Field notes from the Puncharsoft team on SAP, enterprise application development, integration and digitalization.
'We added a field and the mobile app crashed.' An API is a contract, and you don't control its consumers. Which changes are breaking, the tolerant-reader principle, URI, header and date-based versioning strategies, the Spring Boot implementation, retiring versions with Deprecation and Sunset headers, contract tests and breaking-change detection in CI.
The bill for 'we'll fix it later' arrives six months on as lead times that have doubled and sprints consumed by unplanned work. What technical debt is and isn't, its types, how to measure it with signals instead of a single number (lead time, unplanned-work share, hotspot analysis, dependency age), the debt register, prioritizing by interest and principal, repayment strategies and how to explain it to management.
'The application starts in 60 milliseconds' is impressive; what does it cost? We compare GraalVM native image with the JVM and Java 25's AOT cache on startup, memory, peak throughput and compatibility; which scenarios really justify it, the step-by-step build with Spring Boot, RuntimeHints and the tracing agent, pitfalls such as profiles fixed at build time, and a decision guide.
The OWASP Top 10 lists the most commonly exploited weaknesses in enterprise applications; the 2025 edition added supply chain and error handling. For every item, the concrete countermeasure in Spring Boot — object-level authorization, secure configuration and headers, dependency scanning, parameterized queries, password and secret management, safe logging, fail-closed behavior — with code examples and a CI checklist.
'The system has no API' is the beginning of an integration, not the end. For the accounting system on the AS/400, the production tracker written in Delphi or the vendor software that offers no API, we compare database bridges, CDC, file exchange and RPA on reliability, latency and risk; how to do each one right, the facade service pattern and the pitfalls in the field.
CQRS is often mistaken for 'two databases and event sourcing'; it's really the separation of command and query models, and it can be applied at three levels. Which symptoms call for CQRS, separate models on the same database with Spring Boot, read-model projections fed by an outbox, how to present eventual consistency to users and the pitfalls in the field.
Instead of rewriting login in every enterprise application: a central identity provider, Keycloak. Which OAuth2/OIDC flow to use where, realm and client setup, JWT validation and role mapping in a Spring Boot resource server, client credentials between services, the BFF pattern for browser apps and a production checklist, with code examples.
Do AI coding assistants make a team 20% faster, or produce 20% more technical debt? The answer depends on the rules, not the tool. Where they really pay off, how to measure productivity, the data, secret and license risks, the code-review and repository-rules practice, safe use of agentic tools and an enterprise rollout plan.
The riskiest part of a deployment isn't the code, it's the schema: to never hear 'the ALTER TABLE locked the table for eight minutes', a schema change must work with both the old and the new application version. Versioned migrations with Flyway, the expand-migrate-contract pattern, lock-free DDL alternatives in PostgreSQL, batched backfills and safe execution in multi-replica deployments.