So long as you have robust data sanitization on the backend to prevent XSS and HTML injection attacks…

If you can get away with just using Markdown, you should definitely use that instead of full HTML.

Jetbrains Phpstorm is probably best in class, but you’ll have to pay for it.

It’s perfectly normal for your computer to have daemons.

You should definitely set up a DMARC record to prevent other people from using your email domain to send spam. If you don’t have DMARC configured, other email servers will give any senders the benefit of the doubt and accept mail that claims to be from your domain.

You can just set the DMARC record to reject 100% of unverified mail and call it a day. Since you aren’t sending anything it won’t affect you.

The ideal solution is to have one identity provider and then use Single Sign-On (SSO) to authenticate your users to all of their other apps. All of the big identity providers (Microsoft, Google, Okta, etc) support security keys.

I recognize that it might not be feasible to use SSO for all of your apps as a small business; a lot of SaaS platforms unfortunately charge extra for SSO. That being said my advice would be use SSO whenever possible for your apps and include SSO availability in your decision-making process for purchasing new software.

For those apps that do not support SSO, my advice would be to either compensate employees for using their personal devices for work or give them corporate devices that are only used for work things.

“Embargo” sure is a funny way to say “launching pirate raids and missiles”.

The term is metonym. It is when you use a characteristic or associated attribute of a thing as the name of that thing. A classic example would be “the crown” when talking about the monarch or “The Whitehouse” when talking about the president.

These ads only appear in the “promotions” section of Gmail, the section that is by definition for advertising emails. It’s not great, but this is the least intrusive place to put ads.