Miget

One thing to do on any platform today: put a spend limit and usage alerts on every AI key. A leaked key with a $200 cap is a bad afternoon. Without one, it's a $100k story. Full write-up: miget.com/blog/paas-security…

How Miget answers them: - every app and every build runs in its own microVM with its own kernel - builds hold little and reach little - tenants are isolated by default - miget-inspector watches what workloads actually do at runtime

And detection failed because real credentials on real API paths don't look like an attack. So the useful questions for any platform are: - what runs customer code? - what can it reach? - what single identity can read everything? - would anyone notice?

The way in: a valid long-lived credential, or the system that runs customer code (a build, an eval job). The amplifier: one internal place that can read every tenant's secrets. One foothold becomes everyone.

The target was stored customer secrets. AI keys first. A database dump needs a buyer. An AI key with no spend limit is cash the moment someone validates it. @wiz_io saw stolen keys tested within ~30 minutes, then resold.

A Slack integration that posts raw JSON into a channel is not an integration. It is a webhook with extra steps. If the receiver cannot read a signature, stop sending one and render the message instead.

100+ ready-to-deploy Compose stacks on deployable.sh. Every service inside one: $0. You pay for the RAM and the vCPU. Once.

Price a self-hosted stack honestly. Supabase is six services and a Postgres. Per-service billing turns that into six line items and a database add-on. On Miget it is one 4 GiB plan at $25/mo, and everything inside it, databases included, is $0 per service.

Pin your image tags in a compose stack before it goes anywhere real. latest will hand you a breaking change on somebody else's schedule, and it will do it during a redeploy you started for a completely unrelated reason.

"Self-hosted" usually means you now run a database at 2am. Most of what people self-host is a compose file plus a Postgres nobody wants to operate. Take the compose file, hand the Postgres to somebody managed, and self-hosting stops meaning on call.