https://moatline.dev/blog/ Security and operations for self-hosted apps https://moatline.dev/blog/payload-migration-deleted-datahttps://moatline.dev/blog/payload-migration-deleted-dataTue, 06 Oct 2026 08:00:00 GMTPayload's Postgres adapter turns schema changes into Drizzle migrations. A renamed field or collection can become DROP COLUMN or DROP TABLE. How it happens, the two setup mistakes behind most incidents, and how to catch destructive migrations before they run. https://moatline.dev/blog/silent-backup-failureshttps://moatline.dev/blog/silent-backup-failuresMon, 05 Oct 2026 08:00:00 GMTScheduled backups on self-hosted platforms can stop without a notification. Why it happens, what 'backup succeeded' does not tell you, and a dead man's switch that tells you when a backup did not run. https://moatline.dev/blog/paas-vulnerabilitieshttps://moatline.dev/blog/paas-vulnerabilitiesSun, 04 Oct 2026 08:00:00 GMTThe platform that deploys your apps has root on your servers and its own security advisories — dozens of them. How to check the version you run against them, and why the platform is the one component that cannot vouch for itself. https://moatline.dev/blog/nextjs-middleware-bypass-self-hostedhttps://moatline.dev/blog/nextjs-middleware-bypass-self-hostedSat, 03 Oct 2026 08:00:00 GMTThe Next.js middleware bypass let anyone skip middleware — and the authentication in it — with one request header. Who was affected, which versions fix it, and what it teaches about running Next.js yourself.