Preparing for a penetration test: a 10-point checklist for SMEs
What to do before your first pentest. From defining scope to managing access, a practical guide to solidify your preparation.
read more →Notes on software and security
Expert guides and current analysis on software development, product, integration and cyber security.
Backups aren’t enough: the 3-2-1 rule and disaster recovery
Real protection against data loss requires more than a regular backup. An untested backup is no backup.
Off-the-shelf or custom software? Making the right call
There is no single answer for every business. The criteria to weigh when deciding.
An introduction to Zero Trust architecture
The “trust everyone inside” era is over. Why does modern security verify every access?
Technical SEO: fundamentals for B2B technology sites
To be visible you must first be findable. How do search engines understand your site?
An API-first approach to system integration
Disconnected systems create data silos. How should modern integration be designed?
How many users does an A/B test need, and what to do when you don't have them
The sample size an A/B test needs is a number you can calculate. Real figures for a 3% conversion site, why underpowered tests mislead, and five alternatives.
It looked great in the demo: how to ship an AI feature that survives production
Three questions decide it: who pays when the model is wrong, who verifies the output, what does a request cost? Evaluation sets, security limits and budgets.
How should you review AI-generated code? Quality rules and acceptance criteria
AI-written code compiles and reads fine, so the failures moved elsewhere. Practical acceptance rules for duplication, swallowed errors and invented packages.
Why does ChatGPT never mention us? What actually works for visibility in AI search
Why AI assistants never mention your site: which bots to allow, what llms.txt really does, what cited pages look like and how to actually measure any of it.
Why API security is a problem of its own: the OWASP API Security Top 10 (2023)
APIs are the backbone of modern software, and also its most attacked layer. In 2024, 37% of organizations suffered an API breach. Inside OWASP API Security Top 10.
Why do integrations break when you change your API? Versioning and backward compatibility
APIs don't break because of the version number. You need a written definition of breaking changes, usage data per version, and an announced retirement date.
Your app got rejected: how App Store and Play Store releases actually work
Most rejections come from preparation, not code. Account setup, demo logins, review notes, account deletion, the IAP rule and the deadlines that repeat yearly.
The request is pending approval, but with whom? Hardcoded approval flows versus a workflow engine
Approval logic lives at one of three levels: conditions in code, an approval matrix in data, or a full workflow engine. Here is how to pick the level you need.
Who changed this record? Designing an application audit trail
An audit trail is not a debug log: who, when, which record, from which value to which. Field design, writing in-transaction, immutability and retention.
Should you build authentication yourself or use an identity provider?
Login is a subsystem, not a screen. Hosted identity services, self-hosted servers and in-app libraries compared, with the hidden costs and the exit plan.
Who can see what? Designing authorization: roles, permissions, RBAC and ABAC
Authorization answers three questions: which action, which record, which field. Role explosion, row-level scope, RBAC versus ABAC, and when revocation lands.
The request just timed out: moving long work into background jobs and queues
Heroku gives up at 30 seconds, ALB at 60, Cloudflare at 100. A practical guide to queueing long work, retrying it sensibly and watching the dead-letter queue.
The customer uploads a spreadsheet and the import dies halfway: designing bulk CSV and Excel import
A reliable import is three steps: a dry run report, an idempotent write, a reconciliation. Where Excel corrupts data before you see it, and how to report row errors.
The one developer who knew the system left: breaking key-person dependency
When one person understands your software, the risk is not in the code. It sits in access, in undocumented reasoning, and in routines nobody wrote down.
Should employees reach company data from their own phones? BYOD, MDM and MAM
Personal phones touching company data is not the problem; unmanaged access is. What separates MDM from MAM, the limits of remote wipe, and off-boarding.
The customer still sees the old price: cache layers, Cache-Control and invalidation
Stale content is rarely one cache misbehaving. It is layers disagreeing. Cache-Control, ETag, cache keys, purge by tag and the cache stampede, in practice.
Which technology should we build on? Choosing a language, framework and database
The decision turns on support calendars, hiring pools and the cost of reversing it, not on which stack is best. Current dates, criteria and questions to ask.
