标签：#dev

Cindy Zhang discusses the evolution of XDS, a unified UI system powering 10,000+ internal tools. She shares actionable insights for architects and engineering leaders on managing large-scale community contributions, executing safe monorepo refactors using JS AST and AI codemods, mitigating breaking changes via feature flags, and expanding UI libraries into full-stack platform systems. By Cindy Zhang

submitted by /u/Impressive_Layer_867 [link] [留言]

submitted by /u/techie_e [link] [留言]

I'm working on a free SVG icon project called IconShelf and recently noticed something confusing. Analytics show decent traffic, but signups and conversions are much lower than expected. To investigate, I started reviewing sessions in Microsoft Clarity and found behaviour that makes me suspect that a significant portion of visits may be from bots, crawlers, or automated traffic. I'm already using Cloudflare Bot Management and several WAF rules. I'm curious how other developers handle this. What tools do you use to identify bot traffic? Do you rely on analytics, server logs, Clarity, or something else? How do you measure "real" traffic versus raw pageviews? Have you ever discovered that your actual human traffic was much lower than your analytics suggested? I'd love to hear what worked for you and any lessons learned from tracking user behavior and conversions. What is the solution from developer prospective? Here in the screenshot 70% are bots? https://preview.redd.it/19jsil0e5m6h1.png?width=2604&format=png&auto=webp&s=70591a9e33c635cfbaacc64c9af1b5800b6e2e74 submitted by /u/Parking_Pea5161 [link] [留言]

Background: I accidentally created a recursive loop with an AI agent that would have cost me $50+ in API calls before I noticed. Existing tools either cost money or only show you what already happened. So I built TokenFirefighter — a 100% free, local-only HTTP proxy. What it does: - Sits between your app and OpenAI/Anthropic on localhost:7272 - Tracks every API call cost in real time - Detects 4 types of runaway loops and blocks them - Has a terminal dashboard (no web UI needed) - Zero accounts, zero data collection, zero cost Install: npm install -g tokenfirefighter tokenfirefighter init tokenfirefighter start Then just set OPENAI_BASE_URL=http://localhost:7272/v1 in your .env. Would genuinely appreciate feedback from anyone who uses AI APIs regularly. GitHub: https://github.com/MohitBaghel24/tokenfirefighter submitted by /u/AdventurousMirror122 [link] [留言]

Title. I've looked and looked but found nothing. submitted by /u/yduow [link] [留言]

This is a submission for the June Solstice Game Jam What I Built Bletchley is a web codebreaking game set at Bletchley Park, 1939–1945. You play as an anonymous codebreaker in Hut 6. Your job: decrypt intercepted Enigma messages by adjusting mechanical rotors before time runs out. The game spans 4 levels across two cipher types — Caesar and rotor permutation. Early levels introduce the mechanics with a single rotor and generous time. By level 4, you're working with three rotors (two already solved by your colleagues), 90 seconds on the clock, and a hint you have to earn by clicking. The hint system mirrors a real codebreaking technique: cribs — words known to appear in the plaintext. Players use them as anchors, sweeping the rotor until the word surfaces in the decrypted output. That's exactly how Turing's team worked. Between each level, the screen goes quiet and a narrative fragment appears. No UI, no score — just text. Together they tell Alan Turing's story in chronological order: his arrival at Bletchley in 1939, breaking Naval Enigma in 1941, the classified silence after the war, and then 1952. The game doesn't end on victory. That's intentional. Theme connection: The game honors Turing on two registers — the mechanics recreate the known-plaintext attack his team developed, and the narrative tells his full story, including the parts history preferred to forget. June is also Pride Month. That's not incidental. Video Demo Note on the video: Due to a dental procedure, I wasn't able to record a voiceover. The narration was AI-generated. The gameplay, code, and everything else in the demo are entirely my own work. Code cristianrubioa / bletchley Web codebreaking game inspired by Alan Turing and the Enigma machine bletchley — A Turing Tribute Codebreaking game · June Solstice Game Jam 2026 · Best Ode to Alan Turing You are a codebreaker at Bletchley Park. Decrypt intercepted messages by adjusting Enigma rotors before time runs out. 4 levels · 2 cipher types · histori

