Engineering Standards

Changes to the Engineering Standards, newest first. The current standards version is 2026.06.11a. To bring a tool up to date, see Update an existing tool or use the combined update prompt on the Update overview.

2026.06.11a: Cloudflare HTTPS is Flexible (plain HTTP origin)

Engineering Standards · 11 Jun 2026

Changed. For self-hosted (non-Vercel) tools behind Cloudflare, the TLS setup is now Flexible: the origin serves plain HTTP and installs no certificate at all; Cloudflare terminates HTTPS at the edge (Universal SSL) and talks HTTP to the origin. This replaces the previous Full (strict) + Cloudflare Origin Certificate guidance. The origin must listen on HTTP only and must not redirect to HTTPS itself. See Deployment.

Apply. In Cloudflare, set SSL/TLS encryption mode to Flexible and keep Always Use HTTPS on. Remove any origin certificate and any origin-side HTTP-to-HTTPS redirect; serve the app over HTTP.

2026.06.08f: Object storage on Cloudflare R2, never self-hosted

Engineering Standards · 8 Jun 2026

Changed. New storage rule. Files and objects go to Cloudflare R2 (preferred, always the Enjab ceo [at] enjab [dot] ae account, never personal) or, only when genuinely better, the VPS disk. Never self-host object storage (no MinIO/Ceph/homemade S3). See Storage.

Apply. Move any blob/file storage to the Enjab R2. Drop any self-hosted object store.

2026.06.08e: Databases are always the Enjab Supabase

Engineering Standards · 8 Jun 2026

Changed. New database rules. Every database is Supabase (managed Postgres), always the Enjab account (ceo [at] enjab [dot] ae), never personal and never self-hosted on a VPS. Row Level Security is on by default (disable only when genuinely needed). RAG/vector search uses Supabase pgvector, not a separate vector DB. See Databases.

Apply. Confirm your DB is on the Enjab Supabase with RLS enabled where it makes sense. Move any self-hosted or personal DB onto it.

2026.06.08d: VPS must be Hetzner Ubuntu, hardened before use

Engineering Standards · 8 Jun 2026

Changed. New server rules. A VPS must be a supported Ubuntu LTS (22.04/24.04/26.04), on Hetzner only, dual-stack (IPv4 + IPv6). You never ssh in as root and start: a one-command provisioner hardens it (key-only server sudo user with passwordless sudo, root + password SSH disabled, fail2ban, ufw, unattended security updates, Docker). See Servers (VPS).

Apply. Provision every new box with bash <(curl -fsSL https://developers.enjab.ae/provision-vps.sh) before it runs anything. Retire boxes that are not Hetzner Ubuntu.

2026.06.08c: No raw emails on public pages

Engineering Standards · 8 Jun 2026

Changed. New security rule. On public, unauthenticated pages, never write an email as plaintext or a mailto: link, harvesters scrape both from the page source. Show it broken up in a fixed format instead: ceo [at] enjab [dot] ae (replace @ with [at] and each . with [dot]), as plain text, no mailto:. Behind login, emails can be shown normally. See Security.

Apply. Sweep your public pages (landing, contact, footer) for any plaintext email or mailto: link and rewrite each in the [at] / [dot] format. Leave auth-gated pages as they are.

2026.06.08b: Deploy from Git, on the Enjab GitHub org

Engineering Standards · 8 Jun 2026

Changed. New pipeline rules. Every Enjab project lives in the Enjab GitHub org (the ceo [at] enjab [dot] ae / EnjabMedical account), never a personal account. Deployment is Git-based: connect Vercel to the repo and let it deploy automatically on push (production from main, previews for everything else), never a manual vercel deploy from a machine. See Pipeline.

Apply. Move any tool's repo into the Enjab org if it is not already there. In Vercel, connect the project to that GitHub repo, confirm auto-deploy on push, and drop any manual-deploy step from your workflow.

2026.06.08a: Host on Vercel, or Cloudflare-fronted elsewhere

Engineering Standards · 8 Jun 2026

Changed. New deployment rules. Host on Vercel by default (TLS and the CDN are handled for you). If a tool must run on a VPS or your own server instead, put the domain behind Cloudflare with the orange cloud on (proxied) and let Cloudflare handle HTTPS (a Cloudflare Origin Certificate on the origin, SSL/TLS mode Full (strict), and Always Use HTTPS), so you never chase certificates. See Deployment.

Apply. Keep tools on Vercel where it makes sense. For anything self-hosted, turn on Cloudflare's orange cloud and move TLS to Cloudflare per the deployment standard.