The notebook

All AI & LLMs Cloud & DevOps Industry Insights Laravel & PHP Modernisation Performance & Scale SaaS & Product Security & Compliance

Security & Compliance 15 posts

04 May 2026 Security & Compliance EU AI Act for SaaS Teams: What to Ship Before August 2026 A product-team translation of Article 50, live 2 August 2026: chatbot disclosure at the point of interaction, human-detectable and machine-readable labeling of AI-generated content, and a fe... → 28 Apr 2026 Security & Compliance Access control that is enforced, not just hidden The admin menu was hidden behind a Blade @if — but the routes underneath answered to anyone. Hiding a button is UX, not authorisation. Here is how I make access control actually enforced. → 21 Apr 2026 Security & Compliance GDPR erasure you can actually prove Deleting a user row takes a second. Proving their data is gone from files, search indexes, logs and backups is the real project. How I built verifiable GDPR erasure on a document-heavy platform. → 14 Apr 2026 Security & Compliance Dependency vulnerabilities: composer audit in CI Composer ships a free command that checks your dependencies against known CVEs in seconds. Almost nobody runs it. Here is the CI setup that makes it stick — and the noise rules that keep it useful. → 10 Apr 2026 Security & Compliance Signed URLs versus the file path anyone can guess On a healthcare platform, changing one digit in a document URL opened someone else's medical report. How I replaced guessable file paths with private disks and short-lived signed URLs. → 03 Apr 2026 Security & Compliance The security pass I run before every handover Before any codebase leaves my hands, it gets a fixed security pass — unbilled. Here is the actual checklist, what it keeps finding, and why it ships free with every project. → 22 Mar 2026 Security & Compliance Location verification when the prize is real money I built a live game where standing in the right place wins real money. That turns GPS — a signal designed to be trusted — into a security boundary you have to defend in layers. → 04 Mar 2026 Security & Compliance KYC flows that do not lose the customer Identity verification is where onboarding funnels go to die. How I structure KYC in SaaS products so compliance holds and the customer actually makes it through. → 02 Mar 2026 Security & Compliance PII in Logs and Backups: Fixing the GDPR Blind Spot Erasure requests are easy in the database and nearly impossible in logs, backups and error trackers — the blind spot that turns a clean app into a violation. Concrete fixes: log redaction pr... → 27 Feb 2026 Security & Compliance Web App Security Audit: What I Check Before Every Launch The pre-launch audit I run on every client project, as a checklist with the exact tools: security headers, auth/session hardening, rate limiting, mass-assignment and IDOR checks, dependency... → 24 Feb 2026 Security & Compliance The EU AI Act for SaaS Teams: What Applies When You Call an LLM API High-risk enforcement landed August 2026 with fines up to €35M, and most SaaS founders can't say whether their AI feature is in Annex III scope. As someone shipping LLM features for EU clien... → 21 Feb 2026 Security & Compliance EU Data Residency: Why an AWS Frankfurt Region Isn't Enough The common startup misconception that an EU region of a US hyperscaler satisfies residency — the CLOUD Act says otherwise. Decision framework for Nordic SaaS: when Hetzner, UpCloud (Finnish)... →