deploy safety
- CI builds an image and bumps the tag — deploys are pull, never push
- every deploy is verified with a real request after sync, not assumed
- one command rolls back: the previous image tag is always one commit away
- concurrent CI runs cancel, not queue — always watch the run for YOUR commit hash
secrets
- secrets live in host-side env files, mode 600, mounted read-only
- nothing secret is ever in the git repo — public profile data is PII-free by construction
- tokens have scopes: read for analytics, write only where a job demands it
- a leaked key has a runbook: revoke, rotate, update the one place it lives
email and deliverability
- newsletter is double opt-in — confirmed subscribers only, zero exceptions
- every email carries a working one-click unsubscribe (RFC 8058)
- a health endpoint for the mailer is checked daily, before you learn it from users
- no agent ever bulk-sends — digests are a phase, not a default
analytics you can trust
- analytics is self-hosted — no third party needs your visitors
- conversion goals are tested against real path shapes, not assumed patterns
- funnels measure the flow you actually want: read → subscribe, visit → contact
- no verdict on a sample smaller than three — noise outshouts signal at small n
content that compounds
- every post answers a real question in its first 100 words
- internal links connect related posts — the mesh is the ranking
- hreflang and sitemap are generated from real translations, never hand-edited
- translations are native-quality or nothing — bad translation is worse than none
agents with guardrails
- automation pings one summary per run — a quiet agent is a working agent
- every automated decision cites its evidence: numbers, sources, receipts
- destructive actions are owner-gated; the agent proposes, the human disposes
- the runbook lives beside the code — a fix that is not documented is a bug scheduled for rerun
Get the next one by email
One email per post. No spam, no algorithms.
Enjoying the write-ups? I build like this for a living. hire me