Blog
- Why your AI app needs PgBouncer
9 October 2026
AI-built apps open a new Postgres connection per request and hit the wall under load. Here's the PgBouncer config that fixes it.
- Point-in-time recovery for your AI-built app's Postgres
6 October 2026
A daily snapshot restores you to last midnight. Point-in-time recovery restores you to the second before things broke. Here's how, and what your AI-built app's platform actually gives you by default.
- Migrating your AI-built app from NoSQL to Postgres
2 October 2026
Real steps to move an AI-built app off a NoSQL backend-as-a-service platform to Postgres: export, map to tables, migrate auth, cut over.
- Moving off Replit to real production hosting
29 September 2026
Replit is great for building. It's not built to be your production home. Here's an honest, step-by-step plan to move your app to real hosting.
- Managed Postgres providers compared
25 September 2026
An honest comparison of a serverless Postgres provider, a backend-as-a-service platform, a big-cloud database, and self-hosted Postgres.
- Exporting your Lovable app and self-hosting it
18 September 2026
A step-by-step walkthrough for exporting your Lovable app to GitHub and self-hosting the frontend and backend on your own infrastructure.
- Lovable environment variables: what's secret
15 September 2026
Not every value in your Lovable env is a secret, and some things you think are safe aren't. Here's how to tell which is which before you ship.
- Lovable Cloud vs your own Postgres
11 September 2026
Lovable Cloud is fast and hands-off. Your own Postgres is portable and controllable. Here's an honest look at what each one costs you.
- Moving auth off Lovable without breaking sessions
8 September 2026
Migrating auth is where people log out their whole userbase by accident. Here's how to move it off Lovable without losing sessions.
- My Lovable app got hacked: what to do in the first hour
4 September 2026
A calm, ordered playbook for the first 60 minutes after your Lovable app is compromised: contain, rotate, assess, and recover without making it worse.
- Handling a data subject access request, explained
1 September 2026
A step-by-step way to answer a GDPR data subject access request when the app holding the data was AI-built and nobody owns it.
- GDPR-compliant backups: the retention policy
28 August 2026
How to write a backup retention policy that satisfies GDPR: how long to keep backups, when to delete, and how restores square with the right to erasure.
- The 72-hour GDPR breach notification clock
25 August 2026
How the 72-hour GDPR breach deadline works, what starts the clock, and why apps built fast on AI platforms are the ones that blow it.
- EU hosting for AI apps: the checklist
21 August 2026
The EU hosting and data-residency questions a customer security questionnaire will ask about your AI-built app, and how to answer them before they do.
- EU data residency and AI app builders: who hosts where
18 August 2026
Where popular AI app builders store data by default, why it usually lands in the US, and how to check where your own app's data actually sits.
- DPA vs terms of service: not the same thing
14 August 2026
A data processing agreement and terms of service do different jobs. Here's how to tell them apart and check you actually have the one GDPR requires.
- Database export formats across AI app builders
11 August 2026
Some builders hand you a real Postgres dump. Others give you a CSV and a shrug. Here's what each one lets you export, and why the format matters.
- Supabase service_role key exposed: how to check and fix it
8 August 2026
A precise, Supabase-specific check for a leaked service_role key in your frontend bundle, plus the exact rotation steps in the Supabase dashboard.
- How Claude Code projects leak API keys
7 August 2026
AI-generated projects often hardcode secrets or commit .env files by accident. Here's how to scan your Claude Code project for leaked keys in a few minutes.
- Bolt.new database connection limits, explained
4 August 2026
Your Bolt.new app runs fine in the editor, then falls over on launch day. Here's why database connection limits are usually the cause, and how to check yours.