May 2026 monthly summary focused on reliability and security improvements in database migrations for hashtopolis/server. Implemented a critical bug fix to secure DSN construction by URL-encoding user credentials and shell-escaping exec() arguments, ensuring safe handling of special characters in both MySQL and PostgreSQL DSNs. This reduces startup failures caused by DSN corruption and credential leakage risk during server initialization. Key changes address a vulnerability where DSNs were built by string concatenation and passed unquoted into system calls, which could break startup when credentials contained URL- or shell-special characters. The fix applies rawurlencode() to userinfo and escapeshellarg() to exec arguments, covering both database backends. This work strengthens stability, security, and maintainability of the startup and migration workflows, aligning with reliability and security goals for production readiness.