Under the hood

Before we change a system someone else built, we record its behaviour as end-to-end tests against the running instance, tagged “preserve” or “improve”. Findings come from the code and the running system, with file and line references. An evidence register records what was measured and what is only assumed.

We count direct and transitive dependencies, split into build and runtime, known vulnerabilities per layer down to the operating system in the container, missed patches, and the places that need attention for updates. We use tools such as trivy, govulncheck and npm audit and record every number with its date and command, so that it can be repeated a year from now. We measure our own solution by the same rules.

The findings lead to a comparison: what repairing costs, what renewing costs, and what remains in each case. We rebuild only where the analysis justifies it, step by step and against the same tests. A rebuild starts from the observed behaviour, not from a copy of the old code.

We follow the full path from commit to operation: build environment, tests, approval, deployment, rollback and recovery. Infrastructure and configuration live as code and are rolled out via GitOps; recurring steps become shared pipeline building blocks. Recovery counts as secured only once it has been tested.

We clarify access, credentials and keys, monitoring, updates and recovery. On request, we operate the system within an agreed scope and leave documented workflows that can be handed over. On request, we train your team so that it can run them itself.

Today we write most of our code with AI tools and check it like any other code: with tests, review and reproducible builds. The foundation stays deterministic. AI is used where it demonstrably takes work off people's hands, and judgement stays with people. For each engagement we decide which data each model may see, going as far as processing without retention by the provider or on our own hardware.

We use new tools and methods in our own operations first, before we suggest them to clients. That way our advice comes from our own experience: what holds up, what it costs, and where its limits are.

Including GitLab CI, Jenkins, GitHub Actions, Terraform, Ansible, Docker, Kubernetes, Helm, Argo CD, Azure, Go, Java and Intershop.