标签：#dev

Every AI coding tool can write Python — Cursor, Claude Code, Windsurf. None of them can run it safely in production. That gap between "AI wrote the code" and "the code ran safely" is exactly what I'm building jhansi.io to close. This series documents the journey. One layer of the problem at a time. The execution gap When AI generates code, four things still stand between you and prod: Dependencies — Install the right packages, with versions and licenses you trust Isolation — Run it hard-sandboxed. No host access, no outbound network, no surprises Secrets — Let AI use your API keys without ever letting it see or leak them Audit — Log every execution. Prompt, code, result, timestamp. Compliance-grade. Most teams stop at step 1. Banks and fintechs can't. FCA, SOC2, and the EU AI Act require audit trails for AI actions. You can't eval() your way through an audit. jhansi.io is the missing run() for AI-generated code. Open core, cloud sandbox, built to close each part of the gap — layer by layer. The series Part 1 — Persistent sandboxes Why "ephemeral" breaks debugging, state, and compliance. The case for giving every AI a home directory. → Read Part 1 Part 2 — Dependency management (coming soon) Detecting, installing, and locking deps across Python, Node, Go, and Java. With SBOMs and policy built in. Part 3 — Isolation (coming soon) What "hard isolation" actually means. Containers, Firecracker, zero trust networking, and the metadata service attacks you haven't thought of yet. Part 4 — Secrets (coming soon) Kernel-level proxies. AI can call Stripe without the key ever entering the sandbox. Part 5 — Audit (coming soon) Who ran what, when, with which prompt. Hash-chained logs that satisfy auditors, not just engineers. Building this in public. Follow the series on Dev.to , Linkedin , and X . Code is Apache 2.0 at github.com/jhansi-io .

Hi everyone, I’m building Penform, a browser-based tool that turns handwriting into a real installable OTF font. The idea came from seeing people use AI tools to recreate handwriting for personal cards and notes. The results can be touching, but the workflow felt backwards to me. Personal handwriting should not require a black-box model, a server upload, a GPU, or a hidden training pipeline. Penform takes a more deterministic approach: Print an A4 Template or use a tablet Write characters into predefined Glyph Slots Upload a JPEG or PNG scan/photo Align four printed Alignment Markers Optionally add more filled templates for contextual alternates Review and optionally refine the extracted glyphs Preview the generated font in the browser Download an installable .otf Everything runs locally in the browser. There is no account, no upload, no OCR, and no AI. A TemplateManifest defines the page geometry, so the app knows where every Writing Box, Glyph Slot, Alignment Marker, and font metric reference is. The manifest is the source of truth instead of OCR or server-side inference. The part I’m considering open-sourcing is the browser engine behind it. It currently handles: image decoding and EXIF-normalized capture manual marker alignment homography-based perspective correction A4 warping at 150/300 DPI writing-box cropping from a Template Manifest thresholding and empty glyph detection glyph vectorization contour winding correction pixel-to-font-unit mapping OpenType font generation OTF validation before export per-glyph threshold, scale, offset, and rotation overrides I’m trying to figure out two things: Whether this engine is useful enough to open-source as a standalone package Whether the product itself is useful beyond my own use case It is not meant to replace professional font design software. The goal is narrower: preserve someone’s actual handwriting well enough that it becomes usable as editable text for cards, notes, labels, classroom materials, personal project

