OWASP Top 10 is the list of the most serious risk categories in web applications. AI-built apps, for example in Lovable on a Supabase database, usually fail exactly where it says – above all in access control. Here is a 12-point checklist to run before an auditor asks.
Third-party risk management is now a legal duty for companies covered by NIS2. Supply chain security is one of the minimum risk-management measures in the directive, and it reaches the companies that write, maintain and host your software.
An SBOM (software bill of materials) is a list of the libraries, modules and versions a product is built from. From 11 December 2027, the Cyber Resilience Act requires manufacturers of products with digital elements to draw up an SBOM in a commonly used, machine-readable format covering at least top-level dependencies.
The Cyber Resilience Act (CRA) has required, since 11 September 2026, manufacturers of products with digital elements to report actively exploited vulnerabilities and severe incidents. An early warning is due within 24 hours of becoming aware, a full notification within 72 hours and a final report later.
cXML keeps SAP Business Network orders and invoices flowing. How quarterly releases and new DTD versions affect suppliers, and seven steps to avoid failures.
Vibe coding has filled many companies with internal tools IT does not know about, and some of them process customer data. Under NIS2 each one is an asset that must be inventoried and controlled. Here is where the risk comes from, and six steps to bring AI-built tools under control without banning them.
to end the madness
By 3 April 2027, essential and important entities must have their risk-management measures in place, including an information security management system. Those duties reach the applications a company runs every day
TL;DR: NIS2 software requirements cover how a company buys, builds and maintains its applications, not only its firewalls and policies. Each EU country writes NIS2 into national law; in Poland that is the amended KSC Act, in force since 3 April 2026, which gives essential and important entities until 3 April 2027 to implement the […]
Since August 1, 2026 every registered data broker has 45 days to check DROP, match hashed identifiers and report back. The fine for missing it is $200 a day, per request. Most teams are not ready.
Attribution has survived signal loss before. What makes agentic commerce attribution different is that the buyer never visited the site at all.
Most agency websites answer “what do you work with?” with a wall of logos. Ours did too. So here is the same wall, written out.
In this little scroll “how we work”, we’ll show you how we keep code clean, projects on track, and our clients in the loop (no smoke and mirrors, promise) from the first commit to the final ta-da!
who know what they're doing
