标签：#dev

This is a submission for the GitHub Finish-Up-A-Thon Challenge What I Built I built the Atomberg Goal Setting & Tracking Portal — a full-featured, role-based HR performance management system for Atomberg Technologies (a fast-growing Indian consumer electronics brand). The portal manages the complete employee performance lifecycle : 🎯 Goal Setting — Employees create goals with weightage, UoM type, and thrust area alignment. Business rules enforced: max 8 goals, total 100% weightage, minimum 10% per goal ✅ Manager Approval Workflow — Submit → Review → Approve / Return for Rework 📊 Quarterly Check-ins — Q1–Q4 progress logging with 4 UoM types (Numeric Min/Max, Timeline, Zero-is-best) 🚨 Escalation Monitor — Rule-based detection of overdue submissions, missing approvals, and pending manager reviews 📈 Analytics & Reports — QoQ trend charts, department-wise performance, thrust area distribution, CSV exports 🔒 Admin Governance — Cycle phase management, shared goal distribution, full audit logging Tech Stack: React 18 + Vite · Context API · localStorage (zero-backend demo) · Recharts · Lucide Icons · Custom dark glassmorphism CSS Demo 🔗 Live App: https://atomberg-goal-tracker.vercel.app/ 📁 GitHub Repo: https://github.com/anonomous29/atomberg-goal-tracker Quick Login Credentials Role Email Password Admin priya.sharma@atomberg.com admin123 Manager rajesh.kumar@atomberg.com manager123 Employee vikram.singh@atomberg.com emp123 What to try: Login as Admin → Go to Escalation Monitor → see rule-based alerts Go to Reports → QoQ Trends tab → see Q1 performance bar chart Login as Employee → Dashboard shows Q1 score donut + goal-level progress Login as Manager → See team check-in status and review Q1 feedback The Comeback Story This project started as a hackathon requirement — a Business Requirements Document (BRD) from Atomberg asking for a digital goal management system. The initial version had the core structure but was essentially an empty shell: blank dashboards on login, no check

I've been on OpenRouter for a side project for a few months and it's solid for prototyping, but the streaming latency and the pricing markup on models I could call directly started bugging me enough to look around. Curious what other people running real production traffic have settled on. submitted by /u/Quantum_Nest [link] [留言]

Hey everyone! I'm currently working on a landing page project with quite a few GSAP animations, some ThreeJS, all built with SvelteKit and hosted on Cloudflare. I'm working on this project with a designer friend who has some development knowledge. He can do HTML/CSS/JS and use GSAP. We often work together — he finds clients, handles project management, UI and UX, while I take care of the development side. Since I don't really have a strong "graphic eye", our usual workflow was: I lay the foundations, handle the animations, and let him come back over everything for easing and fine-tuning. Since AI came along, things have gotten a lot more complicated. Don't get me wrong — I use Claude myself to get oriented, review my code, analyse a project, or generate boilerplate code. But I always review the output. My friend, on the other hand, uses it in full vibe coding mode. I just got the latest version of this landing page where he'd pushed his changes, and I was pretty shocked. The code is massively over-engineered for no good reason, hard to follow, and a genuine nightmare to debug. Claude made everything far more complex than it needed to be. To avoid this kind of situation going forward, we've started putting a few ground rules in place: a mandatory review before any merge, and certain core files that only I touch. Not a perfect solution, but it helps keep things from spiraling. Has anyone else had the same kind of experience with vibe coding ? I mean, it does work, but the output feels bloated. Edit : As some people noticed it, i've used an AI to translate that text into english and re-phrase it, since i'm not really fluent in english (isn't that ironic lol). submitted by /u/frenchy_mustache [link] [留言]

submitted by /u/dreamnyt [link] [留言]