Breaks down package managers as different dependency models rather than "faster npm replacements". It compares npm, Yarn, pnpm, Bun, and Deno through reproducibility, compatibility, disk usage, and migration failure modes. submitted by /u/OtherwisePush6424 [link] [留言]

I didn't set out to build a content API. I set out to stop copy-pasting. Every week, the same ritual: open a doc, stare at a blank page, write a headline, delete it, write it again. Multiply that by every client, every product page, every email drip campaign. I wasn't doing creative work — I was doing assembly-line work while pretending it was creative. PostAll started as a script I wrote to stop doing that. The API is what that script became after other developers asked if they could use it too. This guide walks you through integrating PostAll's API into your own workflow — authentication, the endpoints you'll actually use, real working code in both Python and Node.js, and the specific places things will break before they work. By the end, you'll have a functioning pipeline that generates formatted, CMS-ready content programmatically. What you'll build A script that takes a list of content briefs (keywords, tone, target length) and returns publish-ready content — with proper formatting, metadata, and error handling for the rate limits you'll hit in production. Here's the shape of what you're building: [ CSV of briefs ] → [ PostAll API ] → [ formatted content objects ] → [ your CMS / database ] The full working code for both languages is at the end of each section. I'll explain the interesting parts inline. Prerequisites A PostAll account with API access enabled (free tier works for this guide — rate limits noted below) Node.js 18+ or Python 3.10+ Basic familiarity with async/await in either language An HTTP client: axios or native fetch for Node, httpx for Python Step 1: Authentication PostAll uses API key authentication. Every request needs your key in the Authorization header. Get your key: Dashboard → Settings → API Keys → Generate New Key Store it as an environment variable. Never hardcode it. export PostAll_API_KEY = "postall_live_xxxxxxxxxxxxxxxxxxxx" Your key has two prefixes: postall_live_ for production, postall_test_ for the sandbox. The sandbox returns r

https://dsa-life-simulator-frontend.vercel.app"I made a free tool to make DSA practice feel like an RPG — would like feedback from this community"Been grinding DSA for months and it never felt fun. So I built something. What it does: 🏟️ Real-time 1v1 Arena battles against other devs 🧪 Lab to create and publish your own challenges 🏘️ Community Hub to attempt others' challenges 📖 AI writes your weekly coding journey as a life story 🎮 XP, credits, levels, leaderboards Stack: React + Tailwind + Firebase + Node.js + Socket.IO + Groq AI Still early — would genuinely love feedback from people who've felt the pain of traditional DSA prep.

AI coding tools are changing how software gets built. Claude Code, Cursor, GitHub Copilot, Windsurf and other tools can generate code incredibly fast. For small tasks, they are already useful: write a component, explain a function, scaffold an endpoint, create a test, refactor a file. But after using AI in real projects, one thing becomes obvious: The problem is no longer code generation. The problem is engineering control. Most AI coding workflows still look like this: text idea -> prompt -> code -> fix -> prompt again -> more code -> lost context -> start over It feels fast at the beginning. Then the project grows. Requirements change. Architecture decisions disappear inside chat history. The AI forgets previous context. You start acting as product manager, architect, reviewer, QA, DevOps, and prompt engineer at the same time. That is not software engineering. That is vibe coding. ## Vibe coding works until it doesn't Direct AI coding is great when the task is isolated. Ask for a React component. Ask for a SQL query. Ask for a utility function. Ask for a unit test. No problem. But real software is not a collection of isolated snippets. Real software has: - business rules - architectural constraints - existing patterns - security concerns - database impact - deployment requirements - edge cases - regression risk - long-term maintenance When AI jumps directly from prompt to code, it often skips the thinking that should happen before implementation. The result may compile. But does it fit the architecture? Does it respect the domain? Does it create hidden technical debt? Does it solve the right problem? That is the gap we are trying to close with N45.AI. ## What is N45.AI? N45.AI is a framework that turns AI coding tools into a structured engineering workflow. It works with the tools developers already use, including Claude Code, Cursor, GitHub Copilot, and Windsurf. The idea is simple: Instead of treating AI as one generic assistant, N45.AI organizes the work like a

My daughter Emma is 11. She's been vibe coding lately, and honestly, she's pretty good at it. The...

