What we learned building and running systems
Notes from real projects: architecture decisions, release discipline, security checks and the operational details that decide whether a product survives its second year. Written by the engineers who ship it.
40 articles · Architecture · DevOps · Security · Frontend · Backend · CRM · Support · Delivery · Case study · Web/Mobile · Integration
How to run a retest after a security audit so the risk is actually closed
Fixing a vulnerability in words is not enough. Without a retest a company often believes the risk is gone while the problem either remains or moved to a neighbouring scenario.
Frontend7 min readWhy a page for a complex IT service cannot be just a long description
For a complex service it is not enough to describe what you can do. A client must understand within a couple of screens whether this is their problem, why you can be trusted, and what happens after the first contact.
Web/Mobile9 min readWhat belongs in the first release of a B2B cabinet to avoid burning budget
The main mistake in a first B2B cabinet release is trying to fit the whole internal process into the starting version. The result is an expensive scope, not a working product.
Architecture9 min readTechnical SEO signals that already hold a B2B site back
A site that grows in iterations almost inevitably collects search debris: soft-404s, duplicates, old URLs, utility pages in the index and weak signals for commercial sections.
Web/Mobile8 min readWhy a B2B site gets traffic but no enquiries
Traffic sells nothing by itself. If a site has impressions and clicks but no enquiries, the break is usually in the chain: query, landing page, trust, next step.
Security8 min readRole and access mistakes that expose other people's data in a cabinet
The most expensive security problems in cabinets rarely look like a breach. They look like an ordinary mistake in roles, ownership or an object access check.
Architecture8 min readSigns a system needs highload architecture, not another server
If the system degrades at peaks and each new resource increase helps only temporarily, the problem is probably not the small server but the architecture of the contour.
Web/Mobile8 min readWhat to check before launching a B2B portal or customer cabinet
Launching a B2B portal is not a final checkbox after development. It is a check whether the product can survive real roles, data, integrations and operations.
Web/Mobile7 min readWhen a business needs a web application, not another corporate site
If the company already has user roles, a cabinet, documents, orders, integrations and daily working scenarios, the task left the scope of a regular site long ago.
DevOps7 min read8 red flags that your release process is dangerous for production
If every deployment brings tension, calls and the fear that something will break, the problem is usually the process, not the specific release.
DevOps8 min readWhat DevOps should include for a business: observability, backups and change control
If DevOps in a company is just shipping releases and setting up servers, the business still lacks the main thing: a controlled production environment.
Integration7 min readConnecting CRM with the site, telephony and messengers without losing enquiries
If leads arrive from the site, calls, Telegram and messengers but live in different windows, the business inevitably loses reaction speed and some enquiries.
Architecture9 min readWhy a B2B system slows down after growth: 7 architecture mistakes
When a B2B product goes through growth, it is rarely just the database or the frontend. Usually the system was designed for one scale while the business already lives at another.
Integration8 min readWhy CRM does not work: 7 systemic reasons sales still stall
If CRM is already installed and sales still stall, the problem is usually not buttons or the plan but how the process around the system is designed.
Architecture8 min readWhen a project needs a technical audit, not another development contractor
If the team keeps fixing symptoms, argues about priorities and cannot ship safely, the project usually needs an audit and a first stabilisation phase, not one more contractor.
Security8 min readWhat to prepare before a web product security audit
A good security audit starts not with a scanner but with knowing which scenarios and data are critical, and what you want to receive at the end.
Backend9 min readTypical mistakes in a zero-downtime database migration
Problems in database migrations rarely appear at the SQL level. They appear at cutover, in roles, queues, integrations — and in the assumption that rollback will somehow work out.
Architecture8 min readSigns the product needs an architecture redesign, not another feature
When every change breaks neighbouring scenarios and releases become a stress test, the problem is usually not one feature but the architecture itself.
Security8 min readHow to tell that your web system is already a business risk
A system can avoid daily outages and still be dangerous. Risk accumulates in access, releases, weak ownership and the team's technical habits.
Security7 min readWhen a pentest is useless without a remediation plan
A pentest does not make a system secure by itself. Without ownership, prioritisation and a real plan, it becomes an expensive PDF that changes nothing.
Backend8 min readHow to tell a query problem from a server problem
A bigger server is often bought before anyone works out why the product is slow. The bill grows while the real problem stays inside the data and the queries.
Architecture9 min readExtracting a new service from a legacy system without stopping the business
When the product can no longer be developed safely as a whole, the answer is often not a full rewrite but carefully extracting one critical service.
Architecture8 min readWhat is cheaper: fixing the old system or building a new one alongside
The question is almost never 'rewrite everything or nothing'. Usually the business needs to know what is cheaper right now: stabilise, extract the critical part, or start something new alongside.
Security9 min readTypical vulnerabilities in APIs, customer cabinets and B2B systems
The biggest risks in B2B systems rarely look like a Hollywood breach. Usually they are quiet mistakes in access, APIs and business logic that stay invisible for years.
Backend9 min readWhy the database becomes the bottleneck in a growing product
Load grows and the team's first instinct is more servers. In practice the bottleneck is usually much closer: schema, queries, indexes and the data model.
Architecture8 min readWhen legacy slows the business down, not just the team
How to tell that the problem is no longer awkward code, but a system that is slowing down money, deadlines and control.
Delivery6 min readBuilding an MVP: what to include in the first version
A good MVP is not a cut-down product — it is the first version that solves the core business task.
DevOps7 min readServer administration and DevOps under SLA: a maturity checklist
What has to be in place when the business cannot afford an outage every time something is updated.
Delivery7 min readIT outsourcing vs in-house: choosing a working model
Why the real comparison is not the hourly rate but the cost of chaos.
Support8 min readSupporting a site or app under SLA: when one-off fixes stop working
How to recognise that a project needs regular support instead of living from one urgent fix to the next.
Case study6 min readHow we made PDF contracts resistant to scraping
Drawing invoices and acceptance acts on the fly with PDFKit, and the two problems nobody warns you about: Cyrillic fonts and signature protection.
Security9 min readAPI security: JWT storage, rate limiting and access checks
The hygiene minimum for any public API: how not to let brute force take the server down.
Backend8 min readNestJS vs Express: why we choose a framework with architecture
The end of spaghetti backends: what dependency injection and a strict structure actually buy you.
DevOps6 min readDocker multi-stage builds: cutting images by 90%
Getting rid of ENOSPC alerts and making deploys fast again with a proper Dockerfile.
CRM9 min readBitrix24 implementation: five mistakes that waste the budget
Why a large share of CRM rollouts produce no result, and what makes sales teams actually use the system.
Backend6 min readPostgreSQL vs MongoDB: choosing a database for a B2B product
Relational against NoSQL, decided on real scenarios instead of fashion.
Frontend7 min readReact and Next.js performance: how we made a site three times faster
The fight for Core Web Vitals: server components, dynamic imports and removing unnecessary re-renders.
Security10 min readZero Trust architecture: security for a remote-first company
Why VPNs and firewalls no longer prevent breaches, and what zero trust actually changes day to day.
DevOps5 min readBuilding a resilient CI/CD pipeline on GitHub Actions
A pipeline on GitHub Actions with security checks, zero-downtime deploys and logs delivered to Telegram.
Architecture8 min readMoving from a legacy monolith to services without downtime
A practical account of splitting a legacy monolith for a logistics company without a single maintenance window.
Need this applied to your product?
The notes above come from projects we run. If your situation looks familiar, send a short description and we will say which of these problems is worth solving first.