My PostgreSQL database got nuked lol

A developer running a self-hosted PostgreSQL instance discovered their database was wiped twice by a bot. The root causes were: the database port was publicly exposed due to Docker's default behavior of bypassing host firewall rules, and the VPS had no UFW firewall installed. The default postgres:postgres credentials made it trivial for a bot to access and delete the data, leaving a ransom note. The fix involved binding Docker ports explicitly to 127.0.0.1, installing UFW, and closing all unnecessary ports.