Audit thousands of passwords against data breaches — completely in your browser with zero-knowledge privacy. Published: June 9, 2026 TL;DR Most bulk password checkers require you to upload your entire vault. Utilora’s Bulk Password Breach Checker uses HIBP’s k-anonymity + local hashing so your passwords never leave your device . The Hidden Risk Most People Ignore Using a password manager is excellent, but it’s not enough. Many users unknowingly reuse or slightly modify passwords that have already been leaked in massive breaches (LinkedIn, Adobe, Yahoo, etc.). Manually checking hundreds or thousands of passwords is impractical — which is why people turn to bulk checkers. The problem? Most bulk checkers ask you to upload your password list . That creates a massive new privacy risk. How Utilora’s Zero-Knowledge Breach Checker Works We built this tool using a privacy-preserving technique called k-anonymity (popularized by Troy Hunt of Have I Been Pwned). Step-by-Step Technical Process: Local Hashing — Your browser uses the WebCrypto API to create a SHA-1 hash of each password locally. Prefix Only — Only the first 5 characters of the hash are sent to HIBP’s Range API. Server Response — HIBP returns hundreds of matching hashes that start with the same prefix. Local Comparison — Your browser checks if your full hash exists in the returned list. Result: HIBP knows someone checked a password starting with ABC12 , but has no idea which specific password it was. Why You Should Audit Your Entire Vault Regularly Discover weak or compromised passwords you forgot about Clean up old reused passwords Respond quickly after major breaches Maintain good password hygiene across all accounts Real-World Scenarios You exported your Bitwarden / 1Password / KeePass vault You want to check 500+ passwords before a security audit You just heard about a new major breach and want to verify impact You’re helping a family member or client secure their accounts How to Use the Tool Go to the Bulk Pas

Hey everyone, I am a frontend dev and design engineer with about 4.5 years of experience. I am currently looking for a full time role. I am hoping to join an agency or a product team that actually cares a lot about good design. I love building modern and clean websites with a minimalist touch. My approach to work is just based on first principles. I always try to think about how Apple would make things. Good design is not really about what you add, it is about what you refine. Here is what I use to build things: My stack: React, Next.js, TypeScript, and Tailwind CSS. Animations: Motion and GSAP for really smooth interactions. How I work: I focus heavily on the design intent and the core architecture to build pixel perfect layouts and animations from scratch. You can check out my work here: My Portfolio: https://deepbuilds.in Recent Build (Autumn): https://autumndev.vercel.app If your team is looking for someone who sweats the small details and wants to build some really cool stuff together, drop me a DM. Let's talk! submitted by /u/Party-Membership-597 [link] [留言]

Keeping validation schemas, OpenAPI docs, and test fixtures in sync requires manual effort. I built TriadJS as a POC to consolidate them in one place. You define the API once using a TypeScript DSL. The framework derives the following: Runtime validation OpenAPI 3.1 & AsyncAPI specs Database schemas via Drizzle Boundary tests (calling scenario.auto() reads schema constraints to generate fuzz tests) This is a pre-1.0 project with specific architectural compromises: Auto-generated tests abstract away edge cases, which can complicate debugging. Designed for AI: It optimizes for single-file context so LLMs can read the API without traversing multiple YAML and test files. This prioritizes scaffolding over standard modularity. There is are built in claude plugin with skills (schema DSL, endpoints, channels, BDD behaviors with the authoritative assertion phrase table, testing, adapters, Drizzle, CLI, DI) and 8 slash commands ( /triadjs:new , /triadjs:model , /triadjs:endpoint , /triadjs:channel , /triadjs:scenario , /triadjs:test , /triadjs:docs , /triadjs:validate ). I am looking for feedback on this architecture. Is this level of tight coupling an anti-pattern, or is the single source of truth worth the DSL requirement? Repo: TriadJS submitted by /u/justhamade [link] [留言]

TLDR: we just launched free OpenClaw hosting. One-click deploy, no infrastructure to manage, only pay...

Hey DEV community! 👋 I'm Gamya, an iOS developer and new here on DEV. So excited to be part of my...

