Engineering
Hands-on engineering practice: languages, frameworks, delivery, security and developer workflows.
npm Supply Chain Attacks in 2025: Hardening a Node.js and TypeScript Codebase
In September 2025 a phished maintainer led to malware in chalk and debug, then a self-replicating worm spread through hundreds of npm packages. Here's what happened and how I'm hardening our Node.js codebases.
Platform Engineering Without a Platform Team: Golden Paths for Small Organisations
You don't need a platform team or a developer portal to get most of the benefits of platform engineering. For small organisations I focus on a few golden paths: a service template, shared CI, shared Terraform modules and a catalogue that lives in the repositories.
PHP to TypeScript: Why We Migrated a Production Subscription Platform
Migrating a production subscription platform from PHP to TypeScript is not a decision taken lightly. Here's the honest case for why we did it, the alternatives we rejected, and what the migration actually delivered.
TypeORM vs Prisma: Choosing Your ORM for a TypeScript Migration
During a platform replatforming, we ended up using two different ORMs in the same project: TypeORM for the core backend API, Prisma for the admin panel. Here's why, and what each is genuinely better at.
Multi-Repo vs Monorepo: A Practical Decision Framework for Small Teams
The monorepo vs multi-repo debate generates more heat than light. Here's the framework I used, and why multi-repo won for a subscription platform replatforming with four applications and a lean team.
Next.js App Router in Production: Lessons from Moving Off the Pages Router
The App Router is a different mental model, not just a new folder. Here's what I've learned running it in production on Next.js 14: Server Components, the caching defaults that surprise everyone, server actions, and how to migrate route by route.
The Two-Tier Feature Flag Strategy: When LaunchDarkly Is Overkill
Feature flags are non-negotiable for safe deployments. But commercial feature flag platforms have convinced teams that a £50K/year SaaS is the only way. Here's the two-tier approach that covers 95% of use cases at a fraction of the cost.
Involuntary Churn: The Engineering Behind Recovering Failed Subscription Payments
Some of the customers a subscription business loses never chose to leave. Their card simply failed. I treat failed-payment recovery as an engineering system: smart retries, decline handling, card updaters and dunning, all built on idempotent, observable queues.
Feature Flags: Enabling Safe and Reliable Deployments
Feature flags changed how we deploy at Freddie's Flowers more than any other single practice. Here's how we implemented them, what went wrong early on, and why I'd never run a production system without them.
Home Office Ergonomics: What Engineers Actually Need
Six months into remote work, half the team had back pain. We learned the hard way that kitchen tables aren't workstations. Here's the equipment list that actually matters.
Remote Pair Programming: Making It Actually Work
Pair programming is hard enough in person. Remote pair programming seemed impossible until we figured out the right tools, practices, and rhythms. Here's our playbook.
Why We Chose Go for TouchNote's Backend (And What Surprised Us)
In 2016-17, TouchNote's backend was a mix of PHP and a growing need for high-concurrency services. Go was the answer, but the migration surfaced surprises we didn't anticipate.
ZendMVC and Rebuilding TouchNote: A PHP Architecture Story
Rebuilding a production platform while the business keeps running is one of engineering's hardest challenges. Here's how we used ZendMVC and AngularJS to transform TouchNote's architecture without breaking it.
Building Resilient Software with C: Enterprise Patterns for Disaster Recovery
Working on InMage's disaster recovery platform in C is teaching me lessons about reliability engineering that apply at every level of the stack, from kernel modules to web applications.