News and articles. From real work, no fluff.
What we learn from client projects and our own products. SEO, AI, security and development.
Latest
SecurityOctober 28, 2026 · 13 min read
API security: authentication, limits and data protection
A valid token does not grant access to every record. A secure API must check identity, permitted actions, specific data and acceptable resource use. It also needs rules for credentials, logs and change. This guide explains what to require during design and how to verify the result using an illustrative business API.Read article →Email Security: How to Introduce SPF, DKIM and DMARC
Someone can send a message that appears to come from your business without knowing a mailbox password. SPF, DKIM and DMARC help receiving systems authenticate the domain involved. Introducing them takes more than copying three DNS records. You need an inventory of senders, evidence from real messages and a policy suited to the way your business communicates.Application authentication: SSO, MFA and user management
A user signs in successfully and opens another company’s order. A former employee leaves, but their existing session still works. Sign-in is only the start. A dependable application connects identity, permissions, recovery and timely removal of access.GDPR in a web application: Decisions to make before the first database
The application is nearly ready, and someone asks where to add a GDPR consent checkbox. Meanwhile, customer details already reach logs, analytics and the test database. Data protection belongs in the data model and operating process. A document added before launch cannot repair access controls or create a missing deletion process.GDPR and IT security: protecting personal data in practice
A privacy notice describes what an organization intends to do with personal data. The application must make that intention real through access controls, retention, supplier arrangements and an incident process. GDPR and IT security meet in those everyday decisions, where a broad policy can otherwise leave sensitive records exposed or impossible to recover.ISO 27001: when certification makes sense and how it works
A prospective enterprise customer asks for an ISO 27001 certificate. The immediate question is commercial, but the work reaches far beyond the sales team: access decisions, suppliers, development, incident response and management accountability. Certification makes sense when the business can sustain the system behind the certificate.Biometric login: implement Face ID and fingerprint access correctly
An app shows a fingerprint prompt and then opens a protected screen. That can be convenient, but the prompt alone says little about how the account is authenticated, where credentials are stored, or whether the server will reject an unauthorized action. The implementation behind the screen matters.Phishing and social engineering: prepare employees for the decision
A familiar supplier asks finance to change bank details. A colleague requests an urgent file through chat. Someone claiming to be support asks for a login approval. The important question is often whether the requested action fits an agreed process, and how to verify it safely, rather than whether the message contains a spelling mistake.SIEM and SOC for a midsize business: who acts on the alert?
An alert reports unusual administrator activity at midnight. The monitoring platform collected it correctly, but the notification goes to an unattended mailbox and nobody has authority to suspend the account. Security monitoring succeeds when useful evidence reaches a person who can investigate and act, within the coverage your business actually needs.MFA and passkeys: protect business accounts without losing access
The finance team has enabled MFA, but one legacy login still accepts a password alone. An administrator uses a passkey, but nobody has tested recovery after losing every device. Better sign-in methods matter. So do the routes around them, the people who approve recovery, and the ability to keep working when something fails.Mobile App Security: Where to Store Data, How to Encrypt It, and How to Protect Your API
A secure mobile app keeps sensitive data only in the phone’s built-in vault (the Keychain on iPhone, Android Keystore on Android), talks to its server over encrypted connections only, ships with no secret keys inside, and relies on a server that checks on every request whether this user may see this exact record. Below we look at where apps fail most often, what changed in 2025 and 2026, and what to put in your contract with the developer. Current as of October 2, 2026.Surfshark Scam Protection Review 2026: Is It Worth It?
Surfshark Scam Protection is a solid add-on to a VPN if you use Android and Gmail, but it is not complete protection against scams. It filters scam texts, watches for your data in breaches, blocks dangerous websites and checks suspicious emails. It does not screen phone calls yet, and the email checker only works with Gmail in Chrome. It comes with the Surfshark One plan, from $2.79 a month for the first 27 months (before tax), then renews at $99 a year. We went through the pricing, help center, privacy policy and independent test results as of September 30, 2026.Who can see your customers’ data? Data security in custom software development
Customer data rarely leaks from custom software through some brilliant hack. It leaks through an account nobody switched off, a test server holding a copy of the live database, or a vendor with no proper contract. Here is what to get right from the first brief to day-to-day operation, what the EU’s GDPR and NIS2 cybersecurity rules expect of you, and what to ask a developer before you hand over your data.Launching a Web App? Check These 105 Things Before Attackers Do
Before you push a web app to production, you need four things nailed down: who can access which data, where your secrets live, how clean your dependencies are, and how you’ll know when someone is attacking you. Everything else, from security headers to backups to compliance, builds on those four.Change One Number in the URL: The Code Flaws That Leak Your Data
A lot of web app breaches start with an embarrassingly simple bug: the server never checks whether the record a user asks for actually belongs to them. Change /invoices/1234 to /invoices/1235 in the URL, and an attacker is reading someone else’s invoices. That’s why broken access control is still number one in the OWASP Top 10:2025 (OWASP).One npm install Was All It Took: How API Keys Get Stolen in 2026 and How to Stop It
In 2026, one of the easiest ways into your app was a library you installed yourself. In late March 2026, attackers took over the account of the lead maintainer of Axios, one of the most widely used JavaScript libraries, and published versions carrying a remote access trojan for Windows, macOS, and Linux (Security Boulevard). Anyone who ran npm install at the wrong moment may have handed over the keys to their infrastructure.They Already Know Your Staging Server: How to Lock Down Hosting, HTTPS, and Cloud Before Launch
The moment you issue an HTTPS certificate for your staging server, attackers know it exists. Every certificate is written to public Certificate Transparency logs, and automated scanners read those logs in real time. Researchers at UC Santa Barbara ran honeypot servers for 200 days and saw the first probes just seconds after a certificate was published (UCSB, IEEE EuroS&P 2023). The study is three years old, and scanners have only multiplied since.A Data Breach Now Costs $4.99 Million on Average. What Leadership Must Do Before Launch
App security is a leadership job too: the incident plan, vendor choice, penetration testing, and regulatory compliance all land on the executive team. In the EU, the NIS2 directive makes management bodies responsible for approving cybersecurity measures and overseeing how they’re carried out (NIS2 Directive, Article 20).How to Secure Your Phone and Accounts: A Two-Factor Authentication Guide (2026)
Two-factor authentication is the single most effective way to protect your accounts. Even if a scammer gets your password, say from a phishing text or a data breach, they can’t get in without the second step: a code from an app or a confirmation on your phone. It takes a few minutes per account and costs nothing.Share this page
Got an idea?
On a short call, we'll find out what you need and suggest the next step. Then you'll get a proposal with a fixed price and a timeline.
+420 771 166 199Mon to Fri, 8:30 a.m. to 4:00 p.m. (Prague time) · info@listify.coolWhen should we call you?
Pick a day and a time window. We'll call you, and it takes about 15 minutes.
Day