Next.js & react cves: what vibe coders must patch. Two Next.js DoS bugs and a high-severity React Server Components flaw landed this week. Here's what vibe coders on Next.js need to check and patch now. Two denial-of-service bugs and one high-severity React bug landed in the Next.js and React ecosystem this week. If your AI builder generated a Next.js app - and a lot of Lovable, v0, and Bolt output runs on Next.js under the hood - this is worth five minutes of your time. TL;DR * CVE-2025-59471 and CVE-2025-59472 are medium-severity (CVSS 5.9) denial-of-service bugs in the Next.js Image Optimizer, affecting self-hosted apps with remotePatterns configured for external images. * CVE-2026-23864 is a high-severity (CVSS 7.5) bug in React Server Components. It does not allow remote code execution, but Vercel says immediate upgrades are required regardless. * Apps hosted on Vercel's own platform are not affected by the Image Optimizer DoS bugs. The RSC bug is different - Vercel shipped a WAF rule as a stopgap but says not to rely on it alone. * Separately, r/vibecoding is having a real conversation about scaling AI-written code past what QA can review - which is exactly how bugs like these slip into production. Two Next.js DoS bugs, and who's actually exposed. CVE-2025-59471 and CVE-2025-59472 both hit the Next.js Image Optimizer when external image optimization is enabled via remotePatterns. Under specific configurations, an attacker can crash the server through memory exhaustion. There's no data exposure and no privilege escalation - this is availability, not confidentiality. If you deployed straight from Lovable, Bolt, or v0 onto Vercel's platform, you're not affected. If you self-host your Next.js app on your own server or a VPS, check whether you use remotePatterns and update. The React Server Components bug needs an actual patch. CVE-2026-23864 is a different animal. It's high severity (CVSS 7.5) and affects React Server Components directly - meaning any framework built on RSC, including current Next.js versions, inherits the risk. Vercel confirms it does not allow remote code execution, and the company pushed new WAF rules that automatically protect all projects hosted on Vercel at no cost. But Vercel is explicit here: the WAF is a mitigation, not a fix. If your app uses RSC, you still need to upgrade to a patched version. If you don't know whether your builder's output uses RSC, check your package.json for react-server-dom or a recent Next.js App Router setup - that's the tell. Why vibe-coded teams are the ones most likely to miss this. A thread on r/vibecoding this week described a company running fully AI-generated commits at team scale, with QA finding issues that Find your gaps before an attacker does. Is My Site Hackable? scans your deployed app for the exact issues in this article - exposed keys, missing RLS, open buckets - and tells you what's real and what's a false alarm.

GraphJSON vs Amplitude. GraphJSON vs Amplitude compared: schemaless JSON event logging, full SQL access, embeddable visualizations, and transparent per-event pricing. Picking an analytics tool is a commitment - once your events flow into one platform, switching is painful. In this post GraphJSON compare GraphJSON and Amplitude, two analytics tools with very different philosophies, so you can decide which one fits your team. (GraphJSON has also compared Mixpanel and Google Analytics if you're evaluating those too.) Introduction to GraphJSON. GraphJSON is an independently built analytics product for developers who want to log JSON events and turn them into graphs with minimal ceremony. It stores events in ClickHouse and layers a point-and-click visualizer, SQL notebooks, dashboards, alerts, and embeds on top. Introduction to Amplitude. Amplitude is one of the biggest names in product analytics. It offers a mature suite for tracking user behavior - funnels, retention, journeys, experimentation - and is widely adopted by product teams at larger companies. GraphJSON vs Amplitude: key differences. * Data Storage and Flexibility GraphJSON stores your data as JSON in a ClickHouse table. There's no schema to define up front, no tracking plan to negotiate - log whatever payload makes sense today and add fields tomorrow. Typeahead suggestions surface your field names and values as you explore. Amplitude is built around a structured event taxonomy. That governance is valuable to large organizations, but it means instrumentation decisions up front, and changing your data model later takes real effort. * Custom Querying and Data Analysis GraphJSON gives you full ClickHouse SQL notebooks. Joins, window functions, arbitrary aggregations - if you can express it in SQL, you can graph it, all without exporting your data anywhere. Amplitude's analysis happens through its built-in reports. They're polished, but when you hit the edge of what the UI supports, there's no escape hatch to raw SQL. * Visualization and Embedding GraphJSON supports a wide range of visualizations plus dashboards, alerts, and iframe embeds. The dynamic Embed API lets you change filters per request, so you can build personalized per-user dashboards or public /open metrics pages with the same graphs. Amplitude dashboards are primarily designed for internal consumption by your team, not for embedding into your own product. * Integration and Compatibility GraphJSON has one-click integrations with Vercel, Segment, and Stripe, and since logging is a single JSON POST, any language or platform that can send an HTTP request works - no SDK required. Amplitude maintains an impressive catalog of SDKs and integrations, though wiring them in correctly is typically a bigger project than a single POST endpoint. * Pricing and Support GraphJSON's pricing is on its pricing page: free up to 5,000 stored events, then $12 per million stored events per month. Check that page for current metering details. No credit card or sales call is required to start. Amplitude has a free starter tier, but costs scale with monthly tracked users and larger plans go through their sales team - which can get expensive quickly as your product grows. Where Amplitude shines. To be fair: if you're a large organization that needs a governed event taxonomy, built-in experimentation, and a decade of enterprise feature development, Amplitude is the mature choice. Teams with dedicated data analysts will feel at home in its report suite. How to choose. Choose Amplitude when a broad product organization needs a mature suite for behavioral analytics, experimentation, governance, and collaboration. Choose GraphJSON when developers want a smaller surface, arbitrary JSON events, direct ClickHouse SQL, transparent stored-event pricing, or customer-facing embeds. Test the tools with the same event set and the five questions your team asks most often. The right choice is the one that reaches a trustworthy answer with the least ongoing ceremony. Founder and builder of GraphJSON.

