What’s new.

Hobby build-minute limit, per-project HSTS, security hardening

From 27 October the Hobby plan stops starting new builds once its 100 included build minutes for the month are used. Running sites are not affected. Also: HSTS settings per project and a further round of security fixes.

• Hobby: once the 100 included build minutes of the month are used (deploy builds and CI jobs both count), new builds and CI jobs pause until the monthly reset or an upgrade. Running sites stay up, and rolling back to an already-built release still works. The dashboard shows a banner while builds are paused.
• Per-project HSTS: set max-age, includeSubDomains and preload in project settings; preload is only sent with includeSubDomains and a max-age of at least one year, and 0 removes the header.
• Analytics injection skips responses whose Content-Security-Policy does not allow the analytics host, so strict-CSP sites no longer log violations; it can be turned off per project.
• buildfy mcp install (next CLI release) asks which workspace to use and registers the server with Claude Code; components can be created, updated and deleted from the CLI and MCP.
• A production deploy is no longer handed an in-flight preview build of the same commit.
• Security hardening (audit of 26 October): image deploys are limited to your own registry namespace, CI jobs from fork pull requests get a throwaway cache, the production gate waits for an expected CI run instead of treating "no checks" as passing, rate limits and lockouts can no longer be dodged with spoofed forwarding headers, and deploy-hook URLs and invite tokens are masked.
• Account page: sessions show the real sign-in IP and device.

Buildfyio Checks: CI on every push and pull request

Add .buildfyio/ci.yml and every push and pull request runs its jobs in a fresh, isolated container at that exact commit, with one buildfyio/<job> GitHub commit status per job.

• New CI tab per project: runs with status, branch, commit, trigger and per-job results; filters, Run on branch, Rerun and Cancel.
• Run pages show the steps of each job with durations, the failure reason, a live log and downloadable artifacts (kept 1 to 30 days).
• CI secrets in Project → Settings → CI: separate from environment variables, only exposed to jobs that name them, never to fork pull requests, masked in logs.
• Runs cannot read production environment variables or reach the platform network; outbound internet works.
• "Require passing checks before production" also waits for buildfyio/<job> statuses, so a red commit cannot be deployed.
• CI minutes count as build minutes. CLI: buildfy ci …; MCP: list_ci_runs, get_ci_run, run_ci, rerun_ci, cancel_ci_run, get_ci_artifact, validate_ci_config.
• Docs: /docs/ci, including a GitHub Actions conversion guide.

Branch and per-commit preview URLs, skew protection, plan limits enforced

Every preview gets a URL pinned to its commit and a branch URL that follows the newest preview of that branch. Next.js apps keep working in tabs opened before a deploy. Plan caps and unpaid usage are now enforced by the API.

• Preview URLs: <project>-<sha7> is pinned to one deployment; <project>-git-<branch> follows the branch’s newest ready preview. Closing the pull request or deleting the branch removes both and tears the previews down.
• Skew protection: Next.js builds get NEXT_DEPLOYMENT_ID, and requests from a tab opened before a production deploy are routed to the previous release, which stays up for 30 minutes.
• Replica counts and instance sizes are checked against the plan when a project or component is saved; minimum replicas above the maximum are refused.
• Hobby workspaces that run past their included runtime hours with no card on file get a 7-day grace period and are then suspended (sites show a notice page). Adding a card restores them automatically.
• Rollback is allowed under a spend cap; static and component rollbacks switch the right release; promote refuses a build whose build-time environment differs from production and offers a fresh build instead.
• A declined card returns the card issuer’s reason, and retrying after a decline works.
• Security: ownership checks on every workspace route, SSRF hardening for rewrites and webhooks, sign-in lockouts per email and IP, no caching of authenticated responses, security headers on every dashboard page, and tenant sites never receive platform session cookies.

Signed webhooks, object storage, CLI deploys without Git, MFA, uptime SLA

Outbound webhooks with signatures and retries, S3-compatible buckets, rollbacks that reuse the built image, enforced two-factor sign-in, and a published SLA backed by off-host uptime probes.

