Decode by Manar
Understanding tech, simply.
Content to understand what is behind a product, an application or a tech idea. The same as on our Decode by Manar Instagram account (opens in a new tab), in a version to read at your own pace.
- October 27, 2026 · 3 min read
Automated tests: what are they really for?
An automated test checks in seconds that your application still does what it should. What it brings you, and what it does not guarantee.
Read the article - October 27, 2026 · 3 min read
Backup and replication: what really protects you
Replication copies your data live, a backup keeps a past state. Why the two do not protect against the same risks, and how to test them.
Read the article - October 27, 2026 · 2 min read
Caching: remember it instead of redoing it
A cache keeps a copy of what you just got so the next answer is faster. Why it speeds everything up, and why it can show stale data.
Read the article - October 27, 2026 · 3 min read
The most common flaws in AI-built apps
Poorly locked data access, visible keys, missing checks: a catalogue of the typical flaws in AI-generated apps, explained simply.
Read the article - October 27, 2026 · 3 min read
Why your database lets everyone see everyone's data
Without access rules, any user can read other people's rows. Row Level Security explained simply, and how to test your app.
Read the article - October 27, 2026 · 3 min read
A database index: the table of contents of a book
An index lets a database find information without reading the whole table. How it works, what it costs, and when to add one.
Read the article - October 27, 2026 · 3 min read
What is a database migration (and why is it risky)?
A migration changes the structure of a database that already holds data. Why it is delicate, and the precautions that keep you from losing anything.
Read the article - October 27, 2026 · 3 min read
Drawn prototype or coded prototype: which one first?
A drawn mockup and a coded prototype do not test the same thing. What each one teaches, its limits, and the questions that tell you which to start with.
Read the article - October 27, 2026 · 3 min read
Exposed API keys: how to check yours are not
An API key visible in your code or repository can be used by anyone. How to spot one, what to do if it leaked, and how to prevent it.
Read the article - October 27, 2026 · 4 min read
GDPR for an app: the 5 points to check
Data collected, legal basis, consent, people's rights, security: five simple checkpoints to review how your app handles personal data under the GDPR.
Read the article - October 27, 2026 · 3 min read
Is my app built with Lovable secure?
An AI-generated app can work perfectly without being secure. What can be checked, what you can test yourself, and how to get real peace of mind.
Read the article - October 27, 2026 · 3 min read
Launching a Lovable, Bolt or Cursor app: the checklist
Before welcoming real users, run through ten checks: data access, secret keys, backups, a separate test environment and error monitoring.
Read the article - October 27, 2026 · 3 min read
Lovable, Bolt, Cursor, v0: what is each one for, and when to switch tools?
These AI tools do not all do the same job. The types of tools, the criteria for choosing, and when to have what was produced reviewed by a person.
Read the article - October 27, 2026 · 4 min read
Monolith or microservices: why not start with microservices
A monolith is an app in one block, microservices are several small ones. Why starting simple is often the best choice for a young product.
Read the article - October 27, 2026 · 3 min read
Why does an app make 100 requests instead of one? (the N+1 problem)
The N+1 problem: a page that queries the database once per row instead of once for everything. What it is, why it slows things down, and how to fix it.
Read the article - October 27, 2026 · 3 min read
No-code, low-code or code: which to choose to test an idea?
The three approaches do not meet the same need. What each allows, its limits, and the questions to ask yourself to test an idea without getting it wrong.
Read the article - October 27, 2026 · 2 min read
OAuth explained simply: how "sign in with Google" works
OAuth lets an application act for you without ever knowing your password. The idea behind the "sign in with Google" button, and the good habits.
Read the article - October 27, 2026 · 2 min read
The queue: not doing everything at the same time
A queue lines up heavy tasks and processes them one by one in the background, without making the user wait. How it works and why it makes an app more reliable.
Read the article - October 27, 2026 · 2 min read
Rate limiting: why a site says "too many requests
Rate limiting caps how many requests a visitor can make in a given time. Why sites use it and what it protects.
Read the article - October 27, 2026 · 3 min read
How to read an audit report without being a developer
Severity, evidence, recommendation, priorities: how to read a code audit report and decide what to do, without needing to be a developer.
Read the article - October 27, 2026 · 3 min read
Rewrite or repair: how to decide for existing code
Should you start from scratch or repair what exists? The questions to ask, the traps of a full rewrite, and the middle path.
