The window
TheLab
Experiments, write-ups, free tools and the making of this room.
Build notes5 sections · 4 ✓Making the workshop with ComfyUI
The room you walked through to get here is one painting, cut into thirteen pieces. Generating the pieces separately was the thing that did not work.Generate the whole scene once. Separate generations cannot agree on a camera.Cut props by differencing two renders of the same seed, not by masking one.Click to explore
Playbook6 sections · 5 ✓Prompt injection in production agents
Prompt injection is not one bug with one fix. It is five attack categories, each with a different defence, which is why teams that add input sanitisation once get a vulnerability report two weeks after launch.LLMPrompt injectionOWASP↗ dfieldsolutions.com
Free tool4 sections · 4 ✓AI security self-audit
Fifteen questions, about five minutes, and nothing leaves your browser. You get a score, a verdict and the fixes for whichever axes you scored worst on.AI securityOWASP LLMChecklist↗ dfieldsolutions.com
Build notes3 sections · 4 ✓Core Web Vitals on a real Next.js site
LCP, INP and CLS are three numbers with three different fixes. Most slow sites fail on the same four things, and none of them need a rewrite.Next.jsWeb VitalsPerformance
Build notes3 sections · 4 ✓RAG that cannot quote a wrong price
A retrieval pipeline that cites stale prices and invented SKUs is worse than none at all. Grounding is a pipeline problem, not a prompt problem.RAGLLMEmbeddings
Playbook3 sections · 4 ✓Solana foot-guns Anchor does not remove
Anchor removes the boilerplate, not the sharp edges. The bugs that lose money are the ones the framework politely lets you write.SolanaAnchorRust
Case note3 sections · 4 ✓From WhatsApp chaos to a real order pipeline
Orders arriving as chat messages feel fast until the day someone misses one. Turning the chat into a pipeline cost less than one lost order.AutomationWhatsAppE-commerce
Build notes3 sections · 4 ✓Structured data an answer engine can use
Search engines read pages. Answer engines read claims. Structured data is how a page says which is which — and this site is the test subject.SEOAEOSchema.org
Field notes3 sections · 4 ✓Where the checkout loses the sale
The sale is lost between 'add to cart' and 'paid' in boring, measurable places. The fixes are usually weeks, not redesigns.E-commerceConversionCheckout
Field notes3 sections · 4 ✓A backup you never restore is a story
Every audit asks the same question and gets the same pause: when did you last restore it? The drill is the backup.OpsBackupPostgres
Playbook3 sections · 4 ✓An accessibility pass in one afternoon
A real a11y pass is an afternoon of tabbing, zooming and one screen reader — not a conformance project. The wins are mechanical and mostly free.A11yWCAGFrontend
Build notes3 sections · 4 ✓Prompts are code: eval them like code
A prompt that cannot be regression-tested is a script nobody dares to refactor. Versioned, evaluated, diffed — the same hygiene as any deployed artefact.LLMEvalsCI
Playbook3 sections · 4 ✓Why your contact form lands in spam
The form works, the mailbox is fine, and enquiries still vanish. Almost always the problem is three DNS records nobody wrote down.EmailDNSDeliverability
Playbook3 sections · 4 ✓The local SEO checklist we run for ourselves
A studio in Dunakeszi competing for 'web developer Budapest' searches. What actually moves a local ranking, in the order it moves it.Local SEOGEOGoogle Business Profile
Build notes3 sections · 4 ✓What we did for the AI crawlers
Every page on this site has a markdown twin, a JSON-LD graph and a seat in llms.txt. Some of it is proven, some of it is a cheap bet — here is which is which.AEOAI SEOllms.txt
Case note3 sections · 4 ✓Enquiry to booked call, without the inbox
A service business losing work in the gap between 'they wrote' and 'we replied'. The fix was a pipeline, not a faster typist.Automationn8nBooking
Playbook3 sections · 4 ✓Stripe webhooks that survive retries
Stripe will deliver the same event twice, out of order, at 3am. The handler is correct only if none of that matters.StripeWebhooksPayments
Build notes3 sections · 4 ✓One site, three languages, zero duplicate-content problems
