<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>Osama Siddiqui — Blog</title>
    <link>https://sudoosama.com/blog</link>
    <description>Security, DevOps, cloud infrastructure, and web development. Practical guides from real client work.</description>
    <language>en-us</language>
    <managingEditor>info@sudoosama.com (Osama Siddiqui)</managingEditor>
    <lastBuildDate>Fri, 10 Apr 2026 02:20:58 GMT</lastBuildDate>
    <atom:link href="https://sudoosama.com/rss.xml" rel="self" type="application/rss+xml"/>
    
    <item>
      <title><![CDATA[Vibe Coding Is Fun Until Your App Gets Breached]]></title>
      <link>https://sudoosama.com/blog/vibe-coding-security-risks-2026</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/vibe-coding-security-risks-2026</guid>
      <description><![CDATA[AI-generated code ships vulnerabilities that pass code review because neither the developer nor the model knows what to look for. Real examples, common patterns, and a checklist to audit your own AI-assisted code.]]></description>
      <pubDate>Sat, 04 Apr 2026 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[7 Ways Your Cloud Bill Is Wasting Money Right Now]]></title>
      <link>https://sudoosama.com/blog/cloud-bill-audit-7-ways-wasting-money</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/cloud-bill-audit-7-ways-wasting-money</guid>
      <description><![CDATA[Unattached EBS volumes, oversized instances, forgotten load balancers, and dev environments running 24/7. Seven categories of waste that show up in almost every small business AWS and Azure account.]]></description>
      <pubDate>Sat, 28 Mar 2026 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[Ransomware Hits Small Businesses Harder Than Anyone Talks About]]></title>
      <link>https://sudoosama.com/blog/ransomware-small-business-2025</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/ransomware-small-business-2025</guid>
      <description><![CDATA[88% of ransomware attacks target small businesses. Average downtime is 24 days. One in five victims goes out of business. What makes small businesses the primary target and the specific controls that actually stop an attack.]]></description>
      <pubDate>Sat, 21 Mar 2026 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[The GitHub Actions Attack That Hit 23,000 Repositories]]></title>
      <link>https://sudoosama.com/blog/github-actions-supply-chain-attack-2025</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/github-actions-supply-chain-attack-2025</guid>
      <description><![CDATA[The tj-actions/changed-files incident in March 2025 exposed secrets from 23,000 repositories through a single compromised GitHub Action. What happened, how mutable tags made it possible, and what to lock down in your own pipelines.]]></description>
      <pubDate>Sun, 15 Mar 2026 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[How to Cut Your Cloud Bill by 30% in Five Days]]></title>
      <link>https://sudoosama.com/blog/cut-cloud-bill-30-percent</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/cut-cloud-bill-30-percent</guid>
      <description><![CDATA[A real example: $520 to $290 per month in five days of focused work. Day by day, here is what to audit, what to cut, and how to lock in savings with Reserved Instances without guessing wrong.]]></description>
      <pubDate>Sun, 08 Mar 2026 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[Fix: Vercel 'We Encountered an Internal Error' — Middleware Region Issue]]></title>
      <link>https://sudoosama.com/blog/vercel-middleware-deployment-fix</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/vercel-middleware-deployment-fix</guid>
      <description><![CDATA[Your Next.js build passes locally but Vercel keeps failing with 'internal error'? It's middleware deploying to a broken region. Here's the one-line fix in vercel.json.]]></description>
      <pubDate>Mon, 02 Mar 2026 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[Is Your CI/CD Pipeline Leaking Secrets? A 10-Point Audit]]></title>
      <link>https://sudoosama.com/blog/cicd-pipeline-leaking-secrets</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/cicd-pipeline-leaking-secrets</guid>
      <description><![CDATA[GitHub Actions pipelines leak secrets in ways that are not obvious: unpinned actions, overly broad permissions, secrets printed to logs, fork pull requests. A checklist to find and fix each one.]]></description>
      <pubDate>Sat, 28 Feb 2026 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[Linux VPS Hardening: 7 Steps Before You Deploy Anything]]></title>
      <link>https://sudoosama.com/blog/linux-vps-hardening-checklist</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/linux-vps-hardening-checklist</guid>
      <description><![CDATA[A fresh VPS is an open door. Root SSH access, default ports, no firewall rules. Seven steps with the actual commands to close that down before you deploy anything.]]></description>
      <pubDate>Fri, 20 Feb 2026 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[Cloud Misconfigurations Are Behind 23% of Data Breaches]]></title>
      <link>https://sudoosama.com/blog/cloud-misconfiguration-data-breaches</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/cloud-misconfiguration-data-breaches</guid>
      <description><![CDATA[Public S3 buckets, security groups open to the world, IAM roles with admin access, RDS without encryption. The misconfigurations that cause most cloud data breaches and how to find them in your own account.]]></description>
      <pubDate>Wed, 18 Feb 2026 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[Docker in Production: 5 Security Mistakes That Are Easy to Miss]]></title>
      <link>https://sudoosama.com/blog/docker-production-security-mistakes</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/docker-production-security-mistakes</guid>