How Reinvoice Uses HMAC Signatures to Detect Invoice Tampering Every invoice sent through Reinvoice includes a cryptographic integrity signature. It is not a PDF stamp, a visual badge, or a checkbox. It is an HMAC-SHA256 hash generated from the invoice payload and a server-side signing secret. If signed invoice data changes after creation, Reinvoice can recompute the hash, compare it to the stored signature, and flag the invoice as potentially tampered with. Here is why we built it, how it works, and what we learned. Why Integrity Checks Matter for Invoicing Invoices are high-value documents. A single altered field could change a payment amount, tax calculation, client record, or audit trail. Most invoicing systems treat invoices as ordinary database records. That works for normal CRUD workflows, but it does not automatically prove that the invoice data being viewed today is the same data that was created and sent. Reinvoice adds an integrity layer. When an invoice is created, we sign the fields that define the invoice. Later, when someone verifies the invoice, we recompute the signature from the current data and compare it against the original stored signature. If the values do not match, the invoice is flagged. The Implementation The signature is stored in two places: on the invoice record in the database, and behind a public verification endpoint. import { createHmac , timingSafeEqual } from ' node:crypto ' ; const SIGNATURE_FIELDS = [ ' invoiceNumber ' , ' issuerName ' , ' clientName ' , ' totalAmount ' , ' currency ' , ' taxAmount ' , ' issuedAt ' , ' dueDate ' , ' lineItems ' , ' notes ' , ' subtotal ' , ' discountAmount ' , ' shippingAmount ' , ] as const ; export function generateInvoiceHash ( invoice : InvoiceData ): string { const payload = SIGNATURE_FIELDS . map (( field ) => { const value = invoice [ field as keyof InvoiceData ]; return ` ${ field } = ${ JSON . stringify ( value )} ` ; }). join ( ' | ' ); return createHmac ( ' sha256 ' , SIGNING_SECRET )

Hey DEV community! 👋 I built IMGVO — a free image tool that works entirely in your browser. What it does Convert JPG, PNG, WebP, AVIF, HEIC and more Compress images up to 90% without quality loss Crop, resize, rotate, watermark Works offline (PWA) Why I built it Most image tools upload your files to servers. I wanted something private and instant. Tech 100% vanilla JavaScript No backend, no server Works offline as PWA Privacy first No files uploaded to any server. Everything runs locally in your browser. 🆓 Free, no signup required. 👉 Try it: https://imgvo.com Would love your feedback! 🙏

Hello, I'm Shrijith Venkatramana. I'm building git-lrc, an AI code reviewer that runs on every commit. Star Us to help devs discover the project. Do give it a try and share your feedback for improving the product. Large Language Models have made it surprisingly easy to generate text. Building a reliable AI application, however, is a completely different problem. Once you move beyond a simple "send prompt, get response" demo, you quickly encounter real-world concerns: Prompt management Structured outputs Multi-step workflows Tool calling Observability Evaluation Model switching Production debugging Many teams end up creating custom frameworks around OpenAI, Anthropic, Gemini, or local models just to manage these concerns. This is where Genkit comes in. Originally developed by Google, Genkit provides a framework for building AI-powered applications with a focus on workflows, tooling, observability, evaluation, and production readiness. While most examples online focus on Node.js, Genkit now has growing support for Go, making it an interesting option for backend engineers who want AI capabilities without introducing an entirely separate application stack. In this article we'll build practical examples and explore how Genkit helps structure real-world AI systems. Why Genkit Exists Most AI applications evolve like this: Phase 1: response := callLLM ( prompt ) Everything seems simple. Phase 2: You need: Retry logic Prompt versioning JSON outputs Tool integrations Tracing Metrics Human review workflows Now your codebase starts accumulating AI-specific infrastructure. Genkit attempts to provide these building blocks from day one. Think of it as: "Spring Boot for AI workflows" rather than "an LLM SDK." Installing Genkit for Go Create a new project: mkdir genkit-demo cd genkit-demo go mod init github.com/example/genkit-demo Install Genkit: go get github.com/firebase/genkit/go/ai Depending on your provider, you'll also install provider plugins. For Gemini: go get github.com/fi

I just launched Kotobato on Google Play after about two and a half years of solo development. It's a word puzzle RPG — you swipe connected letters on a board to form words, and those words become attacks. Longer words deal more damage. Rarer words hit harder. I want to share what I built, why I built it this way, and what surprised me most during development. The core mechanic The board is a grid of letters. You swipe a path through connected letters to form a word. When you submit the word, it becomes an attack against the enemy. The twist: word length isn't the only thing that matters . The game has six elemental types — Animal, Nature, Knowledge, Food, Life, and Fantasy — and each word is categorized into one of these elements. Enemies have elemental weaknesses, so the right word beats a long word if you're hitting a weakness. This created an interesting design problem. In most word games, you're just maximizing point value. In Kotobato, you're making tactical choices: do I use a short word that hits a weakness, or a long word that deals raw damage? Why hiragana and English both work The game runs in both Japanese (hiragana) and English. This wasn't a late addition — it was part of the original design. Japanese hiragana is a syllabic script with 46 base characters. Because each character represents a whole syllable rather than a single phoneme, even short hiragana words feel phonetically "weighty." A 4-character hiragana word might correspond to an 8-letter English word in spoken syllables. This means the game feels different in each language — not just translated, but genuinely different. Japanese mode rewards knowledge of vocabulary that uses phonetically distinctive combinations. English mode rewards knowledge of unusual high-value words (think quixotic , ephemeral ). What I actually built 100-floor tower with escalating bosses, including historical Japanese figures like Oda Nobunaga and Toyotomi Hideyoshi Gacha character system — collectible characters with d

