Journal
Journal: security
On this topic, 19 articles from the journal, from practical guides to behind the scenes of the product.
SecNumCloud: business data hosting rules tightened in 2026
An August 2026 order revised the framework for hosts handling sensitive data. Qualification replaces the sales promise. For a business owner, the question is where software data lives and who can prove it in writing.
Read the article
Anonymous error reporting: what we see of failures, never of your projects
An application reporting failures inevitably learns something about you. We detail the six pieces of information Maestro sends when a screen breaks, what never leaves your Mac, and the two times those records helped us.
Read the article
Exposed API keys in an AI-built application: what an auditor sees
An application delivered in three days welcomes its first users and everything seems to work. An auditor opens it and checks the same three places. What they find, why the demo hides it, and what a business owner can require without reading code.
Read the article
Everything is green, yet it is wrong: how to check what AI built
An advertising professional who cannot code built an application in a week with more than seven hundred passing tests. The import had skipped one file in three, and the tool proposed deleting orphaned data. What green proves, and what you need to inspect yourself.
Read the article
Where is my AI application's code stored? Your tool wants to keep it too
In August 2026, Cursor became the host of the code it writes and removed the final preparation step before launching an agent. The missing step is paid for elsewhere: where your software lives stops being a neutral choice.
Read the article
Do you need French AI to develop an application? Mistral, Dust, and your data
Mistral has signed with Microsoft, opened European regional access, and is targeting a gigawatt of computing capacity. What remains is to understand what that sovereignty covers when AI writes your software, and where the boundary lies between what stays with you and what leaves.
Read the article
Agentic AI and personal data: who is responsible under GDPR?
In July, the CNIL published a note on agentic AI and personal data. It describes agents passing information from service to service and responsibility becoming difficult to assign. What it says, and what to retain before starting a project.
Read the article
Check your application before launch: the 23 vulnerabilities an audit found
The final week goes into announcements, screenshots and first-customer notices. Two pre-launch security reviews, described by a commissioner and a provider, show what else the week should contain and why the list fits into five ordinary working days.
Read the article
API key exposed in an application: an autopsy of a defect, and $600,000 at METR
A tester sent us their project because its online database refused to connect. Opening it, we saw their access key in plain text inside the application. What that costs elsewhere, and what we changed the same day.
Read the article
Software for independent nurses: rounds, travel allowances and fee sharing, alongside approved software
Electronic claims go through approved software, and that will not change. What remains: building rounds, sharing them between partners and locums, and counting travel allowances, an item representing 22% of nursing-care spending.
Read the article
Security of AI-generated code: 56% success, and what you can check
Software that launches and performs its requested service can still have an open door. Veracode has measured large models' generated-code security for two years, and the rate has not moved. What the figure covers, and four requirements before publishing.
Read the article
Cyber Resilience Act: reporting obligations from September 11, 2026, explained
Tomorrow, the European cyber resilience regulation opens its first binding chapter: reporting exploited vulnerabilities. What the text requires, whom it applies to, and why the question changes when your software is an internal tool.
Read the article
Physio or osteopath: simplify practice administration
Cover arrangements and month-end calculations can mean juggling several spreadsheets. A small tool may help track that administration without rebuilding electronic claims or moving patient records.
Read the article
Is your customer data protected? Three initial checks
A sign-in screen is not enough to check who can see your data. Three simple trials on your own app, followed by the evidence to request from its builder.
Read the article
Solo lawyers: keep track of documents and practice tasks
A client has sent documents across several emails. You need to find what is missing before the next meeting. A focused tool can help prepare the file while keeping the services and checks your practice depends on.
Read the article
Building business software with AI: pitfalls and practical checks
From the first demo to everyday work: twelve checkpoints, a fictional workshop and examples for checking calculations, data, access, costs and recovery.
Read the article
What our beta testers broke, second pass: the silence that blocked everything
After a first real user test, 21 written comments revealed a defect invisible internally: an entire step type was handled nowhere in the engine. The chain froze silently, waiting for an answer that never came.
Read the article
Can you keep your application if you change tools?
Your customers and their appointments are already in the application. Before depending on a tool, check what you can retrieve and what you would need to continue elsewhere.
Read the article
Therapists: choose a tool without exposing session notes
Finding information between appointments should be simple. Before building a tracking tool, decide what it holds, who can access it and how that information will be protected.
Read the article