Every morning at 9:05, a client-status report appears in our announcements channel — reds first, before anyone's had coffee. Nobody writes it. The scheduled AI agents that run our daily operations, the guardrail patterns that keep them safe, and why the prompt has replaced the SOP.
Our internal app shipped v1 with the database admin key baked into every install — a sin most small teams commit and few admit. How we migrated a live company onto Supabase Auth and Postgres RLS: the identity bridge, the password import nobody noticed, and everything RLS broke.
We added two-factor authentication to our home-grown team app in about a day — but the interesting part isn't the QR codes. It's making Postgres itself refuse to serve data to a session that hasn't passed the second factor, and the traps we hit doing it live.
Eighteen months ago my 12-person company paid for chat, tasks, notes, and a CRM separately — and none of them talked to each other. Today one home-grown app does all of it. Here's the honest math, what made it possible, and a playbook for any small business owner weighing the same move.
In the last post I walked through rolling out a strict Content-Security-Policy on a legacy WebForms app. What I didn't cover is how the rollout was actually verified before each stage — because "click through the app and see if anything looks broken" stops being
Content-Security-Policy is one of those headers that sounds like a five-minute fix — add one line to your response, drop 'unsafe-inline', done. Then you point it at a legacy ASP.NET WebForms app and discover the framework itself is one of the worst-behaved CSP
For years the sales side of running Dolphin Infotek lived in a mix of email threads, WhatsApp messages, and whatever I remembered from the last call. It worked in the sense that deals still closed, but "worked" is doing a lot of lifting in that sentence. At some
Over the course of a few days I stood up two self-hosted portals for the same underlying reason: SaaS pricing for small teams stops making sense once you actually count seats. Twenty as a CRM, OpenProject for project tracking, both behind nginx on the same box, both wired into
This blog costs me about ₹70 a month to run — and that's entirely the domain name. The hosting is genuinely free, running on an Oracle Cloud Always Free VM, and the setup took an evening because I didn't follow a tutorial: I described what I wanted
In my last post I gave the short version: Claude Code and GitHub Copilot occupy different layers, and they're not really competitors. This post is the long version — a head-to-head from someone who runs both in daily work, organized around the question that actually matters: for
There's no shortage of "top 10 AI coding tools" listicles, and most of them read like the author spent ten minutes with each tool and a marketing page. This is the opposite: a short list of only the tools I've genuinely used in daily
Compliance software has a reputation for being enterprise software at its most bloated — long implementations, heavy platforms, pricing to match. We've spent decades building SEBI-compliance products for capital markets — insider trading and UPSI compliance, ESOP management, financial consolidation — serving hundreds of institutions with a twelve-person team.
Databases
This is the technical sequel to my SQL Server to Supabase post. There I argued that coexistence — both databases live, data flowing between them — deserves its own workstream. This is what that workstream looks like as an actual build: a VB.NET Windows Service that syncs bidirectionally between an on-
Migrations
Supabase pitches itself as the fastest way to get a Postgres backend, and it mostly delivers. But if your starting point is SQL Server — as it is for a lot of Microsoft-stack teams — the migration guides skip over the parts that actually consume your week. Having gone through this
Migrations
Every team still on TFVC knows the migration to Git is coming. What keeps it perpetually on next quarter's list isn't the tooling — git-tfs is mature and does the heavy lifting — it's the fear of two things: losing history, and stopping work. Here&
flutter
A financial tracker sounds like a simple CRUD app until you get to the projections screen. Add, edit, delete an investment — trivial. Show someone what that investment will be worth in five years, compounding monthly versus quarterly versus annually — suddenly you're not writing a form anymore, you'
AI Tools
Most posts about AI coding assistants are demos — a clean prompt, a clean result, wrapped up in three minutes. Real client work doesn't look like that. It looks like a locked file breaking your build at 6pm, an OAuth client mismatch that has nothing to do with the
Company Building
Dolphin Infotek is a 12-person company. We build SEBI-compliant software for capital markets — insider trading and UPSI compliance, ESOP management, financial consolidation — for over 500 clients including some of the largest names in Indian banking and financial services. I lead sales and business development. I also write code