Wissensys - Engineering notes https://wissensys.com/blog Complex software, made clear and built to last. en Your suppression list belongs in the mailer, not the call site https://wissensys.com/blog/suppression-lists-belong-in-the-mailer https://wissensys.com/blog/suppression-lists-belong-in-the-mailer#1 Mon, 17 Aug 2026 16:41:48 +0000 Every "we accidentally emailed someone who unsubscribed" incident has the same root cause: the check lived in the code that sends, and one send path forgot it. Engineering A Cloudflare Tunnel turns your form redirect into a 502 https://wissensys.com/blog/a-cloudflare-tunnel-turns-302-into-502 https://wissensys.com/blog/a-cloudflare-tunnel-turns-302-into-502#2 Mon, 10 Aug 2026 16:41:48 +0000 Validation fails, Laravel returns a 302, and the visitor sees "Service temporarily unavailable" instead of "email is required". Here is why, and what to do. Operations A retention policy nobody implemented is a false statement https://wissensys.com/blog/retention-policies-that-are-only-a-pdf https://wissensys.com/blog/retention-policies-that-are-only-a-pdf#3 Mon, 03 Aug 2026 16:41:48 +0000 If your privacy page says data is deleted after two years, something in your codebase has to actually delete it. Usually nothing does. Compliance A second Content-Security-Policy header is not a stronger one https://wissensys.com/blog/one-owner-per-response-header https://wissensys.com/blog/one-owner-per-response-header#4 Mon, 27 Jul 2026 16:41:48 +0000 Two CSP headers do not override each other. The browser enforces both, your new allowed origin never takes effect, and nothing in the response looks wrong. Engineering If a fresh install does not work, nothing else you measure matters https://wissensys.com/blog/a-fresh-install-that-does-not-work-is-a-broken-project https://wissensys.com/blog/a-fresh-install-that-does-not-work-is-a-broken-project#5 Mon, 20 Jul 2026 16:41:48 +0000 The command that rebuilds the database from nothing is the one command every new machine runs first, and it is the one nobody runs again after the first month. Engineering Reduced motion is not "turn the animation off" https://wissensys.com/blog/reduced-motion-is-not-turn-the-animation-off https://wissensys.com/blog/reduced-motion-is-not-turn-the-animation-off#6 Mon, 13 Jul 2026 16:41:48 +0000 An element that animates from invisible, told only to stop animating, stays invisible. The page does not lose its motion - it loses its content, for the people who asked for less motion. Engineering Moving the consent gate into the browser does not move the test https://wissensys.com/blog/the-consent-gate-belongs-in-the-browser https://wissensys.com/blog/the-consent-gate-belongs-in-the-browser#7 Mon, 06 Jul 2026 16:41:48 +0000 We moved the analytics gate out of PHP so the HTML would stop varying by cookie. For a while the entire gate could have been deleted with every server-side test still green. Compliance A backup you have never restored is a hope, not a backup https://wissensys.com/blog/a-backup-you-have-never-restored https://wissensys.com/blog/a-backup-you-have-never-restored#8 Mon, 29 Jun 2026 16:41:48 +0000 The nightly job is green. The bucket has files in it. Nobody has ever taken one of those files and rebuilt a working database from it, so nobody knows whether they can. Operations