Supply chain attacks every other morning Unless you've lived under a rock for the last few months, you probably noticed that software supply chain attacks are getting trendy among threat actor groups. Over the last 12 months, we've seen more of those than ever before, to name only a few of them: tj-actions/changed-files : In March 2025, a popular reusable GitHub application workflow was compromised to dump secrets from CI/CD pipelines. Salesloft Drift : In August 2025, threat actors stole OAuth credentials from the compromised Drift chatbot application. Shai-Hulud : In September and November 2025, a wormed attack propagated through npm packages and collected secrets. The common thread among those incidents is that they all revolved around secrets, one way or another. Some used secrets as an initial access vector, and others were focused on collecting secrets from victim environments. March 2026 did not change the state of things, with two new severe attacks added to our dreadful collection: trivy-action & LiteLLM campaign by Team PCP. The most popular Axios package compromise. Both those attacks followed a now-classical pattern, spreading through compromised open-source dependencies to maximise the impact in the shortest possible time. Your all-time classic, now with added internal threats Open-source supply chain attacks are not new. Ever since we started using centralized open-source package registries, the risk has existed. Threat actors understood this and started exploiting it. What has changed since 2015 is how we have improved software development productivity through automation. And now, this very same automation that lets you test and build your projects without typing a single command is amplifying the supply-chain threat and the velocity of attacks. Let's see how. Keeping your malware up to date A very concerning pattern we've observed in the trivy-action and Axios campaigns is that automation can become the source of your compromise. One thing no develop

The Scenario: "Oops, I Made a Messy Commit History" Imagine you're working on a feature branch called feature/login-page . You’ve made a few commits, but now : One of the commits has a bug . Another commit has a wrong commit message . Your commit history looks like a jumbled mess compared to main . Time to clean it up! But… should you rebase , reset , or revert ? First, Let’s Understand the Core Idea of Each: Command What it Does Safe for Shared Branches? rebase Rewrites commit history to make it linear and clean No , unless used carefully reset Moves the HEAD and branch pointer to a different commit No , dangerous on shared branches revert Creates a new commit that undoes a previous commit Yes , safe to fix public history 1. Git Rebase : "Let’s Rewrite History Neatly" What is it? git rebase allows you to move or "replay" your commits onto another branch or rearrange them to make a clean, linear history. When to Use? You want to clean up messy commit history before merging. You want to squash commits . You want to change commit messages . Example: You have these commits in feature/login-page : A — B — C — D (feature/login-page) ↑ Buggy commit (C) You want to fix commit C and clean up the message in D . Solution: Interactive Rebase git rebase -i HEAD~3 You’ll see something like this: pick abc123 B pick def456 C pick ghi789 D You can now: Change "pick" to "edit" for C to fix the bug. Change "pick" to "reword" for D to fix the commit message. Squash commits if needed. Important: This rewrites commit hashes. If your branch is pushed and shared , rebasing can mess up others' history. Use with care! 2. Git Reset : "Let’s Go Back in Time (Dangerously Powerful)" What is it? git reset moves your branch pointer ( HEAD ) to a previous commit. It can unstage files , remove commits , or even delete code changes . Types of Reset: Command What happens? git reset --soft Keeps your changes staged. git reset --mixed Unstages changes but keeps them in the working directory. git reset

