Keeping small apps alive
Fly.io machine keeps stopping: auto_stop_machines explained
New Fly.io apps auto-stop idle machines by default. Here's why it happens, the fly.toml settings for always-on, suspend and background workers, and how to know your scheduled jobs still run.
MongoDB Atlas cluster paused: why it happens and how to stop it
Atlas pauses a Free cluster after 30 days with no connections, and your app just starts failing. Here's how to resume it, the version catch that can block a resume, and how to keep it from happening again.
Upstash Redis database archived: why it happened and how to restore it
Upstash archives a free Redis database after a month of no use, and your app's calls start failing. Your data is backed up. Here's how to restore it and keep it from happening again.
Netlify scheduled function not running: 7 causes and fixes
Scheduled functions only run on published deploys, in UTC, for up to 30 seconds. Here are the seven reasons one never fires or quietly stops, and how to get told when it does.
Cloudflare Workers cron trigger not running: 7 causes and fixes
Cron Triggers run in UTC, can take 15 minutes to go live, and get 10 ms of CPU on the Free plan. Here are the seven reasons one never fires or quietly fails, and how to get told when it does.
Website Security Statistics 2026: 416 Newly Launched Sites Scanned
71.6% ship no Content-Security-Policy. 66% can be impersonated by email. 82.5% have no DNSSEC. But not one of 416 newly launched sites had a critical vulnerability — they're not broken, they're unhardened, and always in the same places.
How to keep a free backend awake
Free tiers sleep when idle: Supabase pauses, Render spins down, Neon scales to zero. Here's the map — how each host sleeps, why keep-alive pings have a catch, and what actually keeps a free app responsive.
How to secure a Supabase app: the five settings that matter
A Supabase app can be wide open, almost always for the same handful of reasons: RLS off, the service_role key in the browser, public buckets, unguarded functions, secrets in the bundle. Here's the map to closing each one.
The website launch security checklist nobody hands you
You get a deploy button, not a checklist — so most sites launch with the cert valid and nothing else checked. The four things to test from your URL in seconds, plus the code-side items that cost the most.
How to stop Render spinning down your free service
Fifteen idle minutes and your free service is asleep; the next visitor waits through the cold start. Here's why keep-warm pings have a catch, and what actually keeps a free app responsive.
How to keep a Railway app awake
Railway retired its free tier and added opt-in App Sleeping. Here's what actually happens to an idle service now, how to keep one awake without cancelling out the savings, and why a keep-alive ping can't warn you when it dies.
How to stop Neon autosuspending your database
Neon scales your compute to zero after a few idle minutes, and the next query wakes it. Here's what Scale to Zero does, why the fix depends on whether latency or a surprise bill is your real problem, and how to keep it warm safely.
Why is my website slow the first time I open it?
Slow the first time, instant after? Your site probably isn't slow — it was asleep. Free hosting pauses an idle app and takes seconds to wake it. Here's why it happens, which hosts do it, and your three options.
Is my Supabase database public? RLS, and how to check
Your Supabase anon key is public by design — safe only if RLS is on with a real policy. Tables made outside the Table Editor ship with it off, and USING(true) is still open. Here's how to check if your data is public.
My API key is showing on my website — is that bad?
An API key visible in your frontend is a shrug or an emergency depending on which kind it is. Public keys (anon, pk_, Maps) are meant to be seen; secret keys are compromised the instant they ship. How to tell, and what to do.
Is my app built with AI safe? A non-developer's check
You built an app with AI, it works, and you're quietly worried it's not safe — but you can't read code. Here are the four plain-English questions that matter, and how to check each one without being a developer.