Changelog

What changed.

How each stack’s support moved. For what to upload today, use the stack docs.

Platform

Applies to every guest, not one stack.

PHP is patched — drop and upload again

  • WordPress, PHP, Laravel, and other PHP-based sites stay on the previous PHP until you remove the live app and upload or redeploy it.

Missing pages match the rest of the site

  • A 404 now uses the same theme as the homepage, with a way home and a way to drop a project.

Delete this app now leaves the console

  • WordPress and other apps are removed from the list when you delete them. The URL and files go with them.

Paid plans can replace files and keep the URL

  • Pro, Business, and Studio can drop a new ZIP on an existing app. The address stays. Hobby still mints a new URL each time.

Windows start scripts no longer block a drop

  • A project can include start.bat or similar launcher files. Real binaries and installers are still rejected.

Plans now differ on time and box size

  • A free account is 3 apps for 7 days. Pro lasts 90 days. Business and Studio last a year, with 1 GB and 2 GB boxes. Studio adds 3 team seats and a white-label subdomain.

Terms and Privacy are on the site

  • The footer links to a Terms of Use page and a Privacy Policy. They cover accounts, uploaded apps, billing, and what we collect.

New app URLs get HTTPS immediately

  • A fresh *.mycodedapp.com address is trusted as soon as the app is live. You no longer wait on a first-visit certificate.

Studio plan and a full pricing table

  • Studio is $99 a month for 25 apps at a time with a domain you own. Pro is 10 apps, Business is 15. The pricing page lists every feature each plan includes.

One drop without an account, five with a free signup

  • A browser can host one app for 24 hours. Create a free account for five apps at a time, each for 30 days. Delete an app to drop another.

Pricing lists every Hobby, Pro, and Business difference

  • A comparison table shows what each plan includes. The drop path and runtime stay the same; the URL and how long the site stays up are the upgrades.

Live WordPress and other apps stay up after a busy stretch

  • A site that was already live no longer goes blank with “Upstream is not reachable” after a burst of traffic.

New deploys stay reachable when many apps are already live

  • A twelfth app no longer fails the ready check with connection refused after the process itself started.

Hobby URLs reach the live site

  • A generated mycodedapp.com address no longer shows a missing page after the site is live.

Day, Dawn, Dusk, and Dark

  • The console cycles four palettes. Night is now called Dark.

Pro and Business upgrades bill through Stripe

  • Paid plans go through Checkout. Hobby stays free for a day on a generated URL.

Business domains must point here first

  • Verify only after a CNAME to the platform target (or an address we published).
  • Opening the check file on a pending host does not attach the domain.

Hobby time ends on the next visit

  • When the clock runs out, the next request stops the app. You do not wait for a later sweep.

Fleet signals for every guest

  • The host samples CPU, memory, disk, and process counts for each live app.
  • Overview shows per-app usage. /ops/ lists every guest on the node plus a JSON brief for review.

Site detail shows live usage

  • Each app’s manage page lists CPU, memory, storage, time left, stack, and the upload address.
  • Container apps are sampled from the host. Static HTML is in-process, so CPU and memory are not per-site.

Guest apps are isolated

  • Each guest has no outbound internet.
  • Visitors reach the site through the platform URL, not a raw host port.
  • CPU, memory, process, and disk caps apply to every guest.

Upload gate tightened

  • Archives are checked for zip-slip, zip bombs, symlinks, and oversized trees.
  • Native binaries and installer files are rejected before extract.

Build scripts locked down

  • npm / yarn / pnpm install without lifecycle scripts.
  • Composer install without scripts or plugins.

Folder drops pack in the browser

  • Loose folders are zipped before upload so large trees no longer fail as thousands of form fields.
  • .venv, node_modules, and similar junk are skipped while packing.

Health checks no longer hang on app errors

  • A site that answers HTTP is marked live even if the first page is an application error.

HTML

Static files. No container. index.html is the site.

Docs

Static hosting

  • In-process file serve. `index.html` or first HTML file.

PHP

Apache + PHP 8.3. index.php or composer.json is enough.

Docs

PHP uploads run on a patched, locked-down PHP

  • Uploaded PHP folders start with current PHP security updates, database and image support, and shell commands turned off.

Composer packages are installed before the site goes live

  • A failed package install no longer leaves the site live without vendor/autoload.php.

Composer scripts disabled

  • Composer install no longer runs scripts or plugins.

PHP + Apache

  • `index.php` or `composer.json`. `public/` becomes the docroot.

Laravel

artisan in, public/ as the document root, Apache out.

Docs

Laravel no longer starts without Composer packages

  • The first page no longer fatals on a missing vendor/autoload.php after a successful-looking deploy.

Same Composer lockdown as PHP

  • Artisan hooks do not run during `composer install`.

Laravel detection

  • `artisan` + Composer. Apache document root `public/`.

