The blog
Notes on building websites, design, and the brands I love working with.
Okay, But Actually… Encryption at Rest Does Not Fix a Bad Application
Someone asked whether a hypothetical business app used envelope encryption and what its blast radius was. Fair questions, once we know what the app stores. Here is what encryption at rest protects, what it cannot fix, and why a locked database can still hand information to the wrong person.
Okay, But Actually… Big Companies Build Custom Software Too
Someone asked why the world's most profitable companies don't build custom software. Walmart and JPMorganChase do. Their own explanations show how large businesses choose what to build and what to buy.
Okay, But Actually… Data Residency Is Not the Same as Data Protection
People love throwing California, Europe and Brazil into conversations about custom software before asking what the application actually does. Here is what data residency tells you, what it does not, and why buying SaaS does not make the legal questions disappear.
Okay, But Actually… Your Six-Figure Business Does Not Need Enterprise Cosplay
Apparently a small business cannot own custom software without recreating the IT department of a multinational bank. Before buying the costume, it might be worth finding out what the application actually stores.
Okay, But Actually… A Pile of Security Vocabulary Is Not a Security Review
Apparently you can review an application without knowing what it does, as long as you mention California, Brazil, envelope encryption, blast radius and lawsuits quickly enough. Here is what those terms actually mean, and what a useful security conversation sounds like.
Okay, But Actually… Custom Does Not Mean Homemade Security
Using Supabase, Stripe or managed hosting does not make a product less custom. I am much more concerned about the person who chose the whole stack because AI sounded confident and now cannot explain what any of it is doing.
Okay, But Actually… One Developer Is Not Automatically the Scary Option
An experienced solo developer should not be confused with a beginner holding an AI subscription, and a crowded agency org chart is not proof of competence.
Okay, But Actually… No, Buying SaaS Does Not Make You Safe
Buying SaaS moves some security work to the provider. It does not remove forgotten admins, shared passwords, abandoned integrations or your own questionable decisions.
Okay, But Actually… Custom Software Is Not the Problem Here
Some AI-built apps should not be anywhere near real customer data. Before hiring anyone, ask who controls access, what happens after launch, and whether the person building it can explain their own security decisions without secretly asking AI.
Why some websites feel instant (and others make you wait)
Having a fast website isn't a matter of luck. Here's what makes a site feel instant, why speed decides whether people stay, and a few things you can check on your own site.
I got the first screen back, and it humbled me
The oldest, smallest piece of the game turned out to be the hardest. It also reinforced what I already knew about AI: it can be completely thorough and completely wrong at the same time, and just as sure of itself either way.
The first five seconds: what your homepage says before anyone reads it
People decide how they feel about your website in about five seconds, before they read a word. Here's what they react to, and how to make those seconds count.
I'm rebuilding a dead game for an audience of two
The servers went dark back in 2018. All I've got left is the app file, a lot of nostalgia, and AI tools that finally make rebuilding it possible.
Why 'it works' isn't the same as 'it's done'
You can get a website on screen fast. Getting one you can trust with real users and real money is different. Here's why the order you build in matters.
The quiet design choices that make people click
A handful of well-understood design choices explain why some pages get people to act and others stall. Here's how I use them to help visitors, not trick them.
What women-led brands actually need from a website
Women-led brands don't need corporate polish. They need clarity, confidence, and a site that sounds like them. Here's what I focus on when I design for them.
Why I build from scratch instead of using templates
Templates are fine, until they aren't. Here's where they stopped working for me, why I build custom instead, and the honest cases where a template is still the right call.
Will AI replace web designers?
Will AI replace web designers? Here's the honest answer from someone who builds with AI daily. It changes the job a lot, and deletes it far less than the headlines say.
Designing for animal brands: warm, but still trustworthy
I have three Pomeranians and I've been the anxious owner picking a dog trainer at midnight. Here's what actually earns trust on an animal brand's website, from both sides of it.
What actually goes into a website (the parts you can't see)
The design you see is about half of a website. The other half is invisible to most: speed, accessibility, SEO, security, and responsiveness. Here's what really goes in.
Why I redesign brands nobody hired me for
I redesign brands that never hired me, on purpose. Here's why concept work is some of my favorite portfolio, and how I pick which brands to reimagine.
No AI slop: what I actually mean (yes, I use AI every day)
I use AI every day to build websites, and I still say no AI slop. Here's what that actually means, and why the tool was never the problem.