Insights
How AI implementation actually works
Architecture breakdowns, model comparisons for concrete tasks and write-ups from our projects.
Insights
AI & Machine Learning ·
Workflow or agent? How we decide before writing a line of code
If every step of a process can be written down before it runs, build a workflow and put an LLM call only where something has to be read and interpreted. Use an agent only when the next step depends on what the last one found, and cap it hard.
8 min read
Security ·
Cyber Resilience Act reporting is live: what to build before your first 24-hour clock starts
Since 11 September 2026 every manufacturer selling software or connected products in the EU must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform within 24 hours. The law is short; the hard part is the pipeline that tells you, inside that window, what you ship and whether it is being exploited.
8 min read
Business & product ·
EU AI Act After the Omnibus: What to Build Before Dec 2026
The Digital Omnibus moved the EU AI Act's high-risk dates to December 2027 and August 2028, but Article 50 transparency has applied since 2 August 2026 and marking for older generative systems is due on 2 December 2026. Here is what each date means in code, and what we put in the first sprint.
9 min read
Security ·
MCP Servers in Production: How We Vet and Lock Them Down
Inventory every MCP server first, authenticate each caller with a token issued for that exact server, sandbox anything that runs locally, and log every tool call. Most 2026 MCP incidents trace back to configuration and defaults, and the 28 July 2026 spec revision adds a migration on top.
9 min read
AI & Machine Learning ·
AI Agent Costs: Budgets, Caching and Routing That Work
Agent bills grow with calls per task, not with the token price. We measure cost per completed task, keep the prompt prefix cacheable, route steps to the cheapest model that passes our evals, and cap every task by tokens.
9 min read
Engineering practice ·
Legacy PHP: Upgrade, Strangle or Rewrite? How We Decide
Upgrade in place first, one PHP minor version at a time, and replace piece by piece only what the upgrade cannot reach; rewrite from scratch only small systems, dead frameworks or a product that is changing. Here is the order we check things in, the tooling we run, and what a first pilot looks like.
9 min read
Security ·
SealedRun: Tamper-Evident Audit Trails for AI Agents
Agent traces stored in your own database are claims, not evidence: whoever runs the store can edit it. SealedRun, an early-stage open-source recorder, signs every agent step into a hash chain that an outsider can verify offline. Here is how it works, what it proves, and how we run it for our own agents.
9 min read
Python ·
Parsing CS2 match logs in 2 seconds: why pandas beat Polars for KLR.gg
Evaluating Apache Arrow memory layouts versus contiguous NumPy blocks when calculating Glicko-2 and HLTV Rating 2.0 metrics in the KLR.gg analytics engine.
5 min read
AI & Machine Learning ·
RAG, Fine-Tuning or Long Context: How We Choose
Start with the simplest setup that passes an eval on your own questions: a cached long prompt for a small, stable corpus, RAG when knowledge changes, must be cited or is access-restricted, and fine-tuning only for behaviour. Here is the order we check things in and where each option breaks.
9 min read
Mobile ·
Fixing Android ANRs: How SQLite WAL Rescued Our Mobile App
Switching from SQLite default rollback journal mode to Write-Ahead Logging (WAL) and tuning Room database connection pools eliminated UI thread blocks across our fleet of 50,000 active devices.
6 min read
Mobile ·
Why Bridge Serialization Forced Our Mobile App Rewrite to Native Swift
Streaming 100Hz BLE telemetry through React Native's legacy bridge saturated the event loop, forcing a complete rewrite to native Swift.
6 min read
Cloud, DevOps & High-load ·
Why We Left AWS Aurora PostgreSQL for Managed Bare Metal to Save 58%
Migrating a high-throughput 12TB PostgreSQL database off AWS Aurora reduced our monthly bill by 58%. Here is the technical breakdown of our storage I/O costs and cutover strategy.
6 min read
AI & Machine Learning ·
Why Hybrid Search Beat Pure Embeddings in Our Invoice AI Pipeline
Pure dense embeddings failed on alphanumeric serial numbers in our Invoice AI pipeline. Combining PostgreSQL tsvector full-text search with pgvector cosine distance lifted top-1 matching accuracy from 61.4% to 94.8%.
6 min read
AI & Machine Learning ·
Why pgvector Replaced Qdrant in Our LLM Feedback Pipeline
We migrated 5 million vector embeddings from a standalone Qdrant cluster to PostgreSQL 16 with pgvector 0.7. Here is how operational overhead dropped while maintaining sub-50 ms search latencies.
5 min read
AI & Machine Learning ·
How AI agents work: the architecture of a production agent
An agent is a model wrapped in perception, memory, tools, orchestration and monitoring. A practical walk through the six layers, what breaks in each one, and what we do about it.
6 min read
Security ·
OWASP Top 10 for LLM applications, explained for people who ship them
The 2025 list names ten ways an LLM app gets attacked. Here is what each one looks like in a real chatbot, RAG system or agent — and the fix we apply in production.
4 min read
AI & Machine Learning ·
RAG in production: the checklist we run before go-live
Retrieval-augmented generation demos in a day and fails in a month. The twelve checks — data, retrieval, generation, operations — that separate a pilot from a system people rely on.
5 min read
Security ·
Penetration test or vulnerability scan: which one to order, and when
Customers ask for a "pentest" and often mean a scan; vendors sell a scan and call it a pentest. What each really is, what it costs in time, and a schedule that works for a product team.
4 min read
Engineering practice ·
Python, PHP or Node.js for your back end? How we actually choose
We ship all three. The decision is rarely about the language — it is about the team that will maintain the system, the libraries the problem needs and the load profile. A plain guide.
4 min read
Security ·
Securing AI agents in production: seven controls we never skip
An agent that can read your CRM and send emails is an employee with no judgement and infinite patience for a well-written attack. The controls that let us connect agents to real systems without losing sleep.
4 min read
Cloud, DevOps & High-load ·
Surviving peak load: ten things we check before a sale, a launch or a season
Black Friday, a TV ad, a ticket release — the traffic spike is known in advance, and so are the failures. The checklist we run on e-commerce and high-load back ends before the day.
4 min read