000 — INSIGHTS
What we learn taking software from almost-done to shipped — and keeping it there. Checklists, decisions and the boring details that decide whether a launch is calm.
01 — Rescue · 10 min read
Most AI-built apps that work in preview and fail in production break for the same handful of reasons: environment variables baked in at build time, auth redirect URLs still pointing at the preview, missing database authorization, webhooks that are not idempotent, CORS, and no error monitoring. Each one has a specific, testable fix.
02 — Rescue · 9 min read
If your app talks to Supabase from the browser, Row Level Security is your access control. Enable RLS on every exposed table, write one policy per operation using auth.uid(), keep the service_role key on the server, lock down storage buckets, and test as an anonymous user and as a second account. Copy-ready SQL below.
03 — Business · 7 min read
Rescue when the product works and the problems are security, configuration and missing safety nets. Refactor when it works but every change is slow and risky. Rewrite only when the data model or platform is fundamentally wrong — and even then, replace it piece by piece. The deciding factor is the data model, not how messy the code looks.
04 — Engineering · 8 min read
You pay down technical debt without stopping feature work by treating it as a standing line item, not a project. Measure where debt actually hurts, keep a ranked register, reserve a fixed share of every sprint, and replace risky parts incrementally behind tests, abstractions and feature flags. DORA metrics tell you whether it is working.
05 — Business · 8 min read
A credible SLA promises 99.9% monthly availability, measured from outside, with clear exclusions, committed response times per priority and service credits when the target is missed. That allows about 43 minutes of downtime a month. A vendor promising 100% uptime or fixed bug-fix times is either not measuring or not telling you the truth.
06 — Compliance · 8 min read
In 2026 an EU app maker needs four things in order: the European Accessibility Act has applied since 28 June 2025, Cyber Resilience Act reporting since 11 September 2026, NIS2 is national law in Slovakia and Czechia, and GDPR Article 28 still requires a processing agreement. Most of the work is engineering hygiene you should be doing anyway.