Blog
- The 72-hour GDPR breach notification clock
25 August 2026
How the 72-hour GDPR breach deadline works, what starts the clock, and why apps built fast on AI platforms are the ones that blow it.
- EU hosting for AI apps: the checklist
21 August 2026
The EU hosting and data-residency questions a customer security questionnaire will ask about your AI-built app, and how to answer them before they do.
- EU data residency and AI app builders: who hosts where
18 August 2026
Where popular AI app builders store data by default, why it usually lands in the US, and how to check where your own app's data actually sits.
- DPA vs terms of service: not the same thing
14 August 2026
A data processing agreement and terms of service do different jobs. Here's how to tell them apart and check you actually have the one GDPR requires.
- Database export formats across AI app builders
11 August 2026
Some builders hand you a real Postgres dump. Others give you a CSV and a shrug. Here's what each one lets you export, and why the format matters.
- Supabase service_role key exposed: how to check and fix it
8 August 2026
A precise, Supabase-specific check for a leaked service_role key in your frontend bundle, plus the exact rotation steps in the Supabase dashboard.
- How Claude Code projects leak API keys
7 August 2026
AI-generated projects often hardcode secrets or commit .env files by accident. Here's how to scan your Claude Code project for leaked keys in a few minutes.
- Bolt.new database connection limits, explained
4 August 2026
Your Bolt.new app runs fine in the editor, then falls over on launch day. Here's why database connection limits are usually the cause, and how to check yours.
- Bolt.new custom domain setup: DNS, SSL, and the gotchas
31 July 2026
Point your own domain at a Bolt.new app the right way, with the DNS records, SSL fixes, and propagation traps that trip people up.
- What backend-as-a-service costs after free tier
28 July 2026
The free tier is generous until it isn't. Here's what a Postgres-based backend-as-a-service platform really costs, add-ons included.
- Why your free-tier project keeps pausing itself
24 July 2026
Backend-as-a-service platforms pause free-tier projects after inactivity. Here's why, how to unpause one, and how to stop it happening to a live app.
- Your AI app probably has no real backup
21 July 2026
AI builders make it easy to ship, easy to skip backups. Here's how to check whether your app is actually backed up, and how to fix it if it isn't.
- AI app builders in 2026: a hosting comparison matrix
14 July 2026
A single reference table across a dozen AI app builders: what database you get, what backups look like, and where each one stops.
- Lovable, Bolt, Replit, Base44: hosting compared
14 July 2026
A side-by-side look at what Lovable, Bolt, Replit, and Base44 actually give you for hosting, and where each one runs out for a growing app.
- A named engineer on call, not just an alert
14 July 2026
Automated monitoring tells you something broke. A named engineer on call is the difference between a 3 a.m. alert and someone actually fixing it.
- Free GDPR record-of-processing template
11 July 2026
A fill-in Record of Processing Activities template (Article 30 GDPR), sized for a solo founder running a Lovable, Bolt, or Cursor app.
- Migrating backend-as-a-service to Postgres
7 July 2026
The real decisions in a backend-as-a-service-to-Postgres move aren't the data dump. They're auth, RLS, and rollback.
- How to back up your Lovable app (and test it)
7 July 2026
Lovable Cloud gives you 14 days of daily backups. Here's how to set up your own tested backup with point-in-time recovery instead.
- Deploying a Claude Code project to a VPS
7 July 2026
An end-to-end guide to deploying your own vibe-coded app on a plain VPS: hardening, Docker, automatic HTTPS with Caddy, and zero-downtime deploys.
- Check for exposed API keys in 5 minutes
7 July 2026
A copy-pasteable, 5-minute self-check for whether your Lovable or backend-as-a-service app is leaking a privileged key to anyone who opens the page.