Notes from the build

Writing on building things and keeping them safe.

Practical notes on web development and security — the kind of thing we'd want to read before hiring someone for either.

Featured
Package registry with poisoned npm and PyPI packages sending stolen cloud keys and credentials to an attacker, with a red critical alert banner.
Python and Node.js Supply Chain Attacks (October 2026): What Happened and How to Protect Your Business
Poisoned Python and npm packages are stealing keys from developer machines. Three recent incidents, what they cost, and how to defend against them.
Read →
A hooded intruder breaching the PHP layer of a company server, with corporate data leaking out under a critical remote code execution alert, and the patched PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Critical PHP Vulnerabilities (October 2026): How to Protect Your Website and Server
PHP released emergency fixes for two critical remote code execution flaws. What they are, who is exposed, and what to do today.
Read →
Five-stage secure development pipeline for AI-assisted code: define, generate, review, test and deploy, with the review stage highlighted.
The Hidden Security Risks of AI-Built Websites and Web Applications
AI can write a polished app fast. Five places where generated code goes wrong, and a workflow that catches them.
Read →
Diagram showing a suspicious payment request email blocked, while independent verification through a known phone number leads to a two-approver payment release.
AI-Powered Phishing and Business Email Fraud: How to Protect Your Company
Convincing fake emails, cloned voices and urgent payment requests. Five practical controls that reduce the risk.
Read →
Diagram of a protected website surrounded by seven numbered risk areas: software, admin access, configuration, backups, forms and data, monitoring and third parties.
Your Website Looks Professional. Is It Actually Secure?
A professional-looking site can still be exposed. Seven risk areas to check, with a self-check list you can use today.
Read →
List of HTTP response security headers with check marks for four enforced headers and a warning for a missing Permissions-Policy, connected to a shield labelled browser enforces the rules.
Security headers explained, one at a time
What CSP, HSTS and friends actually do, and how to check whether your own site has them.
Read →
Illustration of a security assessment report listing findings by severity (high, medium, low and info) with a retest confirmation card.
What a security assessment actually finds (and what it doesn't)
A walk through what shows up in a real report — severity levels, evidence, and the gap between "no critical findings" and "secure."
Read →
Decision diagram: the question "What are you building?" leads to three options, a content site, an online store and a custom build, each rated on control, speed and upkeep.
Choosing between WordPress, Shopify, and custom code
A framework for matching platform to project, not a "custom is always better" pitch.
Read →
✓

Our rule for this page

Same policy as the Work page: an article goes live when it's actually finished and fact-checked, not filled with placeholder copy pretending to be a real post.

Have a question we haven't written about yet?

Ask the AI Advisor directly, or suggest a topic and we'll consider it for a future article.