Why does every release feel risky? CI/CD for small teams
If every release feels risky, the cause is rare, large deploys. Four metrics, a ten-minute pipeline, one build artifact and a rehearsed rollback fix it.
Why does the cloud bill keep growing? Finding waste, measuring it, and making the cut stick
Most cloud spend goes to idle capacity and network traffic, not expensive services. A practical order of work: allocation, right-sizing, commitments, architecture.
Who is responsible for cloud security? Misconfiguration and the shared responsibility model
Moving to the cloud does not transfer security responsibility to your provider. Where the shared responsibility model ends, your job begins. Here is the line.
Two people edited the same record: last save wins and the other change disappears
The database raises no error because there is no error, you asked for this. Version columns, affected row checks, ETag and If-Match against lost updates.
Why is our site slow? Core Web Vitals, INP and real user data
Core Web Vitals are measured with real user data, not your Lighthouse score. The LCP, INP and CLS thresholds, where sites actually fail, and the order to fix them.
Moving data from the old system to the new one: mapping, rehearsals, reconciliation and cutover
Data migration is not a copy job. The real risk is not losing records, it is records arriving quietly wrong: profiling, mapping, rehearsals and cutover.
Another column for every new requirement: where did the data model go wrong?
Slow queries and reports that never reconcile are usually not coding mistakes. They are modelling decisions made in week one: status fields, NULL, EAV, JSON, keys.
Why does the app get slower as data grows? Database bottlenecks, indexes and query plans
Slowdowns are rarely about weak servers. They come from queries whose cost grows with row count: missing indexes, N+1, OFFSET pagination and exhausted connection pools.
The report is off by an hour: storing dates, time zones and DST correctly
Store past events in UTC, future appointments as local time plus an IANA zone ID. Database types, DST transitions, the 2038 limit and report day boundaries.
DDoS attacks: what they are and how to protect your business
A DDoS attack floods your site with fake traffic until real users can't reach it. Records hit 31.4 Tbps in 2025. Here's how they work and how to defend.
Do you really need Kubernetes? Choosing between a single server, managed containers and serverless
Kubernetes is not a maturity level, it solves a specific problem. Control plane fees, the upgrade treadmill, the shape limits of serverless and how to decide.
How do you measure a software team's performance? DORA metrics and what not to count
Lines of code, commit counts and velocity do not measure a team. Here is what DORA's five metrics actually count, where the data lives and which metric backfires.
The same customer exists three times: how to find, merge and stop duplicate records
Deduplication is three jobs: normalization, candidate generation and merge rules. Why phonetic matching fails outside English, and why a bad merge costs more.
EDR vs antivirus: is traditional antivirus still enough?
Antivirus catches known malware by matching signatures, but 79% of 2024 attacks used no malware file at all. Here is what EDR does differently and why you need it.
Is someone sending fake email in your name? Protect your domain with SPF, DKIM and DMARC
Anyone can send email that shows your domain in the From line. Here is how SPF, DKIM and DMARC stop domain spoofing, and the safe order to set the three records up.
Why end-of-support software is a real risk, and what to do after Windows 10
Vulnerabilities keep appearing in end-of-life software, but patches stop. Windows 10, Exchange and SQL Server 2016: inventory, ESU cost and a migration plan.
An enterprise customer wants SSO: what SAML, OIDC and SCIM actually cost you
Enterprise SSO is not a login button. The SAML and OIDC split, domain verification, automatic offboarding with SCIM, and the morning a certificate expires.
Duplicate orders and stock that never matches: why data sync between systems drifts
Duplicate orders, stock that never matches. The cause is usually delivery guarantees, not bad code. Idempotency keys, the outbox pattern and reconciliation fix it.
All the user sees is “Something went wrong”: how to design error handling
What the user sees, what support can trace, and what the system does next are three separate decisions. Error types, correlation IDs, RFC 9457, failing closed.
Should a new feature go live for everyone at once? Feature flags and progressive rollout
Deploying code and releasing a feature are two separate events. How to run a staged rollout, design a kill switch and pay down flag debt before it grows.