• Webhooks: workspace and project endpoints for deployment, domain and alert events, signed with a whsec_ secret (shown once, rotatable), retried up to 7 times over about 20 hours, with a deliveries log and redeliver. Alert webhooks and log drains are HMAC-signed too.
• Object storage: create S3-compatible buckets per project with their own access keys (shown once); storage is metered per GB-hour. Components can also mount a persistent volume.
• CLI (next CLI release): buildfy deploy uploads the current directory when it is not a Git checkout, --prebuilt deploys an existing image, and new ls, rollback, promote and cancel commands.
• Rollback re-points to the image that was already built: no rebuild and no Git access, so it takes seconds. Image projects can be redeployed.
• Cancel now stops the running build. Environment variables can be build-only or runtime-only.
• Builds a push cannot affect are skipped (path filter per project root, plus an ignored-build-step command; turbo-ignore works). Every image gets a secret scan, a Trivy vulnerability scan and an SBOM on the deployment page.
• Two-factor authentication (TOTP with recovery codes) is enforced at sign-in, including OAuth sign-in; workspaces can require it for every member.
• Custom environments by branch pattern with approvals; pull requests get commit statuses and a preview comment, and production can wait for required GitHub checks.
• Uptime is probed every minute from a machine outside the production host; the status page shows the last 30 days and the new /sla page publishes a 99.9% monthly uptime commitment for paid plans with service credits.
• Audit log: filters, CSV export and a per-project Activity tab. The Firewall tab shows blocked requests as they happen. Failing cron jobs are visible and can trigger alerts.
• Templates: copy a starter into your own GitHub account from the wizard. The KV add-on gets its own password-protected Redis.

Dedicated databases, edge firewall, a dashboard that tells the truth

Managed Postgres and Redis per project, firewall rules that are actually enforced, and a pass over every dashboard page driven by 60+ in-product feedback reports.

• Dedicated databases: provision Postgres or Redis for a project; the connection URL lands in the project env, with backups and restore.
• Firewall rules are enforced at the edge. Rules saved with invalid patterns before enforcement are flagged and paused instead of silently ignored.
• Feedback: a new in-product feedback inbox for admins, "My feedback" for everyone with status and resolution notes, and reports up to 10,000 characters.
• Deployments: queued tab, Load more paging, live status, fixed columns and one date format; detail pages show build warnings (for example secrets passed as build args) alongside errors.
• Rollback from the deployment page, with the previous release and its routes restored together.
• Workspace Domains page: search, filters, triage sort, paging, DNS instructions and Add domain.
• Projects, Overview, Team, Billing and Settings pages reworked: readable tables, URL-backed filters, validated forms, consistent time windows.
• Environment variables are masked until revealed; the secret flag now says what it controls.
• Region flags render as SVG everywhere (emoji showed as letters on Windows).
• Payment-failure banner deep-links to the Payment tab with Add card open.
• Web analytics hash the real client IP and report LCP/CLS once per page.

Edge watchdog

Follow-ups to the 17 October HTTPS outage: the edge proxy reconciles routes only when they changed, reloads with a 30-second grace period, and an external watchdog restarts it when HTTPS stops answering.

• Static-site routes compare key-sorted, so the reconcile no longer rewrites every route every five minutes.
• Static releases keep a stable per-host route; retention sweeps only touch rows that still own something.
• Minute-level external HTTPS watchdog with automatic recovery and admin alert.

Security hardening release

Every finding from the external security scan addressed: dependencies lifted to patched lines, containers run unprivileged with read-only roots, CI actions pinned to commit SHAs, and the first green CI → release pipeline.

