360SOFTY

Insights

Engineering Insights

Practical writing on software architecture, SaaS products, AI automation, legacy modernisation, and the business of building reliable systems.

RSS

Curated links from external sources — not 360Softy original articles.

ExternalSoftware Engineering
DEV Community

Incident Retrospectives Without Blame

I've run over 100 post-mortems. The worst ones end with 'Alice will be more careful.' The best ones end with 'we fixed the system.' Here's how you get from the first to the second. Ban these phrases from retros: 'Should have...' 'Alice forgot to...' 'If only...' Replace with: 'The system let this happen because...' 'The runbook didn't cover...' 'The signal was missing...' People make mistakes. Systems that allow those mistakes to reach production are the actual bug. Classic 5 whys often end at h

sredevopspostmortem
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Your coding agent runs a shell on your machine. I audited mine.

A coding agent that can run bash on your laptop is a remote shell on localhost. It has that threat model whether or not anyone designed for it — browser drive-bys, DNS rebinding, curl | bash, the twenty years of localhost-daemon mistakes the web already made and wrote down. Last week wren.wtf published a teardown of opencode: Stop using opencode. Read it in full. The headline was a real CVE — a default HTTP server with permissive CORS and an endpoint that ran arbitrary shell commands, so any web

securityaiagents
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Building a 13-Agent Marketing Society on Qwen Cloud — What Actually Broke, and What I Learned Fixing It

Written for the Qwen Cloud Global AI Hackathon 2026 — Track 3: Agent Society. Most "AI marketing" tools are one LLM wearing a lot of hats — a single prompt that agent society — specialized agents That's what I set out to build with Nexus AI: 13 specialized agents — Qwen-Max through Alibaba Cloud's . The moment it became a real "society" The feature I care about most isn't any single agent — it's what happens between two of them. Social Manager drafts a LinkedIn post. Before anything

aihackathonqwen
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Building a Governance SaaS for Trustees: Why Trust Administration Needs Software

Most trusts don't fail in court. They quietly decay in practice. Missed reviews. Casual transfers. Undocumented compensation. Blended accounts. Over time, a carefully designed trust structure starts looking like an alter ego — and when a beneficiary, regulator, or court asks for proof that the trustee did their job, there's nothing to show. I built TrustOffice to fix this. Here's what I learned building a governance SaaS for a market most developers don't know exists. There are roughly 4–5 milli

webdevproductivityai
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Learnings from Building an MCP Server

I built an MCP server for nuzur, a project I've been working on. It fits naturally into my workflow and helps me automate flows from schema design to data changes. In this post I want to share what I learned during the process. MCP (Model Context Protocol) is an open standard, created by Anthropic in 2024, for connecting AI models to external tools and data sources. Think of it as a universal adapter for integrating with any AI assistant or agent. I started by building CRUD operation tools into

aimcpprogramming
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Embedding a talking AI avatar with one script tag — tried NemynAI, here's what's under the hood

Been exploring AI avatar widgets for a client project and wanted to share a quick find: NemynAI (nemynai.com.ua), a Ukrainian AI avatar platform aimed at businesses that want a chat/voice bot on their site without building anything custom. Integration is dead simple: One JS snippet, drop it anywhere in your HTML Stack (from what's documented): Voice synthesis via ElevenLabs (so decent latency/quality out of the box) Pricing tiers run €9–199/month depending on voice minutes needed (text-only vs.

aiwebdevwordpress
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Open Banking Without an eIDAS Certificate: A Practical Developer's Guide (2026)

If you've ever tried to call a European bank's open banking endpoint directly — say, to read your own account balances programmatically — you probably hit a wall that looks something like this: HTTP 401 Unauthorized {"error": "invalid_client", "error_description": "mutual TLS certificate required"} That's the eIDAS certificate gate. Under PSD2, a bank's production API is protected by mutual TLS using a qualified certificate (a QWAC), and request signing often needs a second one (QSeal). For a r

openbankingapifintech
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Germany's 2026 medtech squeeze: EUDAMED + HTA and what my QMS actually had to change

I started triaging this internally when a procurement lead casually asked if our change-control record could be handed to a hospital HTA team "next week." That moment made the regulatory shift real: EUDAMED visibility plus increasingly formal HTA paths in Germany are colliding into the QMS, and it’s not just paperwork — it’s data, interfaces, and traceability. Below I summarize what I’m seeing in 2026, how it affected our Class II/IIa workflows, and the concrete engineering/validation moves we m

qmsmedtechregulatory
DEV CommunityRead original

Work with 360Softy

Building a SaaS product, AI system, or business platform?

Book a free consultation and we will tell you honestly whether we can help.

Book a consultationView our services →