Every customer wants a different feature: how to prioritize a product roadmap
Ordering a request queue takes a written decision rule, not a better scoring sheet. RICE, WSJF, Kano, MoSCoW, saying no well, and measuring what you ship.
Building a file upload feature: size limits, validation and safe storage
File upload is not a form field. It is four decisions: which path the bytes take, what you accept, how you store the result and how you serve it back safely.
Fixed price or time and materials? Who actually carries the risk
A fixed price does not move risk to the supplier, it prices it in or takes it out of quality. Choosing by uncertainty, capped and target-price options, clauses.
Why hardcoding API keys and passwords is dangerous: a guide to secrets management
Writing an API key, password or token into your source code makes a leak inevitable. In 2025, 29 million secrets were exposed on public GitHub. Here is the fix.
Should you move from WordPress to a headless CMS? Decision criteria and hidden costs
A headless CMS is a trade, not an upgrade. When it pays off, which jobs your old CMS did for free you now have to build, and where the cost really lands.
We're changing hosting: how long will the site be down? A server migration plan
Visible downtime is decided by the TTL you published before the move and by two servers writing at once. TTL planning, certificates, email records, IP allowlists.
HTTPS and SSL/TLS certificates: why lifetimes are dropping to 47 days
HTTPS encrypts your traffic and proves your server's identity. Certificate lifetimes drop to 47 days by 2029, ending manual renewal. Here is what to know.
Should we build an in-house dev team or outsource? Cost, speed and where the knowledge ends up
The answer is per capability, not per company. What an in-house team actually costs, what an outsourcing quote leaves out, and where the knowledge ends up.
You have just found an attack: what to do in the first 24 hours
The first day after you spot an attack decides how bad it gets. How to contain it without destroying evidence, who to call, and when the legal clock starts.
What an ISO 27001 certificate actually proves, and whether you need one
An ISO 27001 certificate proves you run an information security management system in a declared scope, not that you are secure. What the 93 controls and audits show.
The page looks fine in the browser but the HTML is empty: JavaScript rendering and search visibility
If content only appears after JavaScript runs, Google usually still sees it but AI crawlers do not. Decide page by page which HTML has to come from the server.
Rewrite the legacy system, or replace it slice by slice?
A full rewrite is rarely the cheapest route. A practical map for slicing a legacy system: picking the first slice, moving the data, keeping a rollback window.
The site fell over on campaign day: load testing and capacity planning
Turn your expected peak into requests per second, test with an open model, find the breaking point. Test types, realistic scenarios and a campaign plan.
You collect logs, but is anyone reading them? SIEM, MDR and 24/7 monitoring
Collecting logs is not detection. Which logs actually matter, why 90 days of retention is not enough, and whether you should run monitoring in-house or buy MDR.
When does low-code stop being enough? Five signals you have outgrown the platform
Low-code is fast for internal tools. Once quota walls, usage-based billing, expression limits and exit costs show up, decide early rather than after a breakage.
Should you move to microservices? Monolith, modular monolith and the real question
Microservices solve an organisational problem, not a code quality one. Modular monoliths, the distributed monolith trap and what teams measured going back.
The total is off by one cent: storing money, rounding and exchange rates
Never store money in a float, never separate the amount from its currency, round in exactly one place, and write the rate you used onto the transaction.
Multi-factor authentication: which second factor is actually secure?
MFA blocks more than 99% of automated account attacks, but not all MFA is equal. Here is why SMS codes are the weakest link and which second factor resists phishing.
Separate install per customer, or one shared app? Multi-tenant SaaS architecture and tenant isolation
Few customers with strict isolation favor separate installs; many customers favor a shared app. Decision criteria, RLS pitfalls, noisy neighbors and cost.
How to build a multilingual site: URL structure, hreflang and the work that starts after translation
A multilingual site is three jobs: addressing, hreflang mapping, localization. Subdirectory or ccTLD, how x-default works, plural rules and casing traps.
