Blog · Page 3
How to build software and AI that holds up.
Guides from our engineers on custom systems, AI agents and private AI: what to build, what it costs, and what breaks once it’s live.
Building software · 4 Aug 2026 · 8 min read
Data Residency Questions That Stall Enterprise Deals
The data residency requirements that block enterprise contracts, why AI features make them harder, and the architecture changes that let you answer yes.
Engineering and operations · 4 Aug 2026 · 8 min read
Building an Audit Trail Auditors Will Accept
A practical audit trail implementation guide — the event schema, the tamper-evidence rules, retention, and how to add one to an app that has been running without it.
Engineering and operations · 4 Aug 2026 · 8 min read
The AI Breaks a Working Feature Every Time I Add a New One
The structural reasons an AI agent breaks working features while building new ones, and the safety net that lets you keep shipping without regressions.
Security and compliance · 4 Aug 2026 · 8 min read
My App Works for Me but Not for Other Users
A diagnostic guide for the app that works perfectly on your account and breaks for every other user, including the security problems hiding behind the symptom.
Security and compliance · 3 Aug 2026 · 7 min read
Can an AI-Generated App Be HIPAA Compliant?
Yes, an app built with AI tooling can be HIPAA compliant — but only after you fix the BAA gaps, PHI leakage into third-party tools, and missing audit trail.
Security and compliance · 3 Aug 2026 · 7 min read
Taking Payments Safely in an AI-Built Product
How to take card payments in an AI-built product without inheriting PCI scope — plus the pricing, webhook, and script-integrity bugs generators reliably produce.
Engineering and operations · 3 Aug 2026 · 7 min read
What Investors Actually Look At in a Code Review
What actually happens when an investor sends an engineer to review your code — the signals they weigh, what they ignore, and how to come out of it stronger.
Security and compliance · 3 Aug 2026 · 8 min read
ISO 27001 for an Early-Stage Product Team
A practical breakdown of ISO 27001 for a startup with a small team — what the standard asks for, what your code has to prove, and when certification is worth starting.
Security and compliance · 2 Aug 2026 · 7 min read
Passing Technical Due Diligence With an AI-Generated Codebase
What a technical due diligence team looks for in an AI-generated codebase, which findings actually threaten a deal, and how to prepare before the data room opens.
Security and compliance · 2 Aug 2026 · 7 min read
SOC 2 When an AI Wrote Your Code
SOC 2 audits controls, not code quality — but AI-built products systematically fail the control tests. Here is which ones, what it costs, and how to close the gaps.
Security and compliance · 2 Aug 2026 · 7 min read
Answering Enterprise Security Questionnaires as a Small Team
How a three-person team answers a 300-row enterprise security questionnaire without lying, stalling, or losing the deal — and what to build before the next one arrives.
Security and compliance · 2 Aug 2026 · 7 min read
GDPR Obligations Your AI-Built App Probably Missed
The GDPR requirements AI code generators never implement — real deletion, lawful basis, subprocessor disclosure, retention, and breach readiness — and how to close them.
Security and compliance · 1 Aug 2026 · 7 min read
What a Security Audit Costs for an AI-Built Product
Quotes for the same security audit routinely differ by a factor of ten. Here is what actually drives the number, and how to buy the right depth for your situation.
Engineering and operations · 1 Aug 2026 · 8 min read
The OWASP Top 10, Read Through AI-Generated Code
A category-by-category translation of the OWASP Top 10 into the specific things Lovable, Cursor, Bolt and friends leave in your codebase.
Security and compliance · 1 Aug 2026 · 7 min read
Auditing the Dependencies an AI Chose for You
How to run a dependency audit on an AI-generated npm project — spotting hallucinated packages, unmaintained libraries, license risk, and the CVEs that actually matter.
Engineering and operations · 1 Aug 2026 · 7 min read
Rate Limiting: The Control Your AI-Built App Almost Certainly Lacks
Why AI-built apps ship without rate limiting, what it exposes, and a layered approach to adding limits that protect your login, your database, and your API bill.
Security and compliance · 31 Jul 2026 · 7 min read
Finding Every Secret an AI Left in Your Repo
AI-assisted commits leak credentials at roughly twice the baseline rate. Here is how to sweep an entire repo — history included — and what to do with what you find.
AI agents and automation · 31 Jul 2026 · 7 min read
MCP Server Security: What to Check Before You Connect One
Connecting an MCP server is installing software and handing it credentials. A practical review checklist for anything you are about to plug into your agent.
Engineering and operations · 31 Jul 2026 · 7 min read
Why AI-Generated Apps Keep Shipping Auth Bypasses
AI builders get login right and access control wrong. The five bypass patterns we find in nearly every generated codebase — and how to test yours in twenty minutes.
Security and compliance · 31 Jul 2026 · 7 min read
Do You Need a Pen Test for an AI-Built App?
A pen test is a proof, not a discovery process. How to tell whether your AI-built app needs one now — and what to do first so you are not paying for a list you could have written.