Preparing for a penetration test: a 10-point checklist for SMEs
What to do before your first pentest. From defining scope to managing access, a practical guide to solidify your preparation.
read more →Notes on software and security
Expert guides and current analysis on software development, product, integration and cyber security.
Backups aren’t enough: the 3-2-1 rule and disaster recovery
Real protection against data loss requires more than a regular backup. An untested backup is no backup.
Off-the-shelf or custom software? Making the right call
There is no single answer for every business. The criteria to weigh when deciding.
An introduction to Zero Trust architecture
The “trust everyone inside” era is over. Why does modern security verify every access?
Technical SEO: fundamentals for B2B technology sites
To be visible you must first be findable. How do search engines understand your site?
An API-first approach to system integration
Disconnected systems create data silos. How should modern integration be designed?
It looked great in the demo: how to ship an AI feature that survives production
Three questions decide it: who pays when the model is wrong, who verifies the output, what does a request cost? Evaluation sets, security limits and budgets.
How should you review AI-generated code? Quality rules and acceptance criteria
AI-written code compiles and reads fine, so the failures moved elsewhere. Practical acceptance rules for duplication, swallowed errors and invented packages.
Why does ChatGPT never mention us? What actually works for visibility in AI search
Why AI assistants never mention your site: which bots to allow, what llms.txt really does, what cited pages look like and how to actually measure any of it.
Why API security is a problem of its own: the OWASP API Security Top 10 (2023)
APIs are the backbone of modern software, and also its most attacked layer. In 2024, 37% of organizations suffered an API breach. Inside OWASP API Security Top 10.
Why do integrations break when you change your API? Versioning and backward compatibility
APIs don't break because of the version number. You need a written definition of breaking changes, usage data per version, and an announced retirement date.
Your app got rejected: how App Store and Play Store releases actually work
Most rejections come from preparation, not code. Account setup, demo logins, review notes, account deletion, the IAP rule and the deadlines that repeat yearly.
Who changed this record? Designing an application audit trail
An audit trail is not a debug log: who, when, which record, from which value to which. Field design, writing in-transaction, immutability and retention.
Should you build authentication yourself or use an identity provider?
Login is a subsystem, not a screen. Hosted identity services, self-hosted servers and in-app libraries compared, with the hidden costs and the exit plan.
Who can see what? Designing authorization: roles, permissions, RBAC and ABAC
Authorization answers three questions: which action, which record, which field. Role explosion, row-level scope, RBAC versus ABAC, and when revocation lands.
The request just timed out: moving long work into background jobs and queues
Heroku gives up at 30 seconds, ALB at 60, Cloudflare at 100. A practical guide to queueing long work, retrying it sensibly and watching the dead-letter queue.
Should employees reach company data from their own phones? BYOD, MDM and MAM
Personal phones touching company data is not the problem; unmanaged access is. What separates MDM from MAM, the limits of remote wipe, and off-boarding.
The customer still sees the old price: cache layers, Cache-Control and invalidation
Stale content is rarely one cache misbehaving. It is layers disagreeing. Cache-Control, ETag, cache keys, purge by tag and the cache stampede, in practice.
Which technology should we build on? Choosing a language, framework and database
The decision turns on support calendars, hiring pools and the cost of reversing it, not on which stack is best. Current dates, criteria and questions to ask.
Why does every release feel risky? CI/CD for small teams
If every release feels risky, the cause is rare, large deploys. Four metrics, a ten-minute pipeline, one build artifact and a rehearsed rollback fix it.
Why does the cloud bill keep growing? Finding waste, measuring it, and making the cut stick
Most cloud spend goes to idle capacity and network traffic, not expensive services. A practical order of work: allocation, right-sizing, commitments, architecture.
Who is responsible for cloud security? Misconfiguration and the shared responsibility model
Moving to the cloud does not transfer security responsibility to your provider. Where the shared responsibility model ends, your job begins. Here is the line.
Why is our site slow? Core Web Vitals, INP and real user data
Core Web Vitals are measured with real user data, not your Lighthouse score. The LCP, INP and CLS thresholds, where sites actually fail, and the order to fix them.
Moving data from the old system to the new one: mapping, rehearsals, reconciliation and cutover
Data migration is not a copy job. The real risk is not losing records, it is records arriving quietly wrong: profiling, mapping, rehearsals and cutover.
Why does the app get slower as data grows? Database bottlenecks, indexes and query plans
Slowdowns are rarely about weak servers. They come from queries whose cost grows with row count: missing indexes, N+1, OFFSET pagination and exhausted connection pools.
