Writing · since 2024
Notes from the studio.
Things we've learned. Things we've changed our minds about. Drafts in public.
Every script on your payment page can read the card
Every script on a payment page has the same access as your own code, including to what the customer types. British Airways lost £20m to twenty-two lines of JavaScript. PCI DSS now asks you to know every script on the page and to notice when one changes. Here's what that means — and how to start in an afternoon.
Archive
15 posts- Nº 015
Native or React Native for a hospitality app?
Three of the six projects on this site are hospitality or culture apps, and a fourth reads rapid tests through a phone camera. All four shipped in React Native. That's a record, not a rule — here's the order we ask the questions in, and where the answer flips to native.
Thanos K.5 min#mobile - Nº 014
Your schema markup is a second copy of the page
Schema markup is the page written a second time, for machines — and second copies drift. We don't keep ours honest by checking it. The page and its structured data come from the same record, so neither can say something the other doesn't.
Nephele K.5 min#seo - Nº 013
The QA list nobody wants to read
91% of the bugs that reach a real user are off the happy path everyone tested. So before every ship we run the QA list nobody wants to read — empty states, double-submits, offline mid-action, names with an apostrophe. Here it is, in order.
Ria P.5 min#process - Nº 012
We trained the model in-house
A recommender doesn't need a foundation model. We shipped one for a hospitality client — a few thousand parameters, retrained every Monday on a single CPU. Most 'AI feature' briefs we see are a ranking problem in a costume.
Thanos K.6 min#ai - Nº 011
The spreadsheet is the spec
Before we replace a client's spreadsheet with a real internal tool, we read every column, every macro, and every dead tab. The spreadsheet already is the system — the rebuild is a transcription with permissions and a query layer.
John P.6 min#custom-systems - Nº 010
Most of your scan findings are noise
A passing scan and a defensible posture are different things. Here's how we tell the noise from the six findings that matter.
Thanos K.6 min#security - Nº 009
Half the time, you don't need a mobile app
About half the briefs we see don't need an app. Here's the question we ask first.
John P.5 min#mobile - Nº 008
Why we ship on Fridays
The week's worst day to ship turns out to be the most honest one. We argue why, then show our deploy log.
Nephele K.4 min#process - Nº 007
The case for un-frameworking your CMS
We've shipped four custom CMSes this year. Here's when not to.
John P.7 min#backend - Nº 006
How we estimate (badly, on purpose)
Our estimates are off by 18%, and that's the point.
Thanos K.6 min#process - Nº 005
Three weeks without opening Figma
What happens when sketches stay in pencil for an entire design phase.
Nephele K.5 min#design - Nº 004
Boring databases age better
Postgres in 2018, Postgres in 2026. Notes from the unsexy middle.
John P.8 min#backend - Nº 003
GEO is just SEO with a longer memory
Generative engines forget less than search engines do. So you write differently.
Nephele K.5 min#seo - Nº 002
Eight rules for typography in software
The first one: stop using system fonts at 14px.
Nephele K.6 min#design - Nº 001
Why we stopped using component libraries
Three years in, we own less code and ship faster. Here's the math.
Nephele K.8 min#frontend