runtime static HTML/CSS/JS, optional ASP.NET 10 (Razor Pages) for server-ish stacks
model Claude Sonnet 4.6 via Anthropic API · streaming · prompt caching on the ~5K-token system prompt
db Postgres schema per Cabin · search_path lock for isolation · 5s statement timeout · 1000-row cap · 50KB response cap · 4000-char SQL limit · 50 params max
sql sdk vibe.sql(q, params) with $1/$2 → @p1/@p2 translation · parameterized only · server-side blocklist (DROP DATABASE/SCHEMA/USER/ROLE, GRANT/REVOKE, CREATE ROLE, ALTER SYSTEM, COPY, SET ROLE, pg_catalog, information_schema)
doc sdk vibe.list / .get / .create / .update / .remove / .watch · 10K records/Cabin · 50KB/record · polling watch (2s default)
deploy Docker container per Cabin · DigitalOcean droplets · Traefik routing · Let's Encrypt SSL (HTTP-01) · auto-rollback on health-check failure
domain Porkbun for registration + DNS · ImprovMX MX + SPF for email forwarding · BYOD supported
git GitHub private repo per Cabin · atomic commits via Git Data API (mixed text + binary blobs in one tree) · default branch main · README + AGENTS.md auto-injected
agents AGENTS.md at repo root AND served at https://yourdomain/AGENTS.md · DATA SAFETY rules baked into builder's own system prompt AND shipped to customer · destructive-SQL detector (DROP TABLE, TRUNCATE, DELETE/UPDATE without WHERE) logs to admin dashboard
assets customer-uploaded files (logos, PDFs, ZIPs ≤ 30 MB) land at /assets/<name> · sanitized filename + extension allowlist · travel through deploy + GitHub commit · base64 heredoc for binaries, utf-8 for text
payments Stripe Checkout · webhook event-id dedup mandatory · idempotency keys on charge creation · idempotent across re-publishes
cancel repo and code stay yours forever · clone, fork, walk · no SaaS lock-in