The report is off by an hour: storing dates, time zones and DST correctly
Store past events in UTC, future appointments as local time plus an IANA zone ID. Database types, DST transitions, the 2038 limit and report day boundaries.
DDoS attacks: what they are and how to protect your business
A DDoS attack floods your site with fake traffic until real users can't reach it. Records hit 31.4 Tbps in 2025. Here's how they work and how to defend.
Do you really need Kubernetes? Choosing between a single server, managed containers and serverless
Kubernetes is not a maturity level, it solves a specific problem. Control plane fees, the upgrade treadmill, the shape limits of serverless and how to decide.
EDR vs antivirus: is traditional antivirus still enough?
Antivirus catches known malware by matching signatures, but 79% of 2024 attacks used no malware file at all. Here is what EDR does differently and why you need it.
Is someone sending fake email in your name? Protect your domain with SPF, DKIM and DMARC
Anyone can send email that shows your domain in the From line. Here is how SPF, DKIM and DMARC stop domain spoofing, and the safe order to set the three records up.
Why end-of-support software is a real risk, and what to do after Windows 10
Vulnerabilities keep appearing in end-of-life software, but patches stop. Windows 10, Exchange and SQL Server 2016: inventory, ESU cost and a migration plan.
Duplicate orders and stock that never matches: why data sync between systems drifts
Duplicate orders, stock that never matches. The cause is usually delivery guarantees, not bad code. Idempotency keys, the outbox pattern and reconciliation fix it.
Should a new feature go live for everyone at once? Feature flags and progressive rollout
Deploying code and releasing a feature are two separate events. How to run a staged rollout, design a kill switch and pay down flag debt before it grows.
Fixed price or time and materials? Who actually carries the risk
A fixed price does not move risk to the supplier, it prices it in or takes it out of quality. Choosing by uncertainty, capped and target-price options, clauses.
Why hardcoding API keys and passwords is dangerous: a guide to secrets management
Writing an API key, password or token into your source code makes a leak inevitable. In 2025, 29 million secrets were exposed on public GitHub. Here is the fix.
HTTPS and SSL/TLS certificates: why lifetimes are dropping to 47 days
HTTPS encrypts your traffic and proves your server's identity. Certificate lifetimes drop to 47 days by 2029, ending manual renewal. Here is what to know.
You have just found an attack: what to do in the first 24 hours
The first day after you spot an attack decides how bad it gets. How to contain it without destroying evidence, who to call, and when the legal clock starts.
What an ISO 27001 certificate actually proves, and whether you need one
An ISO 27001 certificate proves you run an information security management system in a declared scope, not that you are secure. What the 93 controls and audits show.
Rewrite the legacy system, or replace it slice by slice?
A full rewrite is rarely the cheapest route. A practical map for slicing a legacy system: picking the first slice, moving the data, keeping a rollback window.
The site fell over on campaign day: load testing and capacity planning
Turn your expected peak into requests per second, test with an open model, find the breaking point. Test types, realistic scenarios and a campaign plan.
You collect logs, but is anyone reading them? SIEM, MDR and 24/7 monitoring
Collecting logs is not detection. Which logs actually matter, why 90 days of retention is not enough, and whether you should run monitoring in-house or buy MDR.
Should you move to microservices? Monolith, modular monolith and the real question
Microservices solve an organisational problem, not a code quality one. Modular monoliths, the distributed monolith trap and what teams measured going back.
Multi-factor authentication: which second factor is actually secure?
MFA blocks more than 99% of automated account attacks, but not all MFA is equal. Here is why SMS codes are the weakest link and which second factor resists phishing.
Separate install per customer, or one shared app? Multi-tenant SaaS architecture and tenant isolation
Few customers with strict isolation favor separate installs; many customers favor a shared app. Decision criteria, RLS pitfalls, noisy neighbors and cost.
How to build a multilingual site: URL structure, hreflang and the work that starts after translation
A multilingual site is three jobs: addressing, hreflang mapping, localization. Subdirectory or ccTLD, how x-default works, plural rules and casing traps.
How do you scope an MVP? What belongs in the first release and what can wait
A practical way to shrink release one: vertical slices instead of layers, fixed time and variable scope, real usage data, and the four things you must never cut.
Native or cross-platform for your mobile app? The criteria, and what each one really costs
Native, React Native, Flutter, Kotlin Multiplatform or a PWA. What Shopify and Airbnb actually measured, the upgrade tax nobody quotes, and how to decide.