Read Time: ~14 minutes | Building on React fundamentals to master state management at scale Prerequisites : Familiarity with React basics, useState, useEffect (Part 1) 🔗 Series Navigation ← Part 1: Complete Guide from Zero to Production Part 2: Advanced Hooks & State Management ← YOU ARE HERE → Part 3: Performance Optimization (coming next) 📌 What You'll Learn By the end of this guide, you'll understand: ✅ Creating powerful custom hooks ✅ When and how to use useReducer ✅ Managing state globally with Context API ✅ Redux fundamentals and when to use it ✅ Modern alternatives: Zustand and Jotai ✅ Choosing the right pattern for your project ✅ Real-world shopping cart implementation 🎣 Custom Hooks: Reusing Logic Across Components Custom hooks are regular JavaScript functions that let you extract component logic into reusable functions. They're one of the most powerful React patterns. Rule #1: Custom Hooks Must Start with "use" // ✅ Correct - starts with "use" function useFormInput ( initialValue ) { const [ value , setValue ] = useState ( initialValue ); return { value , bind : { value , onChange : e => setValue ( e . target . value ) }, reset : () => setValue ( initialValue ) }; } // ❌ Wrong - doesn't start with "use" function formInput ( initialValue ) { ... } Example #1: useFormInput Hook import { useState } from ' react ' ; function useFormInput ( initialValue = '' ) { const [ value , setValue ] = useState ( initialValue ); return { value , setValue , bind : { value , onChange : e => setValue ( e . target . value ) }, reset : () => setValue ( initialValue ) }; } // Using the custom hook function LoginForm () { const email = useFormInput ( '' ); const password = useFormInput ( '' ); const handleSubmit = ( e ) => { e . preventDefault (); console . log ( email . value , password . value ); email . reset (); password . reset (); }; return ( < form onSubmit = { handleSubmit } > < input {... email . bind } placeholder = " Email " type = " email " /> < input {... password .

If you have ever run a Lighthouse audit on a content-heavy WordPress site, you know the usual verdict: "Serve images in next-gen formats." Translation: your JPEGs and PNGs are too heavy, and WebP would cut them down a lot. The problem is that nobody wants to convert images by hand, and most automated options either run as a bulk job you have to remember to trigger, or push your images to a cloud service with a monthly quota. I wanted something simpler: upload an image, get a WebP, done. So I built a free plugin called Pixellize Image Optimizer , and this post walks through the problem, how the plugin solves it, and how it works under the hood. Why WebP is worth it WebP files are usually 25 to 35 percent smaller than the equivalent JPG or PNG at the same visual quality. On an image-heavy page that is a real difference: Faster Largest Contentful Paint, which is one of the Core Web Vitals Google uses for ranking. Less bandwidth, which matters if you pay for CDN traffic. No visible quality loss at sensible quality settings. Browser support is no longer a concern. Every current browser handles WebP. The approach: convert on your own server, on upload Instead of a cloud API, the plugin converts images locally with the PHP GD or Imagick extension (almost every host has one). There is no account, no API key, and no paid tier. The core flow: You upload an image to the Media Library as usual. The plugin generates a WebP version of the full image and every thumbnail size. Your front end serves the WebP automatically. How it works under the hood For WordPress developers, here is the interesting part. The plugin hooks into the standard upload and rendering pipeline rather than fighting it: On upload, it taps into the attachment metadata generation so it can convert the full image and every registered sub-size, not just the original. That matters because responsive images use srcset , and a half-converted set defeats the purpose. On the front end, it rewrites image URLs to the We

In Part 14 , I finished HMAC webhook signing. The backend was complete — JWT auth, PostgreSQL, Redis caching, rate limiting, circuit breaker, worker pool, webhook delivery, migrations, Docker. All running locally. But "runs on my machine" isn't a portfolio project. It's a homework assignment. Time to ship it. The Stack Being Deployed Go backend — ~15MB Docker image (multi-stage build, CGO_ENABLED=0) PostgreSQL 16 — with golang-migrate running schema migrations on startup Redis — for caching, rate limiting, and refresh token storage Oracle Cloud Free Tier — 1GB RAM, 45GB disk, already provisioned Everything wired together with docker-compose.yml . One command to start the entire stack. Step 1: The VM Was Fine, Actually I was worried about the free tier specs. Turned out the "1GB" in the tier name refers to RAM, not disk. The actual disk is 45GB — plenty. free -h # 954MB RAM, 552MB available df -h # 45GB disk, 41GB free The real constraint: no swap . Go's compiler is memory-hungry. Without swap, building the Docker image on the VM would exhaust RAM and kill the process. More on this in a moment. Step 2: Install Docker curl -fsSL https://get.docker.com | sudo sh sudo usermod -aG docker ubuntu newgrp docker The official install script handles everything — Docker Engine, containerd, Docker Compose plugin. One command, done. Step 3: Clone the Repo The repo is private. Created a fine-grained GitHub personal access token with Contents: Read-only permission. Used it to clone: git clone https://TOKEN@github.com/absep98/Go_learn.git Security note: never paste tokens in chat, email, or anywhere visible. Type them directly into the terminal. Tokens in chat history are compromised tokens. Step 4: Create the .env File The .env from my local machine needed two changes for Docker: # LOCAL (wrong for Docker): DB_HOST = localhost REDIS_HOST = localhost # DOCKER (correct): DB_HOST = postgres # ← service name in docker-compose.yml REDIS_HOST = redis # ← service name in docker-compose.ym

