标签：#ev

By the end of this article, you'll know: what Kimi K3 actually is, the architecture, the scale, and what changed from the K2 family how to run it today, free in the browser, through the API, or wired into Claude Code, Cursor, Cline, and RooCode which exact model ID and settings unlock the full 1 million token context how K3 stacks up on price and benchmarks against DeepSeek V4, Qwen3.7 Max, GLM-5.2, and its own sibling K2.7 Code whether switching today makes sense, or whether you should wait Kimi K3 just dropped, and Moonshot means business Moonshot AI released Kimi K3 on July 16, 2026, timed just ahead of the World Artificial Intelligence Conference in Shanghai. The Beijing lab, backed by Alibaba, has spent the past 18 months watching DeepSeek erode its market position. K3 is the comeback attempt, and the early numbers back it up. The headline result: K3 debuted at number one on Arena.ai's Frontend Code Arena with a score of 1,679, ahead of Claude Fable 5 at 1,631 and GPT-5.6 Sol at 1,618. Its predecessor, K2.6, sat 18th on that same board. That's a 17 spot jump in one release, and it's independently measured, not a number Moonshot invented itself. This isn't Moonshot's first time in Western production stacks either. Cursor built its Composer 2 model starting from a Kimi K2.5 base. DoorDash's CTO has said the company routes lower level work to Kimi K2.6. Thinking Machines used K2.5 to help generate early post-training data for Inkling, its own model released just a day before K3. So when a new Kimi flagship lands, it lands somewhere developers already have skin in the game. For developers, the practical story matters more than the leaderboard. K3 is open weight, speaks the OpenAI SDK, and drops into tools you already use. It's also, for the first time in Kimi's history, priced like a frontier model instead of a budget one. That changes the calculus on when it's actually worth reaching for. What Kimi K3 actually is K3 is a sparse Mixture-of-Experts model with 2.8 tr

AI coding agents have dramatically shortened the distance between an idea and working software. They can inspect a project, create files, run commands, write tests, and help diagnose failures. What they have not eliminated is judgment. A polished screen is not proof that data survives a reload. A passing unit test is not proof that keyboard users can complete the core task. A successful deployment is not proof that the intended commit reached production. This is why I use proof gates : observable conditions that must be satisfied before a product claim becomes stronger. A proof gate is not a meeting, a long document, or an excuse to slow down. It is a compact question: What evidence would let another person verify that this claim is true? Here are five gates that separate a persuasive AI demo from a small MVP you can responsibly ship. Gate 1: Prove One Valuable User Loop AI makes feature generation cheap, which makes uncontrolled scope especially dangerous. Before requesting code, define one primary user in one specific situation. Then describe: Their observable before-state The smallest useful action they can take The immediate result The reason they might return This becomes the product’s core loop. For example, “build a productivity platform” is too broad. A more testable loop might be: A freelancer remembers a useful client outcome. They record the outcome and supporting evidence. The record appears in a searchable library. They can retrieve it later for a proposal or review. The gate is not passed because a form exists. It is passed when a new user can complete the entire loop and explain what changed without coaching. Write a Not Today list alongside the required capabilities. Authentication, dashboards, collaboration, billing, and AI-generated summaries may all be reasonable later. They should not compete with proof of the first useful loop. The goal is not the fewest possible features. It is the smallest complete behavior that tests whether the product creat

AWS has recently introduced CloudFormation express mode, a deployment option that can reduce infrastructure deployment times by marking stack operations complete once resource configuration is applied, rather than waiting for full resource stabilization. By Renato Losio

TL;DR In December 2025, Cline — an AI coding assistant with over 5 million users — gave an AI agent (Claude) write access to triage GitHub issues, including permission to run shell commands. A misconfigured trigger condition let any GitHub user invoke the workflow. What followed was a four-hop supply chain compromise that ended with a malicious npm package silently installing a second AI agent on user machines. I broke down the full chain in video form: Watch the episode Below is the chain, hop by hop. Hop 0: The setup The triage automation was configured with broad tool permissions and a trigger condition open to any GitHub user — not just contributors. That second part is the root cause: it opened the trigger to unauthenticated input. (Exact config values are in the Confirmed Artifacts section below.) Hop 1: Prompt injection via issue title The issue title itself was never sanitized before reaching the model. No first-party source has published the exact injected payload verbatim — GHSA doesn't disclose it — so any reconstruction here is illustrative, not confirmed. What's confirmed is the mechanism: an untrusted string reached the model with tool access already granted. Hop 2: Cache poisoning The injected instruction deployed a tool (multiple independent postmortems — Snyk, Cloud Security Alliance — name it "Cacheract") that flooded the CI cache with over 10GB of junk data, evicting legitimate entries through standard LRU eviction. Hop 3: Nightly workflow inherits the poisoned cache The nightly release workflow restored that poisoned cache around 2 AM UTC and ran inside it — handing over three publish tokens. (Names confirmed across GHSA and multiple independent sources — see below.) Hop 4: Publication cline@2.3.0 went live on npm with a postinstall script that silently installed a second package globally — an AI agent, installed by an AI agent, with no user consent. This line is a direct quote from Cline's own security advisory, not a reconstruction. It's the st

