Keeping small apps alive
Is Lovable secure? The one setting that decides it
A Lovable app can be wide open, and the difference is one setting most builders never touch. The anon-key/RLS model, the gap behind a 2025 CVE, and how to check yours.
Is Bolt.new secure? What the generated app leaves open
Bolt.new builds a working full-stack app fast — which is why the security gets skipped. The usual gaps: a Supabase database with RLS off, secrets in the bundle, UI-only authorization. Here's how to audit yours.
Is v0 secure? Keeping a generated Next.js app's secrets in
v0's Next.js output looks production-ready, which is the trap. NEXT_PUBLIC_ bakes a var into the bundle, and a secret in a client component ships to the browser. Here's how to check a v0 app keeps its secrets in.
Vibe coding security risks: the checklist nobody runs
The appeal of vibe coding is that you don't read every line — which is exactly why the holes get through. Exposed secrets, a database anyone can read, rules enforced only in the UI, and how to close each one.
Website down from an expired SSL certificate
An expired certificate is a full outage — every visitor hits a red warning, though the server's fine. Here's why auto-renewal still fails silently, why shrinking cert lifetimes make it likelier, and how to see it coming.
My website says "Not Secure" — what it means and how to fix it
The "Not secure" label looks like a hack but usually isn't — it means your site isn't using HTTPS properly. Here's what the browser is really saying, and the common causes in plain language, fixed one by one.
What are security headers? A plain-English guide
Security headers tell the browser how to behave safely — refuse HTTP, block framing, don't guess file types. Here's what each of the ones that matter actually does, and why almost every new site ships without them.
How to add security headers in Next.js (including CSP)
Next.js sends no security headers by default. The static ones are a config block; the hard part is a CSP that helps without blocking your own scripts. Here's the nonce approach, the report-only trick, and the version caveat.
SSL certificate expiry monitoring: why the calendar reminder fails
A calendar reminder assumes your renewal works. But auto-renewal is a background job that fails silently, and cert lifetimes are dropping to 47 days by 2029. Here's why manual SSL tracking breaks, and what to monitor instead.
Secure, HttpOnly, SameSite: the cookie flags that matter
Three small flags — Secure, HttpOnly, SameSite — decide whether your session cookie is a locked token or the easiest thing to steal on your site. Here's what each closes, and how to check which your cookies set.
How do I know if my cron job actually ran?
"It ran" hides four different outcomes and only one is good. Why logs and error emails miss the worst case, and how a success heartbeat catches a job that never fired at all.
Why your Vercel cron job is not running
On Vercel it's rarely a mystery: the Hobby once-a-day cap, jobs that fire within the hour not on the minute, a CRON_SECRET that 401s your own cron, or a schedule that only runs in production.
Why your GitHub Actions scheduled workflow stopped running
GitHub auto-disables a scheduled workflow after 60 days of no repo activity — and the cron's own runs don't count as activity, so a quiet side project always trips it. Here's the rule, the fork gotcha, and the fix.
Why your Supabase pg_cron job isn't running
A pg_cron job that never runs is usually a missing pg_net extension, a UTC-not-local schedule, or a run that fired and failed. Here's how to read the run log Postgres keeps and find which is yours.
What a dead man's switch is (and when your app needs one)
Most monitoring watches for something bad happening. A dead man's switch watches for something good not happening — the right tool for backups and cron jobs that fail silently. What it is, and when you need one.
Stripe webhooks failing silently — and how to catch it
The payment succeeds even when the webhook fails, so nothing looks broken until a customer writes in. The real retry-and-disable timeline, the raw-body trap, and how to catch it inside the window.