The Cloud Native Computing Foundation has highlighted a new AI-assisted migration approach that enabled engineers to migrate 60 ingress-nginx resources to Higress in roughly 30 minutes, demonstrating how artificial intelligence is increasingly being applied to modernize Kubernetes networking and gateway infrastructure. By Craig Risi

Curious if anyone here has used it for anything serious. Is it holding up for larger projects or is it still more of a playground? submitted by /u/krrish82 [link] [留言]

I recently launched LuaPlay, a free browser-based Lua editor. No setup, no install — just open the site and write Lua. Why I built it: Every time I wanted to test a quick Lua snippet, I had to either open a local environment or use tools that weren't built for Lua specifically. So I built my own. What it does: Run Lua scripts directly in the browser Clean, minimal editor interface Free to use Would love feedback from the dev community. What features would make you actually use it day-to-day? 👉 https://luaplay.online

TL;DR -DevRelCon NYC returns to Industry City in Brooklyn on July 22–23, 2026. It's the flagship...

If you've ever built or set up a subscription experience on Shopify for a coffee brand, you've probably run into the same problem most merchants face: The signup flow works great. The first order goes out. And then subscribers start quietly disappearing before the third delivery. This isn't a coffee problem. It's a subscription infrastructure problem — and it's almost always caused by the same handful of missing pieces in the system underneath the storefront. In this guide I'll walk through the practical setup decisions that actually move the needle on retention for coffee subscription businesses on Shopify — from choosing the right model and pricing structure to the fulfillment calendar, dunning logic, and cancellation flow that most setups skip entirely. Why Coffee Works So Well as a Subscription Product Before getting into setup, it's worth understanding why coffee is genuinely one of the better products to build a subscription around — when the infrastructure supports it. Predictable consumption cycle. A 12-oz bag of whole beans lasts roughly two to three weeks for a single drinker. That natural rhythm makes it easy to design a billing and delivery schedule that matches actual usage patterns. Daily habit. Roughly two-thirds of American adults drink coffee every day. A subscription removes the friction of reordering, and that convenience compounds into real retention over time. Freshness as a retention argument. Coffee quality degrades noticeably after roasting. Subscribers who care about quality genuinely prefer a recurring shipment over buying retail — which means freshness becomes a built-in reason to stay subscribed that most product categories simply don't have. The global coffee subscription market reached $808.8 million in 2024 and is projected to surpass $2.2 billion by 2033. The infrastructure opportunity for developers and merchants building on Shopify is real and still early. Step 1 — Choose the Right Subscription Model Before You Build The model choic

