Documentation

Everything needed to get a project from a repository to a live URL, and to keep it running.

Quick start

Create the project

Open Create a new project and pick a source. A repository gives you automatic builds; an archive or an image is better for a one-off or a containerised app.

Set the environment

Add variables under the project's Environment tab. Secrets are stored server-side and are never sent back to the browser — the dashboard shows them as a mask.

Deploy

Every push to the production branch starts a build. The Deployments tab shows the log, the resulting version and a rollback control.

On this instance the deploy pipeline is not connected: the create flow shows the fields the connector expects and saves nothing. The rest of the product — directory, project pages, metrics — reads its real source, the database.

Deployment sources

Source	Behaviour
GitHub repository	Automatic builds on push, preview per branch, rollback to any version.
Archive upload	Unpacked into an isolated directory; the archive is not executed.
Docker image	Runs the image with the port and health check you specify.
Lyralink hosting	Starts from a template you can edit after creation.

Domains and TLS

Each project gets a subdomain on the platform's project host. To use your own domain, point an A or CNAME record at the target shown on the project's Domains tab; the certificate is issued once the DNS answer matches. http is redirected to https, and www to the apex.

Configuration

Configuration is environment-first. Nothing environment-specific is compiled into a build, so the same artefact runs in every environment.

NODE_ENV=production
DATABASE_URL=postgres://user:pass@host/db
STRIPE_KEY=sk_live_...

Analytics and privacy

Daily counters are aggregate only: visits, installs, active users. No visitor identity is stored.
Traffic sources are reported as shares, never as identified individuals.
Contact and intake forms rate-limit using a salted hash that rotates daily, so the same visitor cannot be correlated across days.
No page loads a third-party script. That is why the Content-Security-Policy on this site has no external origins in it.

API

Responses use one envelope everywhere, so a client parses one shape:

{
  "success": true,
  "data": { },
  "error": null,
  "request_id": "9f2c1a5b3d7e8f01"
}

Endpoint	Method	Purpose
`/api/health`	GET	Liveness and dependency check. Never returns credentials or failure reasons.
`/api/contact`	POST	Contact intake as JSON. Validates, rate-limits, then stores.

Errors are machine-readable: {"success": false, "error": {"code": "...", "message": "..."}}. A stack trace is never returned, and internal paths are never named.

Limits and fair use

Limit	Value	Applies to
Archive upload	200 MB	Archive deployments
Contact messages	5 per hour per connection	Web form
Contact API	10 per hour per connection	JSON endpoint
Sign-in attempts	12 per 15 minutes	Account login

Limits exist to protect availability, not to make the free tier feel broken. If you hit one doing something legitimate, tell us and we will raise it.

Changelog

Date	Change
2026-09-24	Project management, explorer, Growth Center and the public project pages. Health and contact endpoints.
2026-09-17	Documentation, status and the privacy notice rewritten to describe what the platform actually does.