Promptwatch review 2026: features, pros & cons. Jul 25, 2026 This Promptwatch review evaluates the tool's features and ability to track brand presence across ChatGPT, Gemini, Claude, and Perplexity. While Promptwatch tracks how brands appear across ChatGPT, Claude, Gemini, and Perplexity, then benchmarks that visibility against competitors. Aside from other highlighted limitations by users, the price points may not be suitable for SMBs, freelancers, and agencies seeking a more accessible all-in-one solution. Hence, alternatives like Rankpilot have become a go-to option offering stronger rank tracking, audits, content optimisation, and a more budget-conscious pricing point. What is Promptwatch. Promptwatch is an AI search visibility and Generative Engine Optimisation (GEO) tool that tracks brand mentions, citations, and visibility across AI models like ChatGPT, Claude, Gemini, Perplexity, and Google AI Overviews. Promptwatch targets marketing teams, SEO professionals, and agencies who need to understand AI-driven search behaviour beyond traditional Google rankings. Its core value proposition centres on tracking prompts, analysing citations, and identifying content gaps across multiple AI platforms simultaneously. Core features of Promptwatch. * Prompt tracking: It monitors users' prompts and flags when AI engines mention the brand in their responses. * Citations analysis: The tool shows which sources AI engines cite when discussing a brand, including third-party mentions on Reddit and YouTube. * Agent analytics: Promptwatch tracks how AI agents and assistants interact with a brand's content, available on Professional and Business tiers. * Content agent: It generates AEO (answer engine optimisation) articles, though the number of articles is limited by tiers. * Sentiment analysis and content gap analysis: The tool evaluates how AI engines characterise a brand and identifies topics where visibility is weak * Integrations: Promptwatch also connects with Cloudflare, Fastly, Vercel, and other hosting/CDN providers. Pros and cons of Promptwatch. Pros. * It tracks AI visibility across ChatGPT, Claude, Gemini, and Perplexity. * It has a clean, intuitive interface (though some users reported otherwise) * It offers a free trial * It has a built-in article generation feature (5/month, 15/month, or 30/month depending on the pricing) * It offers country, state, and city-level tracking. Cons. * Users shared that the UI is complex and has a steep learning curve for new users * Reported UX bugs with limited escalation paths * Starting at $95/month, may be expensive for small businesses * Content generation quality rated as weak by users * The reporting depth and accuracy consistency require improvement * According to users, the Answer Gap report can be difficult for non-SEO professionals to interpret Promptwatch pricing. Promptwatch offers three primary subscription tiers alongside a 7-day free trial. For small businesses that don't need deep AI-driven visibility analytics or need more consistent content to support their growth, a $95 starter plan may offer less value than an all-in-one SEO/GEO tool like Rankpilot at $59/month. Promptwatch user testimonials. Positive reviews. Users highlight that the tool is very elaborate, giving very useful recommendations on how to improve visibility within AI tools. A user notes the content gap feature "showed us we weren't showing up in responses because we were missing specific topics" Negative review. On the other hand, a 60-day hands-on evaluation by Generate More (across 8 other SaaS clients) shared that: "Promptwatch has more UX errors and bugs than other solutions. There is currently no way to escalate and resolve them. We're seeing an increasing amount of bugs in the user interface that can't be dismissed or flagged. This means some core reports we share with customers are faulty." Other user testimonials share that the generated content/articles are weak. Promptwatch vs. Alternatives. Final verdict. Promptwatch offers excellent AI visibility tracking across multiple AI models, with unique features such as crawler log analysis and built-in content generation, though reported UI bugs and weak content warrant caution. For teams needing broad AI model coverage and technical crawl insights, Promptwatch justifies its mid-tier pricing. However, small businesses without dedicated SEO resources may find the learning curve and cost too much. Hence, a top Promptwatch alternative you can opt for is Rankpilot, which offers a more affordable all-in-one SEO/GEO suite including content automation and AI visibility tracking at $59/month.