Built a GitHub profile badge that shows where your visitors are coming from I wanted something more interesting than a simple profile view counter, so I built GitViewsMap. Add the snippet to your GitHub profile README (given in repo below) The badge tracks profile visits, and clicking it opens an interactive map showing the approximate locations of visitors. The project is open source and already deployed, so you can use it right away by replacing YOUR_GITHUB_USERNAME with your GitHub username. A few questions: Would you put something like this on your profile? What stats would you want besides a visitor map? Any features you'd like to see added? Repository: Utkarsh-rwt/gitViewsMap https://preview.redd.it/yanbotpzap5h1.png?width=663&format=png&auto=webp&s=2eba0193e266ffb74f5cabaf193d54ac5933bc71 https://preview.redd.it/bk15wl70bp5h1.png?width=1908&format=png&auto=webp&s=a9848597b593935c0a8e40d8bbd4f5479d6e8f16 submitted by /u/UtkarshRawat7 [link] [留言]

I was writing Playwright E2E tests for a small Three.js platformer and hit a confusing issue. Game context: https://games.xgallery.online/forest-quest/ The game worked in the browser. But in headless Chromium, enemies barely moved, jumps looked inconsistent, and the boss test would sometimes fail for no obvious reason. The problem was requestAnimationFrame throttling. In a headless run, the page does not always get normal frame pacing. My game loop depended on rAF, so waiting 1 second in the test did not mean the game simulation advanced like 1 second of real play. The fix was to expose a manual frame step in the game. The test can call a small internal function that advances one frame with a controlled timestamp. Then the test helper advances the game in small steps. Instead of waiting one big second, it calls that frame step about every 50ms. That made the tests deterministic enough to check real gameplay behavior. Example observations from the full run: L2 mushroom patrol delta: 1.071 L6 boss HP sequence: [7, 6, 5, 4, 3, 2, 1, 0] Boss phase switched: true The funny part is that the boss model did not need to be loaded for this to work. The boss could be a Meshy model or a gray fallback box. For E2E, the important thing was the state machine, collision, HP, and portal reveal. I would be careful with this kind of hook in a serious public game. For this tiny project, it is a testing helper, not a scoring or account system. I used to think of browser game testing as screenshot-heavy. This project reminded me that sometimes the best test hook is just a safe way to drive the loop yourself. submitted by /u/Top-Cardiologist1011 [link] [留言]

I wanted a simple place to see what games come out this week without digging through ten ad-heavy sites. I couldn't find one I liked, so I built it. gamecalendar.es What it does: - Releases week by week — you can scroll forward/back through weeks - "Recent" and "Most anticipated" views - Metacritic + OpenCritic scores on each game - Gaming events & showcases with countdowns and stream links - English + Spanish, light/dark mode - Works on mobile Honest context: - It's a personal project, built by one person in my spare time. - Game data comes from IGDB. I'm not affiliated with any company or store. - It's completely free. No ads, no accounts, no invasive tracking (just privacy-friendly analytics, no cookies). - Stack is plain HTML/CSS/vanilla JS, a Postgres database (Neon), hosted on Vercel. No frameworks — I wanted it fast and simple. It's brand new, so there are rough edges and the database is still being filled out. Any feedback — features, bugs, things that feel off — is genuinely welcome. submitted by /u/zwrkly [link] [留言]