How do you scope an MVP? What belongs in the first release and what can wait
A practical way to shrink release one: vertical slices instead of layers, fixed time and variable scope, real usage data, and the four things you must never cut.
Native or cross-platform for your mobile app? The criteria, and what each one really costs
Native, React Native, Flutter, Kotlin Multiplatform or a PWA. What Shopify and Airbnb actually measured, the upgrade tax nobody quotes, and how to decide.
Your users turned notifications off: how to design a notification system
Notification design does not start with picking a channel. Decide which events deserve one, what users can mute per category, and how urgency gets declared.
Customers spot your outages first: observability, SLOs and error budgets
If customers report your outages before your dashboards do, the problem is what you measure. Picking an SLI, setting a realistic SLO, and burn rate alerts.
No signal in the field and the app stops: how to build software that works offline
The hard part of offline is not storage, it is sync: client-generated ids, an outbox queue, per-field conflict rules and syncing only the slice a device needs.
There is GPL code in our product: what open source licenses actually require of you
An open source license is conditional permission, not a gift. What MIT, Apache, GPL and AGPL ask for, when the obligation is triggered, and a one-page policy.
The event fired but the customer never got it: designing webhooks other teams can rely on
Offering webhooks is not POSTing to a URL. Producing the event, signing it, the retry schedule and the delivery log are four separate design decisions.
OWASP Top 10 2025: the ten flaws most likely to break your web app
OWASP has updated its Top 10 after four years. What is the number one web risk in 2025, what changed, and how should your company actually use the list?
What is a passkey, and will it really replace passwords? A passwordless guide for businesses
A passkey swaps your password for a cryptographic key on your device. Here is how it works, why it resists phishing, and where your business should start.
Patch management: how delaying updates puts your company at risk
Exploiting unpatched flaws is now attackers' top way in, past stolen passwords. WannaCry's fix had shipped two months before the attack. Which do you patch first?
The card was charged but no order exists: the hard parts of payment integration
Taking the card is half a day of work. Trusting the browser redirect, skipping idempotency and never reconciling are why money and records drift apart.
Phishing Protection for SMBs: A Practical Guide
Why phishing hits small and mid-sized businesses so often, and the low-cost steps you can take today to protect your company and its accounts.
Plenty of data, no answers: how to set up product analytics and event tracking
Event tracking does not start with a tool. It starts with the questions, an object-action naming rule, a tracking plan, GA4's quiet limits and server events.
Every customer wants their own version: how to keep one product on one codebase
Customer-specific requests belong in one of three buckets: configuration, license entitlements, or extension points. A per-customer branch is a deferred bill.
The build is done and the screens are not what we pictured: how to run the prototype phase
The design phase is where you decide what the software does, not how it looks. Flows, prototype fidelity, testing with five people, and what reaches the code.
Ransomware: how to protect your company and should you pay the ransom?
Ransomware no longer just encrypts your files, it steals them first. Here is how the attack works, how your company can defend against it, and whether paying helps.
One client is slowing the whole API down: designing rate limits and quotas
Rate limiting is not one setting. What you count, how you count it, what you do when the limit is hit and how you tell the client are four separate decisions.
Nothing changes until the user hits refresh: choosing between WebSocket, SSE and polling
Not every live screen needs a WebSocket. A staleness budget per screen, the arithmetic of polling, where SSE stops short and the timeouts that cut connections.
Every report shows a different number: metric definitions, source of truth and a reporting layer
Your store says 1,284 orders, the ERP says 1,301. The gap is rarely lost data: it is metric definitions, date fields, time zones and late-arriving records.
Your team is pasting company data into ChatGPT: how to manage the Shadow AI risk
Your team is pasting company data into tools like ChatGPT. Why the Shadow AI risk is so widespread, and how to build a safe, compliant usage policy today.
We relaunched the site and traffic dropped: protecting search during a redesign or migration
Traffic loss after a relaunch usually comes from unmapped URLs, not the new design. Redirect mapping, 301 rules and what to watch in the first 30 days.