Read the article - October 27, 2026 · 3 min read
Scoping a product before building it: the 5 questions to ask
Before building, five questions are enough to clarify a product: for whom, what problem, what journey, what limits, how to know it works.
Read the article - October 27, 2026 · 2 min read
Session or JWT: how a site recognizes you from page to page
Session or JWT: two ways for a site to remember you are logged in. How each works, where it falls short, and what good habits apply to both.
Read the article - October 27, 2026 · 2 min read
SQL injection: when a text field talks to your database
A SQL injection happens when typed text is mistaken for a command by the database. The principle, why it is serious, and how to protect against it.
Read the article - October 27, 2026 · 2 min read
Staging vs production: why we test somewhere else
Staging is a copy of your application where changes are tried out before going live in production. What it is for and what it must respect.
Read the article - October 27, 2026 · 3 min read
Taking over a web project left by a freelancer: where to start
Your freelancer has left and you have a website or app to keep alive. The access to recover, what to check, and in what order.
Read the article - October 27, 2026 · 3 min read
Technical debt: how to tell if your code is holding back your next ideas
Technical debt is code written fast that costs more with every change. How to recognize it without being a developer, and what to do about it.
Read the article - October 27, 2026 · 3 min read
Vibe coding: how far to go before calling a developer?
Vibe coding lets you test an idea very fast. Its limits, the signs that it is time to get help, and how to go about getting it.
Read the article - October 27, 2026 · 3 min read
Website or app: which should you build first?
A website presents, an app lets people act. The criteria to decide what to build first, depending on your goal, your users and your resources.
Read the article - October 27, 2026 · 3 min read
What does a code audit contain (and what does it not guarantee)?
What a good code audit generally contains, what it brings and what it cannot guarantee. To know what to expect before you ask for one.
Read the article - October 27, 2026 · 3 min read
What makes the cost of a project takeover vary
Size, code condition, documentation, tests, access, debt, urgency: the factors that make a takeover cost vary, and what allows a serious estimate.
Read the article - October 27, 2026 · 3 min read
What is a CDN? Bringing your site closer to your visitors
A CDN keeps copies of your site on servers around the world and answers from the place closest to each visitor. How it works, its limits, and what to use it for.
Read the article - October 27, 2026 · 2 min read
What is a webhook? When the service tells you first
A webhook is an automatic call a service sends to your application when something happens. The idea, its pitfalls, and the good habits to apply.
Read the article - October 27, 2026 · 3 min read
What is an MVP, and what should you build first?
An MVP is the smallest version of your product that lets you learn from real users. How to define it and choose what to build first.
Read the article - October 27, 2026 · 2 min read
What is CORS? Why my browser blocks my request
CORS is a browser rule: a site can read another site's responses only if that site allows it. What it is, why it blocks, and how to fix it properly.
Read the article - October 27, 2026 · 3 min read
Why use Git, even when you work alone
Git keeps a history of every change to your code and lets you go back. Why it helps even when you work alone, and what to ask of any project.
Read the article - October 27, 2026 · 2 min read
The XSS flaw: when a comment hides code for your visitors
An XSS flaw lets code hidden in a comment run in your visitors' browsers. The principle, the risks, and the good habits to protect your site.
Read the article - October 26, 2026 · 1 min read
Password hashing: hashed, never encrypted
A site should never be able to read your password back, not even its own team. Hashing, explained with a meat grinder.
Read the article - October 21, 2026 · 1 min read
Idempotence: tap twice, pay once
An operation is idempotent when repeating it does not change the result. The example of a payment sent twice by mistake.
Read the article - October 20, 2026 · 1 min read
Deadlock: when locks block everything
The lock that fixes a race condition has a price: two crossed transfers can wait for each other forever. Deadlock, explained with Alice and Bob.
Read the article - October 20, 2026 · 1 min read
What is an API, explained simply
An API is a restaurant waiter: you order, the kitchen prepares, and you never see what happens behind the scenes. A jargon-free explanation.
Read the article - October 19, 2026 · 1 min read
Race condition: two tickets for one seat
When two people act on the same data at the same time, the result depends on who goes first. The last concert seat example.
Read the article - October 13, 2026 · 1 min read
Why is my application slow? The 3 most frequent causes
Before rewriting everything, three places to look: images, database queries and what loads too early.
Read the article - October 6, 2026 · 1 min read
Lovable, Bolt, Cursor: What Changes When AI Writes Code
These tools make it possible to build an app in just a few hours. They don't replace the steps that come next: testing, securing, and deploying.
Read the article