Hey [ r/webdev ]( r/webdev )! I just open-sourced the frontend for a tool I built to solve a very real (and timely) problem in the cannabis space. With the 2025/2026 federal hemp law changes coming (seeds will no longer freely cross state lines), growers need to know exactly what genetics are available in their state. So I created CI Seed Map — a fully interactive, data-heavy map of 1,039 breeders, seed banks, dispensaries, and cultivators across 27+ states. Live demo: https://seed-map.poweredbyci.live Repo: https://github.com/Shannon-Goddard/seed-map-usa Key features I’m proud of: • Dual UI modes: Location mode (filter by type/state, marker clustering) + Breeder mode (searchable list of 924 unique breeders → show every location carrying them with custom logo markers). • Priority stacking — when a spot carries multiple selected breeders, the top one’s logo shows with a green ring + “+N” badge. • Rich popups with brand logo grids (up to 12 + “+more”), strain highlights, and hand-written editorial notes. • “Find Me” geolocation with branded radius circle, live search, mobile-first responsive design (collapsible filters, hamburger nav). • Age gate + strong data protection: AWS API Gateway + Lambda serving private S3 data via time-limited HMAC-SHA256 session tokens (no static JSON exposure). Tech stack: • Leaflet.js 1.9.4 + MarkerCluster • OpenStreetMap tiles • Vanilla JS + responsive CSS (mobile-first) • AWS Lambda (Python 3.12) + API Gateway + private S3 • 700+ processed brand logos, Nominatim geocoding pipeline, Formspree forms The dataset was manually researched and verified (huge shoutout to the data side), but the map itself was built lightning-fast with Amazon Q Developer helping on architecture, token system, responsive bits, etc. Would love any feedback on the UX, performance, code structure, or ideas for future enhancements (e.g. more advanced filtering, user submissions, etc.). Especially curious how the logo marker + priority logic feels! 🌱 (21+ only, obviou

submitted by /u/pilcrowonpaper [link] [留言]

https://umigalaxy.com combines a media tracker and an imageboard style forum. Features: Markdown support for the imageboard Both anonymous and logged in support User mentions in the imageboard for logged in users Media tracker of anime, manga, tv shows, movies, games Treasure and achievement system where users can earn limited cards for contributing to the media database Clan system where up to 50 people can join a clan and up to 5 clans can form an alliance Direct Messaging system Friend system Android and iOS apps in development submitted by /u/AutoMick [link] [留言]

I often have to use different email addresses and SSH keys when working for different clients. Managing `.gitconfigs` manually was always a PIA so I created this little tool for myself to help me manage them. Github: https://github.com/sgolovine/crgc NPM: https://www.npmjs.com/package/@sunnygg/crgc submitted by /u/_fat_santa [link] [留言]

This field test was against Next.js. The issue was Next.js #94450: https://github.com/vercel/next.js/issues/94450 The reported problem involved production browser source maps when React Compiler and Turbopack were involved. The visible symptom was that the final browser source map could expose transformed compiler output instead of preserving the original client source content. That matters because source maps are not just debugging extras. They are provenance artifacts. They tell the developer what source the browser output came from. If a source map claims to represent a source file but its sourcesContent contains compiler-transformed output instead of the original file content, then the debugging artifact has drifted from the source truth it is supposed to preserve. The useful diagnostic boundary was: original client source → transform source map → Turbopack source-map composition → final browser chunk map The important proof was that the Babel/React Compiler transform itself could produce a source map whose sourcesContent still represented the original client file. So the loss was not simply: React Compiler changed the code The sharper issue was: the browser source-map composition path was not preserving original source authority all the way into the final artifact That made the repair lane much narrower. The local repair candidate has two parts: Preserve the original loader input source in the Babel loader transform map. Fill missing source-map file provenance from the origin path when an incoming transform map omits it, so Turbopack has enough identity information to match the transform map back to the generated intermediate file during composition. The goal is not to rewrite source-map behavior broadly. It is not to patch the final browser map after the fact. It is to preserve source authority at the point where the transform map is composed into the browser artifact. A regression fixture was added around a React Compiler client component with an original sou

