The blog

Notes on building websites, design, and the brands I love working with.

All 7 paladins ai ai development animals architecture behind the scenes build vs buy business business software conversion custom software cybersecurity data privacy data protection data residency design encryption enterprise game dev okay but actually performance process saas security small business software development solo developer supabase threat modelling vibe coding women-led

9 October 2026

Okay, But Actually… Encryption at Rest Does Not Fix a Bad Application

Someone asked whether a hypothetical business app used envelope encryption and what its blast radius was. Fair questions, once we know what the app stores. Here is what encryption at rest protects, what it cannot fix, and why a locked database can still hand information to the wrong person.

aicustom softwarecybersecurityencryptionsupabasedata privacy

Read post

5 October 2026

Okay, But Actually… A Pile of Security Vocabulary Is Not a Security Review

Apparently you can review an application without knowing what it does, as long as you mention California, Brazil, envelope encryption, blast radius and lawsuits quickly enough. Here is what those terms actually mean, and what a useful security conversation sounds like.

securitycustom softwaredata protectionencryptionthreat modellingai development

Read post