The notebook

All AI & LLMs Cloud & DevOps Industry Insights Laravel & PHP Modernisation Performance & Scale SaaS & Product Security & Compliance

All posts 113 posts

07 May 2026 Laravel & PHP Upgrading to Laravel 13: Field Notes from Real Client Codebases Tests the 'zero breaking changes, ten-minute upgrade' promise against real client apps: the PHP 8.3 floor, which new features (native attributes on models, Queue::route(), Cache::touch()) to... → 04 May 2026 Security & Compliance EU AI Act for SaaS Teams: What to Ship Before August 2026 A product-team translation of Article 50, live 2 August 2026: chatbot disclosure at the point of interaction, human-detectable and machine-readable labeling of AI-generated content, and a fe... → 02 May 2026 Industry Insights Why the person who sold you the project is never the one building it I spent years inside agencies before going independent. Here is why the engineer from your pitch meeting never builds your project — and the questions that expose the model before you sign. → 01 May 2026 AI & LLMs Reliable JSON from LLMs: Structured Output Patterns That Hold Up The technique post underpinning every document-AI and integration project: native structured-output/JSON-schema modes vs the tool-call trick, validate-and-retry loops, enum constraints to ki... → 28 Apr 2026 AI & LLMs Invoice Data Extraction with LLMs: Beyond OCR in 2026 Why vision LLMs beat template-based OCR (reading text vs understanding which number is the total), a production pattern of JSON-schema extraction plus confidence-based human review, and the... → 28 Apr 2026 Security & Compliance Access control that is enforced, not just hidden The admin menu was hidden behind a Blade @if — but the routes underneath answered to anyone. Hiding a button is UX, not authorisation. Here is how I make access control actually enforced. → 25 Apr 2026 AI & LLMs Adding AI Features to an Existing SaaS: An Architecture Checklist The retrofit checklist I run on Laravel codebases: queue-based LLM calls (never inline in requests), timeout and fallback paths for provider outages, per-tenant cost ceilings, PII scrubbing... → 21 Apr 2026 Security & Compliance GDPR erasure you can actually prove Deleting a user row takes a second. Proving their data is gone from files, search indexes, logs and backups is the real project. How I built verifiable GDPR erasure on a document-heavy platform. → 19 Apr 2026 AI & LLMs LLM Guardrails in Production: Surviving Drift and Bad Outputs Runtime reliability engineering as distinct from pre-launch evals: schema validation with retry loops, input sanitisation against prompt injection, fallback chains when a provider degrades,... → 16 Apr 2026 AI & LLMs LLM Evals Without an ML Team: A Practical Setup for Small Teams How a two-person team ships tested AI features: a golden dataset of 200-500 real (not synthetic) examples, assertion-style checks plus LLM-as-judge with its known biases, wired into CI the s... → 14 Apr 2026 Security & Compliance Dependency vulnerabilities: composer audit in CI Composer ships a free command that checks your dependencies against known CVEs in seconds. Almost nobody runs it. Here is the CI setup that makes it stick — and the noise rules that keep it useful. → 13 Apr 2026 AI & LLMs Human-in-the-Loop AI Agents: Approval Gates That Actually Work Where to place approval steps in agent workflows (outbound emails, invoice postings, CRM writes) using confidence thresholds, action whitelists, and audit trails — so automation saves time w... →