Lessons from the workbench

Practical notes on building, securing, and operating software when the details actually matter.

Compliance

2 pieces

Clear

Compliance 6 min

A retention policy nobody implemented is a false statement

If your privacy page says data is deleted after two years, something in your codebase has to actually delete it. Usually nothing does.

3 Aug 2026

Compliance 5 min

Moving the consent gate into the browser does not move the test

We moved the analytics gate out of PHP so the HTML would stop varying by cookie. For a while the entire gate could have been deleted with every server-side test still green.

6 Jul 2026