• Next.js 15.5.24, webpack 5.112, hono 4.13, qs 6.16, undici 6.28, simple-git 4, drizzle-orm 0.45 and ~40 further upgrades.
• API, web and worker images run as non-root with HEALTHCHECKs; Kubernetes manifests carry pod and container securityContexts, no Docker socket, read-only roots.
• Worker RBAC narrowed: no pods/exec, no configmaps, logs and events read-only.
• Published packages fixed for CommonJS consumers; CI pipeline green for the first time; SECURITY.md added.
• Transactional mail moves to an HTTP API (no SMTP).
• Host-side disk GC and BuildKit cache bounds keep the build host out of disk pressure.

Control tower and team invitations

Platform-wide load and cost by customer for operators, and invitation management for teams.

• Control tower (admin): live pods, CPU, memory and disk per workspace and project, with cost attribution.
• Change or revoke a pending invitation’s role; the deployments list shows which app each row belongs to.
• A platform-caused build failure retries once and is marked honestly if the retry throws; a tainted node counts as a platform failure, not the app’s.
• Static-site outputs keep the current release plus three; the janitor stops starting builds when the disk is critical.

Domains, cron and apps from the CLI, MCP and SDK; static sites grow up

Every client can now manage domains, cron jobs, components and project settings. Static sites get the features people expected from day one.

• buildfy domains | cron | components | project, and the matching MCP tools and SDK resources.
• Static sites: a real 404 page, compression, security headers, _headers and _redirects files, and environment variables at build time.
• Cron job names are unique per project; clients refuse ambiguous names.
• Image retention: never prune build images younger than two hours.

API tokens, cron jobs that run, integrations

Account-level API tokens with enforced scopes, project cron jobs moved to a runner that actually fires, and the first third-party integrations.

• Settings → Tokens: scoped, expiring API tokens; buildfy tokens create|ls|revoke; BUILDFY_TOKEN for CI.
• Project cron jobs run from the worker, call the app’s public URL and send CRON_SECRET as a bearer token; each run is recorded with status and duration.
• Integrations: connect Supabase or Basefyio once and link environments to projects.
• Transfer a hostname between your own projects without deleting it.
• Billing: owners are told when a payment fails or a plan is lost; the team page says when the plan has no seats left.
• Fixes: the dashboard Deploy button always built main; the strict rate limit was a global 30 requests per minute; clearing Output directory now persists; pods default HOST=0.0.0.0.

List view, favourites, tags and honest deploy history

Dashboard quality-of-life and a deploy history you can trust.

• Projects list view, favourites, time-zone aware timestamps, Visit site, Copy error, and a 90-day chart.
• Tags on projects, outdated builds are skipped when a newer push arrives, webhooks follow repository renames, cancel means cancel.
• One deploy per commit, an audit trail that matches what happened, abandoned deploys closed out; Astro 6 builds.
• GitHub: choose the account to install on, manage the real installation, disconnect one.
• CLI: deploy is accepted, env push updates existing values, env pull writes secrets.

Capacity and scheduling fixes

A run of reliability work after two capacity incidents: apps that were parked are remembered, every app in a multi-app project is routed, and a release never leaves two deployments running.

• One app, one running deployment; a retired deployment’s preview route is dropped on promotion.
• Unschedulable pods are reported honestly and memory can be changed from the dashboard; the scheduler reserves realistic CPU and memory headroom.
• The healer no longer gives up forever, notices apps with no workload left, and never restores an app the user deleted or parked on purpose.
• Monorepo Dockerfiles build with the repository root as context.
• Edge: a route is written only when it changed; unverified hosts stay out of the edge config.

Packages on npm, browser login, feedback system, remote MCP

The CLI, SDK and MCP server are installable from npm, sign-in is a browser approval, and the connector runs hosted at mcp.buildfyio.com.