      <description><![CDATA[Running containers as root, outdated base images with known CVEs, secrets baked into image layers, mounting the Docker socket, no resource limits. Each one is a common mistake with a straightforward fix.]]></description>
      <pubDate>Thu, 12 Feb 2026 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[Why Your Vercel Bill Keeps Growing (And What to Do About It)]]></title>
      <link>https://sudoosama.com/blog/vercel-bill-is-growing</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/vercel-bill-is-growing</guid>
      <description><![CDATA[Vercel's pricing model has several billing areas that compound as your app grows: commercial use, function invocations, bandwidth, and preview deployments. How each one works and when the math stops making sense.]]></description>
      <pubDate>Thu, 05 Feb 2026 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[Zombie Cloud Resources: How to Find and Kill What You Are Paying for but Not Using]]></title>
      <link>https://sudoosama.com/blog/zombie-cloud-resources</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/zombie-cloud-resources</guid>
      <description><![CDATA[Unattached EBS volumes, orphaned load balancers, forgotten RDS instances, abandoned S3 buckets with versioning bloat. A walkthrough of every AWS resource category worth checking and the commands to audit each one.]]></description>
      <pubDate>Thu, 29 Jan 2026 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[Next.js vs React in 2026: Which One to Pick and Why]]></title>
      <link>https://sudoosama.com/blog/nextjs-vs-react-2026</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/nextjs-vs-react-2026</guid>
      <description><![CDATA[59% of React developers use Next.js. 17% have negative sentiment about it. Vercel lock-in concerns are growing. A practical decision framework for choosing between Next.js, plain React with Vite, and Astro.]]></description>
      <pubDate>Thu, 22 Jan 2026 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[Poor Core Web Vitals Are Costing You Sales (Here Is the Data)]]></title>
      <link>https://sudoosama.com/blog/core-web-vitals-cost-you-sales</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/core-web-vitals-cost-you-sales</guid>
      <description><![CDATA[Only 47% of websites pass Core Web Vitals. A one-second delay reduces conversions by 7%. INP replaced FID and 43% of sites fail it. What each metric measures, how to check your score, and the fixes that actually move the needle.]]></description>
      <pubDate>Thu, 15 Jan 2026 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[Passkeys vs Passwords in 2026: When to Switch and How]]></title>
      <link>https://sudoosama.com/blog/passkeys-vs-passwords-2026</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/passkeys-vs-passwords-2026</guid>
      <description><![CDATA[800 million Google accounts now use passkeys. 26% of sign-ins on Google are passkey-based. What passkeys actually are, how WebAuthn works under the hood, and whether adding passkey support makes sense for your app.]]></description>
      <pubDate>Thu, 08 Jan 2026 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[Why PostgreSQL Gets Slow as Your App Grows (And How to Fix It)]]></title>
      <link>https://sudoosama.com/blog/postgresql-slow-as-you-grow</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/postgresql-slow-as-you-grow</guid>
      <description><![CDATA[N+1 queries, missing indexes, no connection pooling, wrong shared_buffers, LIKE queries that cannot use indexes. The specific PostgreSQL performance problems that appear as your data grows and how to diagnose and fix each one.]]></description>
      <pubDate>Fri, 26 Dec 2025 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[Self-Hosting Your Next.js App on a $4.50 VPS with Coolify]]></title>
      <link>https://sudoosama.com/blog/self-hosting-nextjs-coolify</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/self-hosting-nextjs-coolify</guid>
      <description><![CDATA[Hetzner CX22, Coolify, a GitHub connection, and you have a Vercel-like deployment pipeline for $4.50 a month. Full setup walkthrough: wildcard DNS, automatic SSL, git-push deploys, and how Coolify handles zero-downtime updates.]]></description>
      <pubDate>Fri, 05 Dec 2025 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[AI-Powered Phishing Is Getting Past Your Team's Detection]]></title>
      <link>https://sudoosama.com/blog/ai-phishing-2026</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/ai-phishing-2026</guid>
      <description><![CDATA[$2.9 billion in business email compromise losses in 2024. AI-generated phishing emails with no grammar mistakes, deepfake audio impersonating executives, hyper-personalized attacks from scraped LinkedIn data. What changed, why the old advice stopped working, and what does.]]></description>
      <pubDate>Fri, 28 Nov 2025 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[Is Your Web App Storing Passwords Correctly? How to Check.]]></title>
      <link>https://sudoosama.com/blog/password-storage-wrong</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/password-storage-wrong</guid>
      <description><![CDATA[AI-generated code regularly stores passwords without proper hashing. How to verify what your app is actually storing, what bcrypt and Argon2 hashes look like, and how to migrate to proper hashing without a forced password reset.]]></description>
      <pubDate>Fri, 21 Nov 2025 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[Terraform for Small Teams: What It Solves and When Not to Use It]]></title>
      <link>https://sudoosama.com/blog/terraform-small-teams</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/terraform-small-teams</guid>
