Build
Backups, and losing everything: the copy you'll need once
Lesson 6 of where your data lives: what a backup actually is, what your plan does and doesn't do for you, and the Replit story that made it real.
Sam Ortega · 40m ago · 4 min
Build Editor · since 2026
Sam Ortega
Sam explains what's actually happening when you build software by talking to an AI — what the model is doing, what's really running your app, and where the sharp edges are. No jargon without a picture, no hype, and an honest 'hire someone' when that's the answer.
vibe codingAI coding toolshow language models workbackend basicsapp security for non-engineersdeployment and hostingsoftware costs
Latest by Sam
Build
What is Supabase? The backend-in-a-box, explained
Lesson 5 of where your data lives: the service behind a huge share of AI-built apps. What's inside the box, what's free, and what it asks of you.
Sam Ortega · 40m ago · 4 min
Build
What is a query? Asking the database a question
Lesson 3 of where your data lives: how your app asks for exactly the rows it wants, and what happens when the question has no "only".
Sam Ortega · 40m ago · 4 min
Build
Tables, rows and columns: the shape of your data
Lesson 2 of where your data lives: how a database lays things out, why every column has a type, and the one column that connects everything.
Sam Ortega · 40m ago · 4 min
Build
What is a database? Where your app keeps things
Lesson 1 of where your data lives: the organised place your app puts every sign-up, order and message, and why it isn't just a spreadsheet.
Sam Ortega · 40m ago · 4 min
Build
Frontend vs backend: the dining room and the kitchen
Lesson 6 of the journey of a tap: every part of your app lives on one side of a wall. Which side decides who can see it.
Sam Ortega · 40m ago · 4 min
Build
What is an API? The menu your server serves
Lesson 5 of the journey of a tap: the list of requests a server will accept, why your app uses other people's too, and what an API key really is.
Sam Ortega · 40m ago · 4 min
Build
What is a server? The computer that answers
Lesson 4 of the journey of a tap: where the request lands, what that computer can see, and why "serverless" still means servers.
Sam Ortega · 40m ago · 4 min
Build
What is a request? The message behind every tap
Lesson 3 of the journey of a tap: what's actually inside the little message your phone sends, and the answer that comes back.
Sam Ortega · 40m ago · 4 min
Build
What is DNS? How your phone finds a website
Lesson 2 of the journey of a tap: your phone knows a name, not a location. How it turns aliteq.com into a number it can actually reach.
Sam Ortega · 40m ago · 4 min
Build
What is a URL? The address every tap starts with
Lesson 1 of the journey of a tap: the address your phone reads before anything else happens, and the four parts it's made of.
Sam Ortega · 40m ago · 4 min
Build
What is a backend? Explained for vibe coders, with a drawing
Frontend, server, database, API, secrets: the parts of your app you can't see, drawn as the journey of one tap, and why every security rule has to live on the far side of it.
Sam Ortega · 43m ago · 6 min
Build
Environment variables and secrets, explained: the .env file
Why your app's keys live in labelled envelopes outside the code, which envelopes the browser gets a copy of (VITE_, NEXT_PUBLIC_), and where secret keys actually belong, from the tools' own docs.
Sam Ortega · 43m ago · 6 min
Build
Your API keys are in the browser: which ones matter and the fix
Whatever your app sends to the browser, anyone can read. Which keys are designed to be public, which must never be, how secrets end up there, and the server-function fix, from each vendor's own docs.
Sam Ortega · 43m ago · 7 min
Build
Row Level Security explained (with a picture): the setting that matters
The one database setting behind the biggest vibe-coded app exposures, shown as a table: who sees what with RLS off, who sees what with it on, and the policy your AI tool should be writing.
Sam Ortega · 43m ago · 7 min
Build
The Moltbook breach: what a public Supabase key without RLS grants
An AI-built social network left its whole database readable and writable. The key wasn't stolen; one setting was missing. What happened, from Wiz's write-up, and the lesson for anyone building on Supabase.
Sam Ortega · 43m ago · 7 min
Build
Before you share your vibe-coded app: the 6 security checks
The six mistakes behind 2026's vibe-coded app exposures, turned into checks you can do without reading code: RLS, secrets, server-side auth, admin, webhooks and rate limits.
Sam Ortega · 43m ago · 8 min