WordPress

Full core, or a theme. We provision MariaDB either way.

Docs

WordPress uses the same locked-down PHP as PHP uploads

  • A WordPress folder can no longer run shell commands from PHP after it goes live.

WordPress styles load on HTTPS

  • Stylesheets no longer use http on an https site URL, which left the page unstyled.

WordPress redeploys after a failed attempt

  • A second deploy no longer fails because leftover files from the first attempt cannot be removed.

WordPress theme deploys finish

  • A redirect to the HTTPS site URL no longer fails the ready check.

WordPress database starts

  • MariaDB now finishes boot instead of exiting before the site can connect.

Theme-only install finishes

  • Core install now completes instead of stopping on the setup wizard.
  • The database is used only after it accepts connections.
  • Admin email is a valid address so install is not rejected.
  • Must-use plugins attach after tables exist.

No outbound internet

  • Theme and plugin directory installs from wordpress.org fail. Ship plugins in the upload.

Theme-only packs

  • `style.css` Theme Name provisions a fresh site, activates the theme, logs admin credentials.

mu-plugins and WXR

  • Must-use plugins copied after core install. Demo XML imported when possible.

Core and SQL restore

  • Full core, `wp-config` rewrite, optional `*.sql` import, siteurl rewrite.

Django

manage.py in. Gunicorn + WhiteNoise out.

Docs

Start script no longer crashes before boot

  • A template bug aborted Django deploys before the app started.
  • Drops now reach image build and Gunicorn.

Missing imports added to requirements

  • Common packages imported in the project are added when they are absent from requirements.txt.

Isolated Gunicorn

  • No runtime outbound internet. WhiteNoise still serves `/static/`.

Runtime overlay

  • WhiteNoise, collectstatic, migrate on start, inferred pip extras from imports.

Django detection

  • `manage.py` wins over Flask/FastAPI.

Flask

We find the Flask() object and bind Gunicorn.

Docs

Isolated Gunicorn

  • App object inferred; no outbound sockets.

Flask detection

  • Requirements or `Flask(` in app/main/wsgi.

FastAPI

Uvicorn, inferred as main:app unless we find FastAPI().

Docs

Isolated Uvicorn

  • ASGI on 8080. No outbound internet.

FastAPI detection

  • Requirements or `FastAPI(` in main/app.

Node

package.json is the brief. Express, Next, Nest, or server.js.

Docs

Uploads without a lockfile finish building

  • A Node folder that only has package.json no longer fails before install.

Ignore npm lifecycle scripts

  • npm / yarn / pnpm install without lifecycle scripts.

Node detection

  • package.json, lockfiles, engines, start/build inference for Next/Nuxt/Nest/Express.

React / Vite

We run the build and serve the static output on nginx.

Docs

Uploads without a lockfile finish building

  • A React or Vite folder that only has package.json no longer fails before install.

Build reaches npm run build

  • A config-template bug aborted React/Vite deploys before the image built.

Install scripts off, read-only live site

  • Build still runs `npm run build`. The live site filesystem is read-only.

SPA pipeline

  • React / Vite detected, built, served with index.html fallback.

Vue

Vite or Vue CLI build becomes a live static folder.

Docs

Vue apps with in-page templates show their content

  • A successful deploy no longer leaves a blank page when the app uses template strings instead of single-file components.

Uploads without a lockfile finish building

  • Same frontend install fix as React.

Build reaches npm run build

  • Same frontend image fix as React and Angular.

Same frontend limits as React

  • Install scripts off. The live site has no outbound internet.

Vue detection

  • `vue` dependency, build to static files.

Svelte

Compile, then host the built files.

Docs

Uploads without a lockfile finish building

  • Same frontend install fix as React.

Build reaches npm run build

  • Same frontend image fix as React and Angular.

Same frontend limits as React

  • Static output required.

Svelte detection

  • `svelte` or SvelteKit in package.json.

Angular

ng build, then we serve the output.

Docs

Uploads without a lockfile finish building

  • Same frontend install fix as React.

Build reaches ng build

  • A config-template bug aborted Angular deploys before the image built.

Same frontend limits as React

  • `ng build` output served as static files.

Angular detection

  • `@angular/core`.

Rails

Gemfile, bundle install, rails server.

Docs

Rails becomes reachable after start

  • A successful boot no longer fails the ready check with connection refused when other apps are already live.
  • The generated site URL is no longer rejected as a blocked host.

Isolated rails server

  • No outbound internet. A secret key is generated at start.

Rails detection

  • Gemfile + rails / application.rb / config.ru.

Go

go.mod is the cue. We build a static binary and run it unprivileged.

Docs

Go apps that serve templates or data files start

  • A binary-only start left templates and JSON next to the program unused, so the site never answered.

Unprivileged read-only process

  • Static binary, no CGO, no uploaded binaries, read-only filesystem.

Go detection

  • `go.mod`, optional single `cmd/` package.