Blog
Code audits, straight talk
Field notes and analyses on auditing Flutter and native mobile codebases: architecture, security, performance, AI-generated code.
ITSAppUsesNonExemptEncryption = false — the wrong reflex of Flutter apps that encrypt
Encrypting your local database with sqlite3mc and ticking false answers an EAR classification question wrongly. Notes 3 and 4, ERN with BIS, ANSSI filing.
The code dishwashing — don't let your technical debt pile up
A "we'll handle this error later" TODO left for years, a dummy object ending up cached, and a very real bug. Technical debt earns compound interest.
Apple rejected our app over a bug… in iPadOS — and a reboot unblocked everything
App Store rejection for an empty keyboard that also broke in Safari and iPadOS search. A phone escalation with Apple, and the great classic fix — reboot.
SpecKit alone, I gave up — with an orchestrator, I shipped 64 specs in a row
Turning SpecKit's manual pipeline into a safe autonomous loop — backlog as source of truth, one feature per turn, hard-coded invariants enforced in CI.
Rejected twice by Apple for two popups in the wrong order — ATT and CMP
Apple's ATT prompt on one side, your GDPR CMP on the other — the order and purpose linking that pass review, and guideline 5.1.1 that rejects otherwise.
A €38,000 fine for one missing line in the terms of sale — the consumer mediator
Since 2016, any French professional selling to consumers must appoint a consumer mediator and display it — from the very first client, freelancers included.
I added one line to my Definition of Done — /review before pushing
An AI-agent review pass on the diff before even opening the PR — human reviewers finally read architecture and decisions instead of hunting for typos.
verify(mock.method()) — the green test that let a double call slip through
In Mockito, verify without an explicit .called(1) can stay green while the method fires twice. Why precision in tests protects the reader — and yourself.
App Store rejection for "missing keyboard" — when the false positive is on the reviewer's side
An App Store rejection impossible to reproduce, an iPadOS shortcut bar in the reviewer's screenshot, and an iPad never rebooted that finally explained it all.
3 steps to ditch Figma as a solo dev — from vibe designing to design.md
From feeling-based prompts to a versioned design.md file — how a single source of tokens and rules turns AI prompts into real, consistent design specs.
Why Google is asking for your SIREN — e-invoicing in France is arriving for real
Electronic invoicing becomes mandatory in France on September 1, 2026 — vendors are collecting SIREN numbers to route invoices. The email wave is just starting.
"Do you share data with data brokers?" — the checkbox you shouldn't tick on a hunch
Google Analytics or Dynatrace are not data brokers but data processors. The one question that settles it before filling out an App Store privacy label.
webcredentials — the 3 lines that connect the iCloud Keychain to your app
Associated Domains, apple-app-site-association and Flutter AutofillHints — the config that enables iOS autofill and lays the groundwork for passkeys.
Your French user opens your app and it's in Japanese — locales in Flutter
PlatformDispatcher.locale vs Localizations.localeOf — two ways to get the locale in Flutter, and the supportedLocales order that decides silently.
Uninstalling is not enough — Android Auto Backup silently restores your app data
From API 23 onward, Android backs up prefs, SQLite and cache to the user's Drive, then restores them on reinstall — before the app's very first launch.
A €29,000 tax reassessment for a threshold crossed unknowingly — the flat-tax trap
Losing the right to France's flat-tax option is automatic, but the regularisation is not. The two-year lag on reference income makes this trap treacherous.
Magic-style sparkles in Flutter — animated particles and a Web playground
From a GIF sent on a Friday afternoon to a Flutter implementation of the sparkle effect, animated particles included, with an online Flutter Web playground.
Adding an iOS tester without touching the Apple portal — Bitrise Test devices
No more UDID registration on the Apple Developer Portal and manual provisioning profile regeneration — Bitrise handles the integration at build time.
HiveCacheStore + dio_cache_interceptor — the 3 traps nobody documents
Cold-start corruption, no TTL purge on launch, unbounded size — three edge cases of Dio + Hive caching in Flutter to handle from day one to avoid breakage.
"test cedric" in production — why you need three separate Firebase projects
A test push notification sent in production to thousands of a bank's customers. Every mobile dev's dreaded scenario, and the simple practice that prevents it.
The chicken and the pig — involved or committed, the difference that makes a team
The chicken-and-pig fable applied to software projects — telling apart those who give opinions from those who carry the code, and why both roles matter.
SOLID in Flutter — principles written into CI, not into a wiki
An app that survives three years in production is not about the latest framework but about respected boundaries. SOLID applied concretely in Flutter.
I asked an AI for tax advice — it approved a mistake that ends in a tax audit
A general-purpose AI confused two French tax articles on pension deductions. What saved me — a tool built to contradict instead of confirm your reasoning.
My free Supabase project paused every 7 days — fixed with 5 lines of SQL
Supabase's free plan pauses your project after 7 days of inactivity. An elegant fix with pg_cron — the database generates its own activity from within.
92% of tokens saved — making the invisible cost of AI agents visible
RTK wraps common dev commands so only the essentials reach the agent's context window. A numbers breakdown across 13,361 commands and 114.8M tokens.
The DES — the French filing nobody tells you about when you invoice EU clients
Invoicing an EU business client without VAT is not enough — France's European Declaration of Services is mandatory from the very first euro, with fines if you skip it.
Flutter CallbackShortcuts: Speed Up Dev Test Cycles
Speed up Flutter manual testing with CallbackShortcuts — keyboard shortcuts for cache, forms, and passwords. Debug-only, no Intent/Action boilerplate.
AI-generated code — why a human audit still matters
Vibe coding speeds up development but leaves blind spots. What an expert audit catches that your tooling does not.