Customers spot your outages first: observability, SLOs and error budgets
If customers report your outages before your dashboards do, the problem is what you measure. Picking an SLI, setting a realistic SLO, and burn rate alerts.
OWASP Top 10 2025: the ten flaws most likely to break your web app
OWASP has updated its Top 10 after four years. What is the number one web risk in 2025, what changed, and how should your company actually use the list?
What is a passkey, and will it really replace passwords? A passwordless guide for businesses
A passkey swaps your password for a cryptographic key on your device. Here is how it works, why it resists phishing, and where your business should start.
Patch management: how delaying updates puts your company at risk
Exploiting unpatched flaws is now attackers' top way in, past stolen passwords. WannaCry's fix had shipped two months before the attack. Which do you patch first?
The card was charged but no order exists: the hard parts of payment integration
Taking the card is half a day of work. Trusting the browser redirect, skipping idempotency and never reconciling are why money and records drift apart.
Phishing Protection for SMBs: A Practical Guide
Why phishing hits small and mid-sized businesses so often, and the low-cost steps you can take today to protect your company and its accounts.
Ransomware: how to protect your company and should you pay the ransom?
Ransomware no longer just encrypts your files, it steals them first. Here is how the attack works, how your company can defend against it, and whether paying helps.
Every report shows a different number: metric definitions, source of truth and a reporting layer
Your store says 1,284 orders, the ERP says 1,301. The gap is rarely lost data: it is metric definitions, date fields, time zones and late-arriving records.
Your team is pasting company data into ChatGPT: how to manage the Shadow AI risk
Your team is pasting company data into tools like ChatGPT. Why the Shadow AI risk is so widespread, and how to build a safe, compliant usage policy today.
Users cannot find what they are looking for: why site search returns the wrong things
The search box works but the results are useless. Start with the query log, how far Postgres full-text search gets you, typo tolerance and language pitfalls.
When will it be done? Estimates, probabilistic forecasts and a delivery date you can defend
Dates slip because single-number estimates quietly become commitments. Flow metrics, Monte Carlo forecasts, percentile dates and measuring scope growth.
The build is finished. Who maintains it now? What belongs in a support contract
Defect or change request, response time or resolution time, who applies the patches, what happens at exit: the clauses that keep every incident out of negotiation.
Software supply chain security: how your dependencies put you at risk
Every open source library you install is a door into your systems. Here is how software supply chain attacks really work and how to defend your company.
Who owns your software's source code? Contracts, rights transfer and escrow
Whoever writes the code owns it by default. Turkish law requires a written, itemised transfer of rights. What your contract, handover list and escrow must cover.
We run this process in a spreadsheet: when is it time to build software?
The trigger is not file size. It is whether the process needs validation, concurrent access and an audit trail. Five signals that it is time, and where to start.
What is technical debt, and when do you pay it down? Measuring, prioritizing, budgeting
Technical debt is not messy code, it is the interest on a deferred design decision. How to measure it, rank it by hotspots and pay it where you already work.
How much testing is enough? The test pyramid, coverage targets and flaky tests
The right question is not how many tests you have but how they are distributed. The test pyramid, why coverage targets backfire, and what to do about flaky tests.
Should you copy production data into your test environment? Masking, subsetting and synthetic data
Restoring the live database into staging is the easy option and the expensive one. How to build realistic test data with masking, subsetting and synthetic records.
Your vendor says it is done: how to run acceptance testing before you sign off
Acceptance is not a demo, it is a written answer to your own criteria. Exit criteria, UAT scripts, defect triage, the inspection duty in Turkish law, go-live.
Vulnerability scan or penetration test? What each one actually finds
A scanner lists known vulnerabilities. A pentest proves how far someone can get with them. Why PCI DSS and Turkish banking rules require both, separately.
Is your website accessible? WCAG 2.2, the EU Accessibility Act and a practical compliance plan
The EU Accessibility Act has applied since June 2025 and Türkiye set WCAG 2.2 deadlines. What Level A actually requires, how to test it, where to start.
Why bids for the same project differ by multiples: how to write a software requirements spec
A vague requirement prices itself. Writing verifiable requirements, spotting requirement smells, setting measurable quality targets and a real out-of-scope page.
Why does your site go down when you deploy? Zero-downtime releases and schema changes
Deploy downtime comes from three places: a schema lock, two incompatible versions running at once, and traffic sent to processes that are not ready yet.
Stay in the loop
Once a month, only value-adding content. No spam, unsubscribe anytime.