ai-agents
Every morning at 9:05, a client-status report appears in our announcements channel — reds first, before anyone's had coffee. Nobody writes it. The scheduled AI agents that run our daily operations, the guardrail patterns that keep them safe, and why the prompt has replaced the SOP.
supabase
Our internal app shipped v1 with the database admin key baked into every install — a sin most small teams commit and few admit. How we migrated a live company onto Supabase Auth and Postgres RLS: the identity bridge, the password import nobody noticed, and everything RLS broke.
supabase
We added two-factor authentication to our home-grown team app in about a day — but the interesting part isn't the QR codes. It's making Postgres itself refuse to serve data to a session that hasn't passed the second factor, and the traps we hit doing it live.
build-vs-buy
Eighteen months ago my 12-person company paid for chat, tasks, notes, and a CRM separately — and none of them talked to each other. Today one home-grown app does all of it. Here's the honest math, what made it possible, and a playbook for any small business owner weighing the same move.
Testing
In the last post I walked through rolling out a strict Content-Security-Policy on a legacy WebForms app. What I didn't cover is how the rollout was actually verified before each stage — because "click through the app and see if anything looks broken" stops being
CSP
Content-Security-Policy is one of those headers that sounds like a five-minute fix — add one line to your response, drop 'unsafe-inline', done. Then you point it at a legacy ASP.NET WebForms app and discover the framework itself is one of the worst-behaved CSP
AI Tools
For years the sales side of running Dolphin Infotek lived in a mix of email threads, WhatsApp messages, and whatever I remembered from the last call. It worked in the sense that deals still closed, but "worked" is doing a lot of lifting in that sentence. At some
Self-Hosting
Over the course of a few days I stood up two self-hosted portals for the same underlying reason: SaaS pricing for small teams stops making sense once you actually count seats. Twenty as a CRM, OpenProject for project tracking, both behind nginx on the same box, both wired into
Self-Hosting
This blog costs me about ₹70 a month to run — and that's entirely the domain name. The hosting is genuinely free, running on an Oracle Cloud Always Free VM, and the setup took an evening because I didn't follow a tutorial: I described what I wanted
AI Tools
In my last post I gave the short version: Claude Code and GitHub Copilot occupy different layers, and they're not really competitors. This post is the long version — a head-to-head from someone who runs both in daily work, organized around the question that actually matters: for
AI Tools
There's no shortage of "top 10 AI coding tools" listicles, and most of them read like the author spent ten minutes with each tool and a marketing page. This is the opposite: a short list of only the tools I've genuinely used in daily
RegTech
Compliance software has a reputation for being enterprise software at its most bloated — long implementations, heavy platforms, pricing to match. We've spent decades building SEBI-compliance products for capital markets — insider trading and UPSI compliance, ESOP management, financial consolidation — serving hundreds of institutions with a twelve-person team.