Users cannot find what they are looking for: why site search returns the wrong things
The search box works but the results are useless. Start with the query log, how far Postgres full-text search gets you, typo tolerance and language pitfalls.
Can a deleted record come back? Designing soft delete, trash and permanent deletion
Deletion is not one decision: undo bar, soft delete, a trash window and restoring from backup are separate mechanisms. Which one saves which accident?
When will it be done? Estimates, probabilistic forecasts and a delivery date you can defend
Dates slip because single-number estimates quietly become commitments. Flow metrics, Monte Carlo forecasts, percentile dates and measuring scope growth.
The build is finished. Who maintains it now? What belongs in a support contract
Defect or change request, response time or resolution time, who applies the patches, what happens at exit: the clauses that keep every incident out of negotiation.
Software supply chain security: how your dependencies put you at risk
Every open source library you install is a door into your systems. Here is how software supply chain attacks really work and how to defend your company.
Changing software vendors: what a real handover has to include
A zip file of the source code is not a handover. Domains, cloud and store accounts, secrets, data and knowledge: what to demand, and what to put in writing.
Who owns your software's source code? Contracts, rights transfer and escrow
Whoever writes the code owns it by default. Turkish law requires a written, itemised transfer of rights. What your contract, handover list and escrow must cover.
We run this process in a spreadsheet: when is it time to build software?
The trigger is not file size. It is whether the process needs validation, concurrent access and an audit trail. Five signals that it is time, and where to start.
It works in staging but breaks in production: where the gap comes from
When the same code behaves differently in two environments, the cause is one of five: config, data, concurrency, the network layer in front of the app, or drift.
We moved to subscriptions and the numbers stopped adding up: building recurring billing
Plan changes, trials and failed charges are three separate problems. Proration rules, retry policy and invoice timing do not get easier to fix later on.
What is technical debt, and when do you pay it down? Measuring, prioritizing, budgeting
Technical debt is not messy code, it is the interest on a deferred design decision. How to measure it, rank it by hotspots and pay it where you already work.
How much testing is enough? The test pyramid, coverage targets and flaky tests
The right question is not how many tests you have but how they are distributed. The test pyramid, why coverage targets backfire, and what to do about flaky tests.
Should you copy production data into your test environment? Masking, subsetting and synthetic data
Restoring the live database into staging is the easy option and the expensive one. How to build realistic test data with masking, subsetting and synthetic records.
The shipping API is down and we cannot take orders: designing for third-party outages
When a payment, shipping or invoicing vendor goes dark, why does your whole product stop? A practical guide to timeouts, circuit breakers and graceful degradation.
Password reset emails never arrive: why transactional mail lands in spam
Why does the mail your app sends miss the inbox? A look at DMARC alignment, sender reputation, bounce handling and the sending queue inside your own product.
Your vendor says it is done: how to run acceptance testing before you sign off
Acceptance is not a demo, it is a written answer to your own criteria. Exit criteria, UAT scripts, defect triage, the inspection duty in Turkish law, go-live.
They sign up and never come back: how to build onboarding and activation
Onboarding is not a welcome screen, it is the work of shortening the path to first value. How to find the activation moment and clear the setup blockers.
Vulnerability scan or penetration test? What each one actually finds
A scanner lists known vulnerabilities. A pentest proves how far someone can get with them. Why PCI DSS and Turkish banking rules require both, separately.
Is your website accessible? WCAG 2.2, the EU Accessibility Act and a practical compliance plan
The EU Accessibility Act has applied since June 2025 and Türkiye set WCAG 2.2 deadlines. What Level A actually requires, how to test it, where to start.
Why bids for the same project differ by multiples: how to write a software requirements spec
A vague requirement prices itself. Writing verifiable requirements, spotting requirement smells, setting measurable quality targets and a real out-of-scope page.
Why does your site go down when you deploy? Zero-downtime releases and schema changes
Deploy downtime comes from three places: a schema lock, two incompatible versions running at once, and traffic sent to processes that are not ready yet.
Stay in the loop
Once a month, only value-adding content. No spam, unsubscribe anytime.