Auditing PHP dependencies without blindly upgrading production A dependency audit identifies known advisories or other package concerns. It is the beginning of a repair decision, not a reason to replace every…

Building PHP dependencies when SSH is unavailable A hosting account without SSH may still run a Composer-based application if a complete compatible release is built elsewhere and uploaded through an…

Checking the PHP runtime used by Composer The PHP used by Composer can differ from the PHP serving the website. A successful dependency install with one runtime does not prove the web process…

Creating repeatable Python dependency installations A repeatable Python deployment records the dependency versions and installation inputs used by the tested application. Unbounded package requirements…

Installing Composer dependencies from a lock file An application’s Composer lock file records the dependency versions selected for its release. Production installation should reproduce that reviewed set…

Investigating Python packages that need native libraries Some Python packages rely on compiled extensions or operating-system libraries. An installation failure may concern that platform support rather than…

Keeping npm registry credentials private Private package downloads need credentials during installation, but those credentials should not be committed to source control or included in the…

Moving runtime secrets out of a public document root Database passwords, application keys and provider tokens should not be downloadable website files. Directory layout and deployment controls should keep…

Rotating an application secret without breaking active traffic A secret rotation is a coordinated change between the issuing service, application configuration and running processes. Its exact recovery behavior…

Separating development and production dependency groups Build tools, test libraries and runtime packages have different roles. A smaller production installation is useful only when it still contains…

Updating a dependency with a staged compatibility test A dependency update changes application behavior even when your own source files stay the same. Treat it as a release with a clear reason, compatibility…

Using a Python virtual environment for each application A virtual environment keeps one Python application’s installed packages separate from another’s. The application process must use that environment, not…

Using environment variables consistently across web and CLI Web requests, SSH commands, cron jobs and workers can start with different environments. A setting present in an interactive shell may be missing from a…