Technical due diligenceAn investor wants to review your code: what to prepare before access
Prepare a scoped investor code review with controlled access, a useful evidence index and an honest account of technical risks.
Read articleThe reading room
A little clarity goes a long way.
Practical notes on code quality, launch decisions, technical risk, and the work behind trustworthy software.
Engineering insights
Better questions. Safer software.
Practical guidance on AI-built software, code reviews, security and release readiness.
30 articles in the collection
Technical due diligence
Testing and reliabilityEvery AI change breaks something: how to stop the regression cycle
A practical regression-control workflow for AI-built software, with a permissions example, release checklist and evidence to retain.
Read article
Security readinessYour first enterprise security questionnaire: answers you can prove
Answer an enterprise security questionnaire with scoped evidence, honest gaps and a reusable response record instead of unsupported yes answers.
Read article
Architecture and deliveryYour MVP has been almost done for months: fix, refactor or rebuild?
Decide whether a stalled AI-built MVP needs focused fixes, structural refactoring or replacement using a concrete decision record.
Read article
Launch readinessAI app launch checklist: five questions your demo cannot answer
Before launching an AI-built app, check access, payment failures, recovery, monitoring and rollback. Build a release decision from evidence.
Read article
Technical due diligenceAI-built code handoff: what the next engineer needs
Prepare architecture, setup, deployment and decision records so an AI-built product can be maintained by someone new.
Read article
Application securityAn API key was exposed: what should you do next?
A practical response sequence for an exposed credential: contain access, replace it, inspect use and verify the deployed fix.
Read article
Security readinessAnswering a customer security questionnaire with evidence
Build consistent questionnaire answers from actual controls, evidence owners and clearly recorded gaps.
Read article
RemediationBudgeting for audit remediation before the report arrives
Plan capacity, verification and contingency so an audit produces completed improvements rather than an unfunded backlog.
Read article
Independent assuranceCan a second AI review your code? What independence really adds
Use AI review as a source of hypotheses while requiring independent expectations, reproduction and human ownership of release decisions.
Read article
Independent assuranceCode audit vs penetration test: which review do you need?
Compare source review and penetration testing by the evidence each can produce and the decision your team needs to make.
Read article
Release engineeringDatabase migrations: plan compatibility before rollback
Review schema changes against old and new application versions, data transformations and practical recovery options.
Read article
Application securityDependency review before launch: look beyond the alert count
Review dependency exposure, update paths and runtime use so package alerts become actionable engineering decisions.
Read article
Application securityFile upload security: review the whole attachment journey
Review upload validation, storage access, downloads and deletion as one workflow instead of checking only the file picker.
Read article
RemediationFixed is a claim. Verification is the evidence.
Closing a ticket and closing a risk are different activities. Here is how to make remediation reviewable.
Read article
RemediationHow to prioritise security findings when everything looks urgent
Turn an audit backlog into a practical sequence using exposure, consequence, confidence and dependencies.
Read article
Independent assuranceHow to scope a code audit without buying a vague review
Define the product boundaries, evidence and decisions a code audit should cover before comparing proposals.
Read article
Release engineeringHow to test a database restore before you need it
Turn “backups enabled” into recovery evidence by rehearsing a restore, checking attachments and measuring the missing-data window.
Read article
Release engineeringHow to test AI-generated code before real customers arrive
A practical test plan for AI-built apps: critical journeys, permissions, payment failures, regression checks and release evidence.
Read article
Release engineeringIdempotency for SaaS workflows: make retries safe
Design retries around one business operation so interrupted requests do not create duplicate orders, jobs or payments.
Read article
Due diligencePreparing your team for technical due diligence
Make the review more useful by gathering the evidence behind your product and delivery process.
Read article
Security readinessRelease approval evidence: what to keep with every important change
Connect review, tests and deployment to one revision so release approval can be understood and verified later.
Read article
Security readinessSOC 2 readiness for small SaaS teams: start with the buyer’s request
A practical SOC 2 readiness plan for a small SaaS team: clarify buyer requirements, scope the system and collect evidence before buying tools.
Read article
Release engineeringStripe webhook test plan: duplicates, delays and state changes
Test payment events beyond a successful checkout, including duplicate delivery, delayed processing and access changes.
Read article
Application securitySupabase RLS security checklist: prove who can access your data
Check Supabase permissions, public and secret keys, and cross-account access before launch—with a practical evidence checklist.
Read article
Launch readinessTechnical debt or launch blocker? Make the distinction explicit
Separate inconvenient code from release-stopping risk using affected journeys, consequences and a documented acceptance decision.
Read article
Application securityUseful application logs without exposing customer secrets
Design diagnostic events around safe identifiers and outcomes, then test redaction and log access before production.
Read article
Release engineeringWhat should a small SaaS team monitor after launch?
Choose signals that reveal broken customer journeys and give each alert a clear owner and response.
Read article
Code auditsWhat should you actually receive from a code audit?
A useful report connects a business concern to engineering evidence and a practical next step.
Read article
Release engineeringYour first incident runbook: decisions a small team should prepare
Prepare ownership, containment, recovery and communication steps before a customer-facing incident forces rushed decisions.
Read articleA clear next step
Let’s make your next move a confident one.
Tell us what you’re building and what’s coming next.
We’ll help you scope the right review.