🚀 Building my site in public: the stack and the first mistakes
🚀 This is the first post on my blog, and it is about the site you are reading right now. 🛠️ I wanted a personal website that I fully control, where I can publish build notes, decisions and things I learn along the way. I will publish every other Friday about different topics. So I picked a stack I know well enough to ship with: Next.js with the App Router on Vercel, Supabase for the database, authentication and images, and GitHub for the source code. 🐛 The first version went live quickly. The problems came after that. My profile photo did not show, and the cause was not the photo but the environment variables. Supabase keys that the browser needs must be named with the NEXT_PUBLIC_ prefix, and on Vercel they must be stored as plain configuration, not as secrets. Once I fixed those, the photo appeared 📸 🔐 Next, Vercel flagged my Next.js version as vulnerable (CVE-2025-66478, a React Server Components issue). I upgraded Next.js and React, and pinned a patched version of postcss through an override. Small, boring fixes like this are part of shipping. 🧱 🔀 I also changed my workflow. Nothing goes straight to main anymore. Every change lives on a branch, goes through a pull request, and runs through GitHub Actions, which type-checks and builds the site first. It feels slower at the start, but it catches mistakes before they reach the live site. ✅ 📅 Next time: what I’m learning from running CI on every pull request.