App Stabilization & RescueAn MVP backend you won't have to rewrite
Why we start client MVPs on Postgres rather than Firebase, what Supabase still ties you to, and how to split a mobile MVP from its store launch.
App Stabilization & Rescue
Field notes on making apps built fast safe for real users, data, and money.
These articles come from reviewing and repairing products that reached real users before they were ready: the patterns we find in apps built fast, moving users off an insecure legacy app without a cutover weekend, testing embedded firmware before the hardware exists, code highlighting that fails accessibility contrast, and the post-mortem of our own contact form. Client names are withheld unless the client agreed to be named.
For the engineering behind the notes, see App Stabilization.
7 articles
App Stabilization & RescueA control nobody can reach is a control nobody tests
Three access controls in a compliance pipeline had passing tests and could never fire. Why unit tests miss unreachable controls, and how to find them.
App Stabilization & RescueYour code highlighting probably fails accessibility contrast
Hugo's default code theme failed WCAG AA contrast on 10 of our 12 posts with code. How we tested nine themes with axe-core, and the parser trap we found.
App Stabilization & RescueTesting embedded firmware before the hardware exists
How to keep pre-silicon firmware honest: fail-closed stubs, a sanitized host test harness, marked bench seams and a protocol simulator.
App Stabilization & RescueRetire, don't patch: moving users off a legacy app without a big-bang cutover
A strategy for retiring an insecure legacy app: a live switch, delta loads, paced invites, a read-only legacy database and rehearsed restores.
App Stabilization & RescueOur contact form silently dropped every inquiry for six days
A post-mortem: a template-encoding bug sent every website inquiry to a dead URL for six days. How we found it, sized the damage and stopped it recurring.
What we find in apps built fast
The failure classes a stabilization assessment keeps finding in apps built quickly, including with AI builders, and how to check your own.