Development Practices
Maintaining Codebases for Security and Longevity
Regular maintenance keeps a codebase secure, supported and easier to develop further. Small continuous updates are usually safer and less expensive than letting technical debt and outdated dependencies accumulate.
What does it mean?
Code maintenance means regularly taking care of a website or application after it has been launched. This includes keeping its technology updated, fixing security issues, improving performance and adapting to changes in browsers, devices and web standards.
It also means keeping up with evolving best practices in areas such as accessibility, SEO and AI search, and taking advantage of newer browser and platform features.
Regular maintenance reduces risk and makes future improvements easier and less expensive.
How often?
Maintenance should be continuous rather than saved for occasional large upgrades.
Security updates should be handled promptly. Other updates can normally be reviewed on a regular schedule based on the project, release frequency and available budget.
Avoid running unsupported versions of frameworks, runtimes, operating systems or other critical software, as they may no longer receive security updates, bug fixes or compatibility improvements.
Regular smaller updates are usually easier and less risky than waiting several years and doing one large upgrade.
Budget
Maintenance should be planned and budgeted as part of the ongoing lifecycle of a website or application.
A project should not be considered finished at launch. Time should be reserved for security updates, dependency upgrades, platform changes and other maintenance work.
To do
Dependencies and frameworks are on supported versions.
Runtimes and infrastructure are on supported versions.
Known security vulnerabilities are addressed.
Automated dependency monitoring is configured where possible.
The project has a plan and budget for continuous maintenance.