Notes from the studio.
What we learn building and securing software for this market: written up properly, so you do not have to learn it on your own budget.
We run SQLite in production, and it was the right call
SQLite has a reputation as a toy database. It runs five restaurant platforms for us. Here is where that holds, where it breaks, and how to tell which case you are in.
QR ordering at the table: designing the flow around the kitchen
Most QR menus are a PDF behind a code. Real table ordering has to survive a busy service, which changes who confirms what, and when.
What an App Store rejection actually looks like
Rejections are routine, not catastrophic. The ones we see repeat: privacy answers that do not match the app, missing account deletion, and permission text nobody wrote.
Building an AI assistant that cannot invent a price
A chatbot that hallucinates a restaurant price is worse than no chatbot. The fix is architectural: the model never answers from its own knowledge, only from tool results.
Right-to-left Arabic is not a translation problem
Swapping the strings is the easy tenth. The layout has to mirror, numbers stay left-to-right inside right-to-left sentences, and animations point the other way.
Where subscription fraud actually happens, and how to close it
If your app decides entitlement from what the device reports, it is already bypassed. Server-side verification is the whole game, and it changes how you model entitlement.
What separates a penetration test from a scanner report
A scanner returns three hundred findings and no exploit. A real test returns a chain, a proof, a fix and a retest. Here is how to tell what you are buying.
Alert fatigue is a design failure, not an analyst failure
A SIEM that alerts on everything is the same as one that alerts on nothing. Tuning is not cleanup after the project, it is the project.
Network segmentation for a business with no security team
Flat networks are why one clicked attachment becomes a company-wide incident. Meaningful segmentation is achievable without enterprise tooling or a dedicated team.
Designing checkout for a cash-on-delivery market
Most e-commerce advice assumes cards. In Morocco the order arrives by phone call and settles in cash at the door. That changes checkout, order states and even the database.
One codebase, two app stores: what Expo actually buys you
We ship iOS and Android apps from a single React Native codebase. A honest account of what Expo gives, what it costs, and the failure that only appears in production builds.
A practical OWASP pass for a small business website
You do not need an enterprise budget to close the holes that actually get small sites hacked. The checks we run on every site we ship, and what each one prevents.
Programmatic SEO for directory sites, without the spam
How a directory earns search traffic page by page: URL design, structured data, sitemaps that grow with the database, and the thin-content trap that gets sites ignored.