This is a submission for the GitHub Finish-Up-A-Thon Challenge What I Built I built and revived Mandi Central , a complete business operations and billing system for mandi-style trading businesses. Live Project: https://mandicentral.in Mandi Central helps manage daily mandi operations like purchases, farmer purchase entries, sales entries, payments, bank and cash ledgers, accounting heads, reports, invoices, outstanding balances, and financial statements from one structured platform. This project was not started as a simple demo. It was a real business-focused software project, but it had many unfinished parts, broken flows, missing reports, pending PDF generation, incomplete mobile API planning, and several UI and accounting issues. For the GitHub Finish-Up-A-Thon Challenge, I brought it back, fixed the pending issues, completed the core business flow, and made the project live on mandicentral.in . Demo Live Website: https://mandicentral.in GitHub Repository: https://github.com/hiijoshi/bill Screenshots and demo cover the completed modules: Business Operations Hub Sales List Bank reconciliation Cash ledger Bank ledger Sales entry Purchase entry Farmer purchase entry Bulk PDF download Accounting reports Party ledger redirection Outstanding reports Mobile API-ready backend The Comeback Story Mandi Central started with a strong idea: create one platform where mandi businesses can manage their complete daily workflow. But before this challenge, the project was stuck with many incomplete and pending items. There were more than 40 pending issues across PDF generation, sales invoices, bank ledger, cash ledger, accounting reports, outstanding reports, purchase calculations, sales calculations, mobile APIs, AWS deployment, domain setup, and UI fixes. Some of the major problems before completion were: PDF generation was not working properly. Bulk sales bill download was missing. Mobile application APIs were pending. Farmer Purchase Entry API was pending. Purchase Entry API w

Over 51% of all GitHub commits in early 2026 are AI-generated or AI-assisted. That statistic creates a problem no one anticipated when AI coding tools first launched: who reviews the AI's code? The answer, increasingly, is another AI. The AI code review market has grown rapidly alongside vibe coding and AI-first development workflows. But the category is fragmented there are PR-level reviewers, IDE inline analyzers, security scanners, and general-purpose AI assistants all claiming to do "code review." They work very differently, and picking the wrong one for your workflow is a real productivity cost. This guide cuts through the noise. We explain what each category does, highlight the best tools in each, and give you a decision framework to help you choose what fits your actual situation. Why AI Code Review Is Now Essential Three converging trends make AI code review the category to watch in 2026: AI-generated code has real quality problems. Research shows 45% of AI-generated code fails at least one OWASP Top 10 security check, and 53% of developers have found security vulnerabilities in AI-written code. When you use tools like Cursor, Claude Code, or GitHub Copilot to write 80% of a feature, you're shipping code you may not have read line by line. Code review is a bottleneck. Stack Overflow's 2026 developer survey found code review wait time is the top-ranked productivity killer. For solo developers and small teams, reviews pile up and slow shipping. AI reviewers don't have calendars. The security stakes are rising. As more non-developers ship production code via vibe coding, the need for automated security checks compounds. AI review tools catch issues like SQL injection, CORS misconfigurations, and hardcoded secrets before they ship. Two Categories of AI Code Review Before picking a tool, understand that "AI code review" means two distinct things. 1. PR-Level AI Reviewers These run at the pull request level. When you open a PR on GitHub, GitLab, or Bitbucket, they

Hey everyone! I bring you my development journey on what I have discovered, accomplishments for this...

The moment I realized AI coding assistants were broken I was building a side project — a simple task manager app. I opened Claude Code, typed: "Add user authentication with email and password login" …and hit enter. Twenty minutes later, I had code. A lot of code. Authentication logic, routes, middleware, even some basic tests. But there was a problem. The frontend (me, on a different day) had assumed a different API shape. The tests only covered the happy path. There was no architecture decision to reference — I just picked JWT because it felt right. And the docker-compose.yml ? It didn't exist yet. I had AI-generated code, but no real software development workflow. What was actually missing Good software isn't just code. Before you write a single line, you need: A spec that everyone (including future-you) agrees on An architecture decision that explains the why Backend and frontend designed to talk to each other Tests that prove things actually work A code review that catches security holes before they ship A deployment config that someone can actually run Normally, a team handles all of this. A PM writes the spec. An architect proposes options. Engineers implement and review each other's work. A DevOps person sets up CI/CD. What if AI could fill all those roles? Building the pipeline I built claude-dev-pipeline — a Claude Code plugin that orchestrates a team of specialized AI agents, each with a specific job. airwaves778899 / claude-dev-pipeline 7-agent full-stack development pipeline plugin for Claude Code — PM → Architect → Backend → Frontend → QA → Reviewer → DevOps claude-dev-pipeline A Claude Code plugin that orchestrates 7 specialized AI agents to take your feature request all the way from requirements analysis to production deployment — with a human-in-the-loop checkpoint at every phase. 中文說明 Why? Writing a feature involves more than just code. You need: A clear spec that everyone agrees on An architecture decision before you write a single line Backend and