• @fyio/buildfyio-cli (binary: buildfy), @fyio/buildfyio-sdk and the MCP server published with real install instructions.
• buildfy login opens the browser for approval — no password prompt.
• buildfy errors, SDK error/tail methods and the MCP tool give agents the diagnosis and only the error lines of a failed build.
• Hosted MCP connector at mcp.buildfyio.com with OAuth 2.1 + PKCE; add it to Claude without a local install.
• Feedback: typed reports with tasks and resolution emails; a dialog instead of window.prompt.
• Pull environments from envfyio; per-project AI connect block; routing rule builder; prompt to redeploy after env changes; typed confirmation before deleting a project.
• Copy-report button on deployments; monorepo discovery says when a scan was partial; dead GitHub connections are marked.

Headless workers, push fan-out, metering

Background components without a route, a push that deploys every app, and the last pieces of usage metering.

• Headless worker and cron components: no probes, no route, no preview URL.
• A push deploys every app in the project; apps can be renamed; domains re-point to another app without deletion.
• Manual redeploy for image-backed projects; worker components no longer stick in queued.
• pnpm workspaces install with the hoisted linker so phantom dependencies resolve as they do on Vercel and npm; npm cache and Prisma generate fixes.
• Egress bandwidth metering; entitlement reconciliation (a dead subscription means Hobby, everywhere).
• Documentation and SEO overhaul: the docs set you are reading.

Monorepo builds, Astro, zero-touch analytics

Workspace monorepos build from the repository root, Vercel-configured Astro repos run unchanged, and analytics inject at the proxy.

• pnpm, yarn and npm workspaces build from the repo root like they do locally.
• Astro: SSR builds a container, static publishes to the edge; a Vercel adapter is swapped automatically at build time.
• Every app gets its own subdomain, domains and environment; components stop hijacking the primary host.
• Zero-touch analytics tracker for SSR and container apps via proxy-level HTML injection.
• Explicit port in the start command wins everywhere; static-tier installs include devDependencies.

One project, many apps

A monorepo becomes a single project with apps, each with its own domains and environment; plus invitations, the Starter tier and build-time secrets.

• Monorepo = one project; apps are components with per-app domains, env and detail pages.
• Set environment variables before the first build, or paste a whole .env file.
• Secrets are injected at build time through a BuildKit secret mount and never land in image layers.
• Domains: on-demand DNS verification, apex and www siblings provisioned together, clearer "already in use" errors.
• Team invitations by email with accept and decline; Starter tier at $10/month.
• Build Doctor surfaces the diagnosis in-product with a suggested fix.

Toolchains and the configure step

More languages build out of the box and the project wizard explains what it found.

• .NET, PHP, Python and Ruby native-package toolchains; Nixpacks upgraded for modern SDK targets.
• Wizard: a professional Configure step with framework badges and monorepo copy; repository validation that survives rate limits.
• GitLab SSO sign-in and sign-up.
• Confirm dialogs replace native confirm(); build-doctor rules for image-pull and crash failures.

Vercel parity batch

Routing rules, image cache, firewall, ISR, first-class environments and deploy-failure diagnostics.

• Nixpacks-first Dockerfile synthesis with homegrown templates as fallback.
• Deploy failure diagnostics; preview, production and custom environments.
• Routing rules, image cache, analytics, firewall and runtime docs; preview gate, regions, ISR, edge detection, log drains.
• GitHub install is OAuth-first; the App install is opt-in.

Growth surface

One-screen onboarding, template gallery (20 pages), attribution funnel from OSS + npm + MCP, referral credits, and dunning for failed payments.

MCP server for AI agents

Ship @fyio/buildfyio-mcp so Claude/Cursor/Windsurf can deploy for you. `buildfy mcp install claude-code` writes the config; safety tiers gate destructive ops.

Platform admin panel

Cross-org reporting, config viewer, and audit trail for the ops team.

In-product feedback and GitHub install fallback

Send feedback right from the navbar — it is routed to the platform-admin triage queue. When the GitHub install round-trip fails, pick from app-visible installations and link in one click.

Production launch

docker-compose stack + k3s + Caddy on a single Ubuntu host. Verified custom domains are pushed into Caddy on the fly and served with auto-issued Let’s Encrypt certificates.