28 articles in this category.
Guides
What an MCP server is, how hosts, clients and servers fit together, MCP vs a REST API, what changed in the 2026-07-28 spec, and the security rules.
Thomas Lovas Lokoy · 9 min read · 2026-10-23
Guides
Turn a web app into a mobile app: PWA install rules, iOS web push, Trusted Web Activity and Capacitor, store fees, and Apple's repackaged-website rule.
Thomas Lovas Lokoy · 8 min read · 2026-10-23
Guides
What vibe coding means, why AI-written code often ships with security flaws, and a 10-point security checklist to run before a vibe-coded app goes live.
Thomas Lovas Lokoy · 8 min read · 2026-10-23
Guides
API keys security for first-time app builders: where secrets belong, how env variables and NEXT_PUBLIC_ work, and what to do after a leak.
Thomas Lovas Lokoy · 7 min read · 2026-10-17
Guides
The OWASP Top 10 (2025) in plain language: what each of the ten web app security risks looks like in a first app, and what to check first.
Thomas Lovas Lokoy · 7 min read · 2026-10-17
Guides
Rate limiting explained for first-time app builders: what it is, which endpoints to protect, where to add it in Next.js, and how to answer with a 429.
Thomas Lovas Lokoy · 7 min read · 2026-10-17
Guides
Core Web Vitals in plain terms: what LCP, INP and CLS measure, the pass thresholds, field vs lab data, and the fixes that matter for a first web app.
Thomas Lovas Lokoy · 8 min read · 2026-10-17
Guides
Web accessibility for a first app: what WCAG 2.2 Level AA asks, the success criteria small apps hit most, and a one-hour check you can run yourself.
Thomas Lovas Lokoy · 7 min read · 2026-10-17
Guides
Connect a custom domain to your web app: DNS records, apex vs subdomain, how HTTPS certificates are issued, redirects, mixed content and HSTS.
Thomas Lovas Lokoy · 7 min read · 2026-10-17
Guides
Web app authentication compared: how passwords, magic links, OAuth and passkeys work, what each costs to run safely, and a sensible default.
Thomas Lovas Lokoy · 7 min read · 2026-10-17
Guides
Stripe Checkout or Payment Links? What each does, fees, and the webhook fulfilment both need, for people taking payments in their first web app.
Thomas Lovas Lokoy · 7 min read · 2026-10-17
Guides
How to choose a database for a small app: when SQLite is enough, when you need Postgres, and what hosted options like Supabase and D1 change.
Thomas Lovas Lokoy · 7 min read · 2026-10-17
Guides
GDPR for web apps, explained for small teams: scope, lawful bases, user rights, security, breach rules and the paperwork you do and do not need.
Thomas Lovas Lokoy · 7 min read · 2026-10-17
Guides
What a privacy policy for an app must include under GDPR Article 13, item by item, plus how to write and present each section so people read it.
Thomas Lovas Lokoy · 7 min read · 2026-10-17
Guides
When cookie consent is required for a web app, which cookies are exempt, and what regulators say a valid banner must and must not do.
Thomas Lovas Lokoy · 7 min read · 2026-10-17
Guides
REST API design basics for your first web app: which HTTP method to use, which status code to return, and how to name URLs consistently.
Thomas Lovas Lokoy · 8 min read · 2026-10-17
Guides
How to scope an MVP for your first web app: write the user need, find the one journey, test the riskiest assumption and cut the rest.
Thomas Lovas Lokoy · 8 min read · 2026-10-17
Guides
How Next.js environment variables load, what NEXT_PUBLIC_ really does, and how to set different values for development, preview and production.
Thomas Lovas Lokoy · 8 min read · 2026-10-17
Guides
Files, not a running product. A plain account of what you hold after an AI app builder finishes, what is still yours to do, and how to tell marketing from mechanics before you pay.
Thomas Lovas Lokoy · 6 min read · 2026-10-16
Guides
The three numbers behind every AI app builder price: how many runs you get, how much each run can produce, and which model produces it. Explained with ContentForger's published tiers.
Thomas Lovas Lokoy · 7 min read · 2026-10-16
Guides
The twelve checks to run on a generated project before it goes live: build, types, environment, secrets, auth, database policies, tests, metadata and the things a model is told to do but might not have done.
Thomas Lovas Lokoy · 7 min read · 2026-10-16
Guides
Daily app counts, per-batch output ceilings, hourly rate limits and a monthly spend ceiling: what each limit protects, why they fail closed, and how to work with them instead of against them.
Thomas Lovas Lokoy · 6 min read · 2026-10-16
Guides
What an agency needs from a code generator that a solo builder does not: white-label output, a client record, an API, scheduled runs and a daily allowance that survives a busy day. Judged against ContentForger's Agency plan.
Thomas Lovas Lokoy · 7 min read · 2026-10-16
Guides
Ten small-scope builds with real demand: invoice generator, link checker, regex tester, resume tailoring and more. One session plus a bit of polish.
Thomas Lovas Lokoy · 8 min read · 2026-04-28
Guides
Not a love letter. Why ContentForger and most serious AI generators landed on Next.js: the ecosystem, server components, hosting, and the counterargument.
Thomas Lovas Lokoy · 6 min read · 2026-04-28
Guides
The five predictable errors that eat weekends: prompting for features before structure, skipping the generated auth flow, ignoring the env file, and two more.
Thomas Lovas Lokoy · 6 min read · 2026-04-28
Guides
How to write prompts that produce shippable apps instead of generic demos: name the core loop, specify the data model, and leave room for sensible defaults.
Thomas Lovas Lokoy · 8 min read · 2026-04-28
Guides
Cloudflare Pages or Netlify: the actual trade-offs at realistic scale, what ContentForger handles for you, the migration cost, and what not to do.
Thomas Lovas Lokoy · 7 min read · 2026-04-28