Hey everyone — I've been building The Drive AI, a file intelligence API, and wanted to share it. The problem: If you're building an AI agent, RAG pipeline, or any app that needs to understand documents, you end up duct-taping together 5-6 different libraries — one for PDFs, one for screenshots, one for Office docs, one for markdown conversion, one for OCR. Each breaks differently and none give you structured output. What this does: Send any file or URL, get structured JSON back. Define a schema of what you need, and the API extracts it with typed fields, confidence scores, and citations pointing to where in the document the data came from. 107+ file formats — PDFs, Office docs (Word, Excel, PPT), 40+ code languages, images, videos, websites. One API handles all of them. Not just extraction. You can also: Convert anything to clean markdown Generate screenshots of URLs (with device presets, dark mode, full-page capture) Ask analytical questions about documents and get reasoned, step-by-step answers Get Open Graph images for link previews What makes it different from competitor? Most "file to X" APIs do one thing — thumbnails OR markdown OR extraction. This handles the full pipeline. And the extraction isn't just OCR-and-dump — you define a JSON schema, and it returns typed data with confidence scores. Think of it as "SQL for documents." The simple path-based API is also something I haven't seen elsewhere: GET /md/example.com/report.pdf gives you markdown. GET /example.com gives you a screenshot. No auth needed for basic usage. Free tier: 100 credits/month, no card required. There's also an interactive playground where you can test every endpoint without writing code. Would love feedback from anyone building with documents or doing AI agent work. What's missing? What would make you switch from your current setup? Give it a try at https://dev.thedrive.ai submitted by /u/karkibigyan [link] [留言]

zxcvbn is the most widely used password strength estimator with 1M npm downloads a week. It's also 389KB gzipped and hasn't shipped a commit since 2017. Most sign-up forms are hauling that around just to block password123 . Poor password UX is a real conversion problem. A strength meter that adds 389KB to your bundle delays page load — on mobile, measurably so. Users who hit a slow registration page don't wait. They leave. The irony is that most of that weight goes toward catching passwords nobody is actually using to register on your site. So I built passcore - 3.0KB gzipped and 98.4% detection rate on real breach data - same as zxcvbn, benchmarked against a deduped list of passwords pulled live from RockYou, Adobe, HIBP, and other major leak lists. zxcvbn takes ~9.7ms to load — it's parsing 389KB of dictionary into memory on every cold start. passcore loads in ~0.2ms. It evaluates a password in ~2,600 nanoseconds. For a registration form, it's effectively invisible — no jank, no layout shift, no contribution to your Core Web Vitals score. The strength meter shows up before the user finishes typing their first character. How it works: passcore runs five detection layers on every password: Dictionary - All entries sourced directly from breach data, not a generic word list Keyboard patterns - qwerty , asdf , 1234 , numpad walks Repeats - aaaa , ababab Sequences - abcdef , 123456 L33t speak - decodes p@ssw0rd → password , m0nk3y → monkey , then dictionary lookup The dictionary is small by design. Every entry was chosen because it appears in real breach data - not because it's a common English word. Password1! is caught not by a 40k word list but by stripping the suffix and checking if the core word is in the breach list. It is. The scoring model: passcore returns a score from 0 to 4 - same scale as zxcvbn. The detection layers run first. A dictionary match, keyboard pattern, repeat, sequence, or l33t substitution scores 0 or 1 immediately - no further calculation. If

I automated my Gumroad product screenshots with Playwright I recently started packaging a few small frontend projects as digital products, and one surprisingly annoying part was preparing product screenshots. Manual screenshots quickly became messy: different browser sizes inconsistent cropping blurry images mobile screenshots were easy to get wrong Gumroad needed a square thumbnail every update meant taking screenshots again So I built a small local screenshot workflow with Next.js and Playwright. The workflow captures: desktop screenshots mobile screenshots square thumbnail images consistent PNG outputs route status checks basic console error reporting basic horizontal overflow checks The basic command flow is: npm run build npm run start npm run screenshots The script reads a simple config file, opens the configured local routes, captures each screenshot with consistent viewport settings, and exports the images into a predictable folder. For example: screenshots/gumroad/ landing.png dashboard.png template-preview.png mobile-preview.png thumbnail.png I found this especially useful when preparing Gumroad product galleries, because I could regenerate all product images after every UI change instead of taking screenshots manually. This is not a hosted screenshot service. It is just a local source-code workflow for people who want to generate product screenshots from their own Next.js pages. I packaged the workflow as a small Gumroad product here: https://remix410.gumroad.com/l/screenshot-automation-kit Curious how other developers handle product screenshots. Do you take them manually, use Playwright/Puppeteer, or use a design tool workflow?