Blog
Running Next.js, Payload and Node apps on your own servers — what breaks, what leaks, and how to see it coming.
Why a renamed Payload field can delete your data — and how to catch it in the pull request
Payload's Postgres adapter turns schema changes into Drizzle migrations. A renamed field or collection can become DROP COLUMN or DROP TABLE. How it happens, the two setup mistakes behind most incidents, and how to catch destructive migrations before they run.
Backups that stopped weeks ago: how to know your Dokploy and Coolify backups actually ran
Scheduled backups on self-hosted platforms can stop without a notification. Why it happens, what 'backup succeeded' does not tell you, and a dead man's switch that tells you when a backup did not run.
Is your Dokploy or Coolify vulnerable? Checking the platform itself against its advisories
The platform that deploys your apps has root on your servers and its own security advisories — dozens of them. How to check the version you run against them, and why the platform is the one component that cannot vouch for itself.
CVE-2025-29927: why self-hosted Next.js was affected and Vercel was not
The Next.js middleware bypass let anyone skip middleware — and the authentication in it — with one request header. Who was affected, which versions fix it, and what it teaches about running Next.js yourself.