All notes

Production readiness
Fixed Price vs. Hourly: How to Pay for App Hardening

Neither description tells you which one protects your runway — and the difference between choosing correctly and choosing quickly can cost more than the gap between the rates.

May 3, 2026 · 6 min read
Security
A Founder's Checklist — Multi-Tenant Leaks in Supabase

A user loads their dashboard and sees someone else's name, email, and records — not because of a sophisticated attack, but because one default setting was never changed.

Apr 25, 2026 · 7 min read
Reliability
The Missing Index — Why Your App Is Fast in Dev and Slow in Prod

Your production database now holds fifty thousand — and without an index, every query reads every single one of them.

Apr 18, 2026 · 7 min read
Reliability
Stripe Webhook Failures — The Money That Never Made It to Your Books

A Stripe payment notification — a real charge from a real user.

Apr 17, 2026 · 8 min read
Security
When "It Works" Hides a Security Hole

Functional correctness and security are separate properties — an app can pass every demo scenario and still carry exploitable gaps in authentication, data handling, or secrets management.

Mar 29, 2026 · 8 min read
Migration
Exporting Your Code From Lovable — What's in the Repo and What Isn't

A zip lands on your desktop, and for a beat it feels like ownership — the thing you built is finally yours, portable, real.

Mar 26, 2026 · 8 min read
Load more