Engineering notes
What we actually run into building web applications and AI automations - stack decisions, real project costs, and the bugs we keep finding in other people's code.
Every article here comes out of a project that was paid for. There are no roundups, no listicles, and nothing rewritten from somebody else's post. When a piece describes a failure, it is one that happened on our own work or on a client system we were brought in to fix, and the fix is included.
The recurring subjects are the ones that keep costing money: credentials that end up somewhere they should not be, systems that report success while doing nothing, legacy backends nobody wants to own, and the question of whether an AI project needs retrieval, fine-tuning, or a better prompt. Written for the person who has to make the call, not for a search engine.
Smart-UI is a software development agency in Merida, Spain, with an engineering centre in Kharkiv. We build web applications in React, Next.js, Node.js and Python, and AI automation systems, for clients in the UK, US, EU and Australia. If an article describes a problem you recognise, get in touch and we will tell you what it usually takes to fix.
We audited our own site and every page failed
Thirty pages, thirty with at least one fault. What a full audit actually turns up when the site belongs to the people running the audit.
The hardest part of a legacy system is staffing it
The code was never the problem. Finding one senior engineer willing to own an old .NET backend was, and what fixed it was the job description, not the pay.
Adding tests to a codebase that has none
You cannot retrofit test coverage as a project. What works on a legacy system is recording what it already does, starting with the paths that carry money.
Five million emails on a stolen key
A leaked API key, five million emails, and a $2,000 invoice. What the attack looked like, why nothing alerted anyone, and the audit we now run on every project.
Everything was green and nothing worked
Four failures that reported success: a revalidation that changed nothing, a 404 served as 200, schema for content that was not there, and a tag silently dropped.
Inheriting a legacy .NET backend nobody wants to touch
What to do when a business-critical system runs on old .NET, the people who wrote it are gone, and rewriting is not an option. The order of work that holds.
RAG, fine-tuning, or just a better prompt?
Most AI projects reach for RAG before they need it. A decision tree for operations teams, and the three questions that settle it in an afternoon.
Is your API key in the browser bundle?
Secrets leak into frontend bundles constantly, and NEXT_PUBLIC_ is not the culprit people think it is. A 30-second check, and the fix that actually holds.