Most meeting tools help during a meeting, but the real challenge often starts before it. Users spend time searching for context, reviewing past interactions, and preparing discussion points. While building MeetMind, our goal was to make meeting preparation and follow-up simpler and more intuitive. As a frontend developer, I focused on designing user-friendly interfaces, building responsive components, and creating a smooth workflow from meeting preparation to post-meeting insights. In this article, I'll share the design decisions, frontend challenges, and lessons I learned while building the user experience behind MeetMind. How We Used Hindsight Memory to Make Our AI Meeting Assistant Actually Remember Things Hook I've been in too many meetings where I blanked on something a client told me weeks ago. You're sitting there, nodding, and somewhere in the back of your head you know they mentioned a budget number or a deadline — but you can't pull it up. That feeling is expensive. It erodes trust, slows decisions, and makes you look unprepared. That's the problem MeetMind was built to solve. And the hardest part of building it wasn't the AI — it was making the AI remember. What Is MeetMind — And How Does It Actually Work? MeetMind is a web application that functions as your AI-powered pre-meeting assistant. Here's the full user flow: Before a meeting: Type a contact's name, click "Get Briefing." The app retrieves everything stored about that person — notes, promises, project details — passes it to the LLM, and returns a structured briefing: a summary of past interactions, key reminders, and conversation openers grounded in your actual history with them. After a meeting: Type your notes and click "Save." The system stores them under that contact's name for next time. Under the hood: Python + Flask backend, Llama 3.3 70B on Groq's inference API, and a JSON-backed memory layer modeled on the Hindsight architecture. The interface is intentionally minimal. Two panels, two act

Hey everyone! Our team and I (acting as a junior backend) recently finished rebuilding GlobeVM (an enterprise Cloud, IT, and Cybersecurity provider) from a traditional monolithic WordPress site into a Headless architecture. I wanted to share our entire journey, our tech stack, the massive headaches we faced, and the solutions we engineered. If you are planning a Headless WP build soon, grab a this might save you weeks of debugging! The Tech Stack Frontend: Next.js (App Router), React, deployed on Vercel. Backend: WordPress hosted on Cloudways (Purely as a headless CMS). Data Structure: Advanced Custom Fields (ACF Pro) + Custom Post Type UI (CPT UI). SEO: Yoast SEO Premium (via REST API). Caching: Vercel Edge Cache (ISR) + Redis Object Cache on Cloudways. During the development and deployment of this website we faced several issues containing the frontend stack itself and traditional features of WordPress. I tried my best to save them all and show them all up here for everyone so that we can discuss on every section of it, maybe we could reach to even something more special :) Challenge 1: The API Was a Mess ("BFF" Architecture) When we first started, we were using the default WordPress REST API. Our Next.js frontend was making 8 different fetch() calls just to build the Blog Homepage (fetching posts, authors, categories, tags, ACF fields, etc.). We were also using messy URLs like ?_fields=id,title,acf&_embed. The Solution: We built a Backend-For-Frontend (BFF). Instead of Next.js doing the heavy lifting, we wrote a custom PHP plugin in WordPress. We created a single master endpoint (/wp-json/gvm/v1/blog-home). WordPress ran all the complex database queries, bundled the Tags, Hero Article, and Categories into one beautiful JSON array, and cached it in RAM using Transients & Redis. Only one of WordPress default api was used for our categories. Result: Next.js made one fetch call. The page loads instantly.' Challenge 2: Handling Vector Icons & ACF Our design heavily re

I’ve been working on a small project: a zero-knowledge, E2EE audio chat that runs in a single PHP/JS file. No database, messages delete after 24h. I managed to solve the NAT traversal issues by switching from Trickle ICE to Vanilla ICE (wait-and-retry approach), which finally lets me call between a PC and a 4G phone. I’m curious—from a cybersecurity perspective, what are the biggest risks in a P2P architecture like this? Besides the obvious metadata leaks from the signaling server, what else should I be looking at to harden the privacy? Any feedback or "this is a bad idea because..." comments are welcome! v2v.site submitted by /u/Alternative-Claim-41 [link] [留言]

