too
What the Linux 7.4 merge window shows about using AI to find bugs, and how to fit AI review and human sign-off into your own software process.
So You Built It on Lovable. Now What?
You shipped something on Lovable and you're not sure what's underneath. Here's how to tell if there's a problem, and a five-minute test to run yourself.
If the AI Bubble Bursts, What Happens to Your App?
What a burst AI bubble would mean for tools like Lovable and Copilot, why the cheap prices may not last, and how to protect software built with them.
That Linux TCP Flaw: Your Go App May Change the Risk
A critical Linux TCP flaw has a claimed remote root exploit that needs multipath TCP, and Go apps can turn that on by default, so here's what to check.
If Your Software Supplier Went Bust, What Would You Do?
A GP website supplier's collapse has left practices hunting for replacements. Five things any small firm can check now about the suppliers it relies on.
Shopify Changed Who Counts as a Customer With an Account
A customer's first Shopify sign-in now sets them to ENABLED and fires webhooks. What changed, who it affects and what to check in custom apps and themes.
What Does AI Tell Shoppers About Your Shopify Store?
Shopify's Knowledge base holds the facts AI agents use to answer shoppers. Here's what changed, what to check, and why to do it before Black Friday.
Your Custom Shopify App Can Now Report Into Analytics
Custom Shopify apps can now send their activity into Shopify Analytics. Here's what changed, the small print, and whether it's worth doing.
Shopify Can Now Lock Your App's Token to Your Servers
Shopify now lets you lock an app's Admin API token to your own servers. Here's what it does, who can use it and how to avoid locking yourself out.
Tell us what you've got
It goes straight to Rob and Jase. You'll hear back from one of us, usually the same day, and we'll tell you honestly whether we're the right people.