This site answers in English, Hungarian and German — with localized URLs, symmetric hreflang and content that was written, not machine-translated. The build notes.i18nhreflangSEO
Playbook3 sections · 4 ✓Your thousand dependencies, audited in an afternoon
Nobody reads a thousand packages; everybody runs them. The boring controls that keep the supply chain survivable.Supply chainnpmSecurity
Pattern3 sections · 4 ✓The public status page replaces the status meeting
Every project we run ships with a public progress endpoint the client can check anytime. What it shows, and why it kills the 'where are we' call.DeliveryProcessTransparency
Playbook3 sections · 4 ✓Move the site, keep the rankings
The redesign that loses 40% of organic traffic is not a design failure — it is a redirect failure. The checklist that prevents it.MigrationSEORedirects
Playbook3 sections · 4 ✓Monitoring that pages someone, not the dashboard
A dashboard nobody watches is a screensaver. The setup that actually catches the outage: external probes, one alert path, a written runbook.MonitoringOpsUptime
Buyer's guide3 sections · 4 ✓What custom software actually costs
The honest answer is a range with a driver behind it. Small automations land in the low thousands; a product with payments, roles and a mobile surface is a different order of magnitude. What moves the number is never the page count.PricingBuying softwareProcess
Buyer's guide3 sections · 4 ✓Custom software or off the shelf — the honest test
The shelf wins when the process is standard. Custom wins when the process is the advantage. The expensive mistake is buying custom to do something a plugin already does, or bending a business to fit a tool it has outgrown.Buying softwareBuild vs buyTCO
Comparison3 sections · 4 ✓Self-hosted n8n or Zapier — where the bill actually differs
Zapier charges per task and punishes success: the more the automation works, the more it costs. Self-hosted n8n charges in maintenance instead. The crossover is closer than it looks — and it is about data, not just price.n8nZapierAutomation
Field notes3 sections · 4 ✓The first ninety days of a retainer, as it actually goes
Month one reads the codebase before touching it. Month two clears the queue that built up while nobody owned the system. Month three is where it starts looking like progress instead of maintenance.RetainerMaintenanceProcess
Field notes3 sections · 4 ✓Why clients get a progress page instead of status emails
Status emails answer 'where are we' the day they are written and expire immediately. A live progress page answers it whenever the question is asked — and the question gets asked at 11pm.ProcessClient communicationTransparency
Build notes3 sections · 4 ✓MCP servers in production, not in the demo
The Model Context Protocol demos beautifully: plug a server in, the model gets tools. In production the questions are duller — who can call what, with whose credentials, and what happens when the tool answers wrong.MCPAI agentsSecurity
Checklist3 sections · 4 ✓The AI-search visibility checklist we run on this site
Everything on this list ships on this site right now — the schema graph, the llms.txt files, the markdown twins, the glossary built for quoting. This is the checklist version, so it can be checked.AEOAI searchllms.txt
Deadline3 sections · 4 ✓The EU accessibility deadline passed — what still applies
Since 28 June 2025, the European Accessibility Act applies to e-commerce, banking, e-books and most consumer digital services in the EU — including a Hungarian shop selling to German customers. WCAG 2.1 AA is the yardstick courts will reach for.AccessibilityWCAGEU law
Ops notes3 sections · 4 ✓What Solana RPC actually costs once the prototype works
The free RPC endpoint got you through the demo. Production means rate limits, archival history, websockets that stay up — and a provider bill that scales with calls your code did not need to make.SolanaRPCInfrastructure
Case note3 sections · 4 ✓The invoice pipeline that ended the Friday admin block
A service company spent every Friday afternoon typing invoices from timesheets, chasing PO numbers, and re-sending the ones that bounced. The pipeline that replaced it runs Friday morning, unattended.AutomationInvoicingCase study
Tell us the problem in plain words.