The Redefinition of "Frontend Engineer" in 2026 The era of the frontend engineer as a purely visual specialist is over. In 2026, companies like Vercel, Linear, Figma, Shopify, and major FAANG divisions expect their frontend engineers to think in terms of systems, not just components. A modern frontend engineer must understand rendering pipelines, browser internals, network optimization, and component architecture at the same depth that a backend engineer understands database indexing or API design. This shift is reflected directly in how companies interview frontend candidates. If you walk into a 2026 frontend interview expecting to answer "what's the difference between let and const ," you will be humbled. This guide covers everything you need to know to pass a senior-level frontend interview at a top tech company. Core Web Vitals: The Mandatory Topic You Can't Skip Google's Core Web Vitals have become a standard lens through which senior frontend engineers are evaluated. Interviewers now routinely ask candidates to diagnose performance bottlenecks using CWV metrics. The three primary metrics are: LCP (Largest Contentful Paint): Measures perceived load speed. Target under 2.5 seconds. Optimized via image preloading, server-side rendering, and CDN caching. INP (Interaction to Next Paint): Replaced FID in 2024. Measures responsiveness. Optimized by breaking up long tasks, using web workers, and deferring non-critical JavaScript. CLS (Cumulative Layout Shift): Measures visual stability. Prevents jarring layout shifts by pre-defining dimensions for images, iframes, and dynamic content. Be prepared to walk through a real-world scenario: "Given an LCP score of 4.2s, what is your systematic debugging and optimization approach?" This is now a standard senior frontend interview question. React 19 and the Concurrent Rendering Model React 19 introduced a fully concurrent rendering model that fundamentally changes how components behave. Key concepts interviewers probe in 2026

The Problem We Were Actually Solving Our event platform at Veltrix ran a treasure hunt game that gave users real-world rewards. It started as a simple Rails app with a PostgreSQL counter column for each hunt. By 3 AM on Black Friday, that counter column became a single point of failure. Every leaderboard update blocked the entire leaderboard query because PostgreSQL row-level locks escalated to table-level for SERIAL columns. Our error rate jumped from 0.2% to 18% under 2000 concurrent writes. The system didnt just slow down; it started failing writes with could not serialize access due to concurrent update deadlocks. We lost $47K in rewards payouts before we could scale up the database. What We Tried First (And Why It Failed) Our first fix was to shard the PostgreSQL counter by hunt ID, splitting the hot row into 1024 partitions. That reduced the lock contention, but introduced new problems. Each hunt now needed its own sequence, and our Rails code had to route writes to the correct shard. The shard routing introduced 400ms extra latency on leaderboard queries because we had to union results across 1024 tables. Meanwhile, PostgreSQL sequences had gaps up to 1024 when nodes restarted, so our reward payouts were off by thousands on high-traffic hunts. Our Redis cache didnt help because the leaderboard queries were point lookups against 1024 tables, and Redis couldnt pipeline those efficiently. The Architecture Decision We ripped out the PostgreSQL counter and replaced it with a Kafka Streams-based event sourcing system called HuntStream. Every hunt action (point earned, reward claimed) became an immutable event in a Kafka topic. We built a materialized view on top of RocksDB that consumed the topic and maintained the current leaderboard state in memory. The materialized view was partitioned by hunt ID, which meant leaderboard queries only hit one RocksDB partition per hunt. We used RocksDBs built-in caching to keep hot leaderboards in memory, and fall back to disk fo