Blog
All articles. All pillars. All authors.
We Audited Our Own Platform and Found 88 Security Issues
We ran 4 comprehensive security audits on our own PaaS and found 88 issues -- 9 critical, 12 high, 45 medium. Here is every finding, every fix, and what we learned.
The Bugs That Almost Broke Us
Git pull failures, CSRF blocking uploads, stale Caddy processes, FTP IPv6 incompatibilities, and Docker network aliases -- the bugs that almost derailed sh0.
OpenAPI as Single Source of Truth: Docs, MCP Tools, and Playground
How we used utoipa to auto-generate an OpenAPI 3.1 spec from Rust handler annotations, then used that spec to generate API docs, an interactive playground, and MCP tool definitions.
The sh0 CLI: 10 Commands That Mirror the Dashboard
How we built the sh0 CLI with 10 commands that mirror every dashboard action -- deploy, logs, env vars, health checks, and SSH into containers.
License Enforcement: Free, Pro, Business -- Gating Features in Rust
How we implemented a 3-tier license system in a self-hosted PaaS -- generous free tier, feature gating in Rust, dashboard upgrade prompts, and the pricing decisions behind it.
#131 -- Chunk-Embedding Integration
How FLIN connects text chunks to vector embeddings for semantic search over stored documents.
Cron Jobs and Preview Environments: Two Features, Zero Downtime
How we built cron job scheduling with timeout enforcement and preview environments with PR webhook integration -- developed in parallel using git worktree isolation.
The Agentic Loop: 24 AI Tools in a Single Chat
Up to 10 iterations of LLM calls, 24 tools from file generation to code execution, background jobs for 30-minute tasks. The agentic heart of Deblo.ai.
Credits, FCFA, and 6 African Payment Gateways
USD-cent pricing, 13 currencies, Orange Money and M-Pesa, 3 payment gateways, webhook-driven confirmation, and a background poller. Monetizing an African SaaS.
Voice Calls With AI: Ultravox, LiveKit, and WebRTC
Real-time voice conversations with the AI tutor: Ultravox sessions, LiveKit WebRTC, photo analysis mid-call, and per-minute credit billing.
WhatsApp OTP and the African Authentication Problem
Email does not work. SMS is expensive. WhatsApp is universal. How we built authentication for Africa with WhatsApp OTP, Google OAuth, and student access codes.
Building an MCP Server: 25 Tools, 3-Tier Safety, OpenAPI-Driven
How we built sh0's MCP server with 25 tools, OpenAPI-driven auto-generation, scoped API keys, risk classification, and confirmation tokens for destructive operations.