While designing the database and Product Requirements Document (PRD) for an online school project, I ran into a problem I was not expecting. The school had multiple subscription plans. For simplicity, imagine: Live Class Plan:₦50,000 per term Video On Demand Plan: ₦30,000 per term Hybrid Plan (Live Classes + Video On Demand):₦70,000 per term. Initially this looked simple. Students subscribe. System charges them. Done. Then I asked: What happens if somebody changes plans halfway through the term? Suppose: A student already paid: Live Class Plan ₦50,000 Two months later: They decide: Upgrade to Hybrid Plan Do we charge: ₦70,000 again? That would be unfair. Do we charge: ₦20,000 difference? Maybe. But what if they already used most of their subscription period? This question led me to something called: Proration What Is Proration? Proration simply means: Charging customers only for the portion they actually use. Instead of pretending subscriptions always begin and end perfectly. Proration tries to answer: "How much value remains in the current subscription?" and "How much should the customer pay for the new one?" Simple Example Assume: Term Length: 100 Days Student buys: Live Plan ₦50,000 After: 40 Days they upgrade. This means: Used: 40 Days Remaining: 60 Days Value remaining: Remaining Value = Remaining Days / Total Days = 60 / 100 = 60% Remaining credit: 60% × ₦50,000 = ₦30,000 Hybrid costs: ₦70,000 Therefore: Amount to bill = New Plan Price − Remaining Credit = ₦70,000 − ₦30,000 = ₦40,000 Student pays: ₦40,000 instead of: ₦70,000 This feels fairer. Downgrades Are More Complicated What if: Hybrid user: ₦70,000 moves to: ₦30,000 plan Should the system: Refund money? Create account credits? Apply discount later? Ignore downgrades until renewal? This is where: Proration Rules become important. What Are Proration Rules? Proration calculations are useless without rules. The business must decide: Rule 1: How Is Remaining Value Calculated? Options: Daily basis Weekly basis

Last time I posted this game the UI looked totally different and the UX was honestly pretty rough. I'm happy with where it's at now, but the colors keep bugging me and I can't tell if it's just me staring at it too long. Quick context on what you're seeing: it's a roguelike where you pick a few technologies and use them to answer quizzes. Combos, multipliers, mods, the usual. The cards in the middle are Strikes, basically quiz minigames, and each one is tied to a tech like React, Next or Postgres. The card's color is how you tell which tech it is, so the palette is doing actual work, not just decoration. The bar at the bottom is the Mods Bar. Mods are one off modifiers you pick up during a run, like the cards in a deckbuilder. So: does it read as too much, or is the color earning its place? Roast it. submitted by /u/mister_pizza22 [link] [留言]

This is a submission for the June Solstice Game Jam What I Built Solstice Cipher: Enigma of the Longest Day is a browser-based puzzle game built around the Caesar cipher — the same substitution cipher technique used in ancient cryptography. On the theme of the June Solstice, I tied the longest day of the year to an Enigma Machine-inspired challenge: decode encrypted messages before time runs out, with the difficulty scaling as the sun climbs higher. The game features a real-time animated sky that shifts through dawn, noon, and dusk to reflect the solstice theme. Players are given a cipher shift key and must decode encrypted phrases by working through the Caesar cipher manually or by reasoning out the pattern — no brute-force tools allowed in-game. This connects to the June Solstice theme because the game is literally set on the longest day: the puzzles grow harder as the day progresses, and the sky animation mirrors real solstice light from sunrise to sunset. Video Demo Play it here: gtxpoffic-developer.github.io Code GTXPOFFIC-developer / Solstice-Chiper-Enigma-of-the-Longest-Day This is a Enigma based June Solstice game feel free to include your own code or tinker this project just mention the orignal developers name pls Solstice Cipher — Enigma of the Longest Day A browser-based Enigma machine puzzle game set on the June solstice. Decode (or encode) encrypted transmissions before the daylight runs out. Built By Sudipto — Original developer Feel free to fork, tinker, and include this in your own projects. Just mention the original developer's name. How to Play Objective Configure the Enigma machine correctly to decode each level's ciphertext (or encode the plaintext) before the sun sets. Each wrong guess costs 45 minutes of daylight; correct guesses pause the timer for 30 seconds. Controls Control What it does Rotor dropdowns Select which 3 rotors (I–V) are used ▲ / ▼ buttons Adjust each rotor's starting position Plugboard Drag from one letter to another to connec