      <description><![CDATA[Terraform solves infrastructure drift, reproducibility, and review. It also introduces state management complexity and a learning curve. An honest breakdown of when it makes sense for a small team and when it is overhead you do not need.]]></description>
      <pubDate>Fri, 07 Nov 2025 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[Stripe Integration Mistakes That Cost You Revenue (And How to Fix Them)]]></title>
      <link>https://sudoosama.com/blog/stripe-integration-mistakes</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/stripe-integration-mistakes</guid>
      <description><![CDATA[Webhook failures, missed subscription events, payment state bugs. The Stripe integration problems that show up weeks after launch, why they are hard to debug, and exactly where each one hides.]]></description>
      <pubDate>Thu, 30 Oct 2025 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[Azure vs AWS for Small Business in 2026: An Honest Comparison]]></title>
      <link>https://sudoosama.com/blog/azure-vs-aws-small-business-2026</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/azure-vs-aws-small-business-2026</guid>
      <description><![CDATA[AWS has 32% market share, Azure has 25%. For small businesses, the right choice depends on what you already use. Where each one genuinely wins, where they are roughly equal, and the scenarios where the choice is easy.]]></description>
      <pubDate>Thu, 23 Oct 2025 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[JWT Done Wrong: The Auth Mistakes That Let Attackers Stay Logged In]]></title>
      <link>https://sudoosama.com/blog/jwt-done-wrong</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/jwt-done-wrong</guid>
      <description><![CDATA[JWT in localStorage, no token rotation, weak secrets, no expiry. These mistakes appear in tutorials and AI-generated code constantly. What the correct implementation looks like and why each mistake is actually exploitable.]]></description>
      <pubDate>Thu, 16 Oct 2025 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[TypeScript Has Won. What That Means for Your Next Project.]]></title>
      <link>https://sudoosama.com/blog/typescript-has-won</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/typescript-has-won</guid>
      <description><![CDATA[The State of JS 2026 survey officially declared TypeScript has won. Majority adoption, ecosystem-wide support, and JavaScript without types is now a deliberate choice with real tradeoffs.]]></description>
      <pubDate>Thu, 02 Oct 2025 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[How to Build a SaaS MVP Without Creating a Security Nightmare Later]]></title>
      <link>https://sudoosama.com/blog/saas-mvp-without-security-nightmare</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/saas-mvp-without-security-nightmare</guid>
      <description><![CDATA[The decisions you make at MVP stage determine how painful your next 18 months will be. What to get right from the start so you are not rewriting auth and security six months after you shipped.]]></description>
      <pubDate>Tue, 23 Sep 2025 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[Surviving Submarine Cable Cuts with SD-WAN SLA Design]]></title>
      <link>https://sudoosama.com/blog/surviving-submarine-cable-cuts</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/surviving-submarine-cable-cuts</guid>
      <description><![CDATA[Submarine cable cuts in the Red Sea pushed latency from 50ms to 300ms+ across six ISPs. Here's how I redesigned SLA checks in FortiGate SD-WAN to keep links stable and reliable.]]></description>
      <pubDate>Thu, 18 Sep 2025 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[What a Vulnerability Audit Actually Finds in a Typical Web App]]></title>
      <link>https://sudoosama.com/blog/what-a-vulnerability-audit-finds</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/what-a-vulnerability-audit-finds</guid>
      <description><![CDATA[Most web apps have the same five or six issues. Exposed API keys, broken auth logic, public cloud storage, unsanitized inputs, and outdated dependencies with known CVEs. What each one looks like in practice and how serious each actually is.]]></description>
      <pubDate>Tue, 09 Sep 2025 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[Building Automated Backup Scripts for My Azure-to-Local Workflow]]></title>
      <link>https://sudoosama.com/blog/building-automated-backup-scripts</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/building-automated-backup-scripts</guid>
      <description><![CDATA[Bash scripts for automated backups of NGINX, SQL Server, PostgreSQL, MongoDB, and other services from Linux hosts to a remote server over SSH/SCP.]]></description>
      <pubDate>Tue, 02 Sep 2025 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[FortiGate Removed SSL VPN - How I Got Linux Clients Working with IPsec on Fedora 42]]></title>
      <link>https://sudoosama.com/blog/fortigate-removed-ssl-vpn</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/fortigate-removed-ssl-vpn</guid>
      <description><![CDATA[Fix FortiGate 7.4.8 SSL VPN removal. Step-by-step strongSwan IPsec (IKEv2) setup for Linux Fedora 42 and Ubuntu clients.]]></description>
      <pubDate>Mon, 01 Sep 2025 00:00:00 GMT</pubDate>
    </item>
    <item>
      <title><![CDATA[How I Got Hooked on Networking and Why Security Starts Here]]></title>
      <link>https://sudoosama.com/blog/how-i-got-hooked-on-networking</link>
      <guid isPermaLink="true">https://sudoosama.com/blog/how-i-got-hooked-on-networking</guid>
      <description><![CDATA[I was always fascinated by tech. I touched a computer for the first time when I was very young, and from then on, I had a habit: every week, I'd break something… and then spend hours figuring out how to fix it.]]></description>
      <pubDate>Sun, 31 Aug 2025 00:00:00 GMT</pubDate>
    </item>
  </channel>
</rss>