The blog
Notes on building websites, design, and the brands I love working with.
Okay, But Actually… Encryption at Rest Does Not Fix a Bad Application
Someone asked whether a hypothetical business app used envelope encryption and what its blast radius was. Fair questions, once we know what the app stores. Here is what encryption at rest protects, what it cannot fix, and why a locked database can still hand information to the wrong person.
Okay, But Actually… Big Companies Build Custom Software Too
Someone asked why the world's most profitable companies don't build custom software. Walmart and JPMorganChase do. Their own explanations show how large businesses choose what to build and what to buy.
Okay, But Actually… Data Residency Is Not the Same as Data Protection
People love throwing California, Europe and Brazil into conversations about custom software before asking what the application actually does. Here is what data residency tells you, what it does not, and why buying SaaS does not make the legal questions disappear.
Okay, But Actually… Your Six-Figure Business Does Not Need Enterprise Cosplay
Apparently a small business cannot own custom software without recreating the IT department of a multinational bank. Before buying the costume, it might be worth finding out what the application actually stores.
Okay, But Actually… A Pile of Security Vocabulary Is Not a Security Review
Apparently you can review an application without knowing what it does, as long as you mention California, Brazil, envelope encryption, blast radius and lawsuits quickly enough. Here is what those terms actually mean, and what a useful security conversation sounds like.
Okay, But Actually… Custom Does Not Mean Homemade Security
Using Supabase, Stripe or managed hosting does not make a product less custom. I am much more concerned about the person who chose the whole stack because AI sounded confident and now cannot explain what any of it is doing.
Okay, But Actually… One Developer Is Not Automatically the Scary Option
An experienced solo developer should not be confused with a beginner holding an AI subscription, and a crowded agency org chart is not proof of competence.
Okay, But Actually… No, Buying SaaS Does Not Make You Safe
Buying SaaS moves some security work to the provider. It does not remove forgotten admins, shared passwords, abandoned integrations or your own questionable decisions.
Okay, But Actually… Custom Software Is Not the Problem Here
Some AI-built apps should not be anywhere near real customer data. Before hiring anyone, ask who controls access, what happens after launch, and whether the person building it can explain their own security decisions without secretly asking AI.