Blog

CVE-2026-66066 lets an unauthenticated upload read server files via Active Storage. Patching Rails is not enough - libvips must go to 8.13 and secrets rotate.

Rails 7.1 got no patch for CVE-2026-66066, a CVSSv4 9.5 pre-auth RCE. How to find every app of yours on a dead branch and pick between four realistic exits.

Your Lovable, Bolt, or Replit MVP works in the demo and breaks with real users. How to migrate a vibe coded app to Rails: schema, auth, payments, front end.

Deploy Rails across multiple servers with Kamal 2: roles, the load balancing gap, boot limit gotchas, the multi-host SSL error, and when one big box wins.

Cheap developers turn into expensive mistakes when nobody senior reads their code. A 20-minute pull request check plus ways to add review without a CTO salary.

Five SLA requirements for your dev shop contract: response times, fix windows, uptime, a definition of done, and a penalty clause that actually bites.

How to switch development agencies without losing your code: the 30-day overlap, the cold-start deploy drill, and what the next team needs on day one.

Retros for non-technical founders: what a retrospective is, what the one-page summary should say, and why a repeated action item is your best warning sign.

Under US copyright law the code your dev shop writes is not yours by default - a signed clause makes it yours. Five clauses to check, plus one command to run first.

You asked for a simple admin panel and got an over-engineered MVP. The feature-noun check to run on your own spec, and the 90-minute rewrite that stops it.