Blog

Assembling a stack from best-in-class services is the sensible default. Here is the specific reason we did the unreasonable thing instead — and what it cost.

A tablet on a shop counter is shared, public, and occasionally offline. Designing for it forced us to rethink what device trust means when the device is not personal.

Component libraries scale poorly when every product has a different domain. We stopped hand-building admin screens — and started shipping admin panels in days instead of weeks.

OAuth solved delegation for a federated web. It does not solve identity for systems where every device, every session and every request needs to be trustworthy. Here's the gap — and what closing it looks like.

We turned on automatic enforcement in production six months ago. Here's what real-world attacks actually look like, how often a legitimate user got caught, and why enforcement has to live next to the data.

Bearer tokens are a liability: whoever holds one is the user. Why a stolen token should be worthless — and why every API that handles sensitive data should insist on it.

A customer app, an admin dashboard, a partner API and a shop-floor terminal should never share one set of security rules. Why one-size-fits-all auth fails — and what per-client security makes possible.

A security system that only logs threats is a record of your exposure. Why response has to be automatic, immediate and reversible — and what that looks like with Enravo Trust.

Most systems can't tell you which installations of their app are out there, let alone switch one off. Why that blind spot matters — and what it looks like when every installation is known, controllable and auditable.