Before I critique modern web development, I want to make some points: I'm not discouraging anybody from web development. This is only my opinion and my experience of the story. Everyone has their own story. Part 1. Javascript JavaScript is known for being the web's language. It's used everywhere in the web, and can also be used to make external applications outside of web development. JavaScript has many flaws in its language, such as its comparison logic. JavaScript uses the "strict equality operator" that tries to solve its weird type coercions (e.g [] == ![] being true). Another flaw is that JavaScript has poor maintainability. JavaScript has a poorly managed type system that introduces errors without proper error handling. You cannot explicitly define what error you're trying to catch in the try-catch statement. try { functionThatThrowsError () } catch ( error ) { console . error ( error ); if ( error instanceof MyError ) { doSomething (); } } instead of modern languages: try { functionThatThrowsError () } catch ( e : MyError ) { print ! ( " error: ${e.message} " ) } This adds complexity to try-catch statements and makes it almost impossible to handle errors in a robust manner. Another issue with JavaScript's maintainability is the wording of the language. JavaScript has two keywords called undefined and null . In practice these should mean the same thing but it doesn't. An undefined variable is an uninitialized variable, or a function that doesn't return anything. Undefined: // Returns undefined function getName () {} // syntactically correct in JavaScript // but will cause undefined console . log ( getName ()); const myCoolObject = {}; console . log ( myCoolObject . property ); // still syntactically correct in JavaScript even though the property doesn't exist. Null: // Returns a null name function getName () { return null ; } // output: null console . log ( getName ()); const myCoolObject = { property : null }; console . log ( myCoolObject . property ); //out

I don lose count of how many times I don see this kind yarns online: "Backend development na just CRUD. Everything else na decoration." And honestly? I sabi why people dey talk am. E no kuku wrong. E no just complete, na like when person say "cooking na just to heat food." Technically, e dey true. But e dey miss almost everything wey make am skill. Make I carry you waka through wetin I mean, using something wey all of us don do before: to order food for app. First, Wetin CRUD Really Be CRUD mean Create, Read, Update, Delete, na the four things you fit do to any piece of data. Operation Wetin e dey do Normally e go be Create Add new data POST /orders Read Fetch existing data GET /orders/482 Update Change existing data PATCH /orders/482 Delete Remove data DELETE /orders/482 You place order, that na Create. You check where the order dey, that na Read. You change delivery address before dem ship am, na Update be that. You cancel am, that one na Delete. Change "order" to "post", "message", or "appointment" and you don describe almost every app wey dey for your phone. If you dey new for backend work, to build small CRUD API na genuinely good way to learn. You go jam routing, HTTP methods, request validation, database, and ORM almost by accident. Na exactly why every bootcamp dey start you off with building Todo app. But see this thing, to build only the CRUD part of that food order na maybe 10% of the real engineering work. Make we follow that one order through everything else wey suppose happen. "Who Even Dey Ask?" — Authentication Somebody send this: DELETE /orders/482 Fine. But who you be sef? If anybody at all fit hit that endpoint, you no get API, you get public database with extra steps. Before any Create, Read, Update, or Delete happen, backend need answer one question first: who dey make this request? That one na authentication, JWT, session cookie, OAuth, whichever flavor you dey use. "Dem Get Permission Do That?" — Authorization Say two different people send tha

Every team doc tool these days is "searchable." Notion, Confluence, wikis — you can find any page in seconds. But search only tells you a document exists; it doesn't tell you how it connects to the five other docs that explain why it looks the way it does. New hires still end up pinging three people on Slack to reconstruct the reasoning behind a decision that's technically "documented" somewhere. This post is about the difference between a searchable knowledge base and a connected one — and why most teams have the first but assume they have the second.

Every team builds APIs. Few build ones that survive their second rewrite. After inheriting three different REST APIs in as many years — one with endpoints named /getAllUsers , another that returned { "status": "ok" } for both success and 500 errors — I started keeping a list of the practices that actually distinguish robust APIs from ones that generate PagerDuty alerts at 3 AM. This guide distills six rules I've validated across production services handling tens of millions of requests. None are theoretical. All come with working code. 1. Resource-Oriented Naming — Not Action-Oriented The single biggest smell in a REST API is action verbs in URLs: # Bad — these are RPC, not REST GET /api/getUser?id=42 POST /api/createUser POST /api/deleteUser/42 POST /api/activateUserSubscription Resources are nouns, not verbs. The HTTP method is the verb: # Good GET /api/users/42 POST /api/users DELETE /api/users/42 POST /api/users/42/subscriptions # nested resource DELETE /api/users/42/subscriptions/active Key conventions that have held across every production API I've consulted on: Plural nouns : /users , not /user . Consistency with list endpoints ( GET /users = a list) makes singular feel like a bug. Kebab-case for multi-word resources : /order-items , not /orderItems or /order_items . It's URL-safe and matches what browsers expect. Nest at most two levels : /users/42/orders/7 is fine. /users/42/orders/7/items/3/addresses/9 is a cry for help. At that point, use a query parameter: /items?order_id=7 . Use query params for filtering, not path segments : /users?status=active&role=admin , not /users/active/admins . 2. Consistent Error Responses — The Contract People Actually Rely On Most API errors are parsable only by humans staring at a screen. That's a bug. Every error response should follow the same schema so clients can handle them programmatically: { "error": { "code": "USER_NOT_FOUND", "message": "User with id 42 was not found.", "details": { "resource": "users", "identifier"

I spent three months and about $500 on GPU rental trying to host my own LLM. I had a spare RTX 3090, I was deep in the open-source hype, and I was convinced that running my own model was the only way to get privacy, control, and—let’s be honest—bragging rights. I ended up switching to an API that costs me less than a dollar per month for my use case. Here’s what I learned, and why I think most developers should stop self-hosting AI models. The Siren Song of Self-Hosting The argument for self-hosting sounds great: Privacy : Your data never leaves your machine. Control : You can fine-tune, tweak, or swap models whenever you want. No vendor lock-in : You’re not at the mercy of OpenAI or Google changing their pricing or policies. Open source ethos : It’s the “right” way to do things. I bought into all of it. I set up Ollama, downloaded Llama 2 7B, then 13B, then Mixtral 8x7B. I spent weekends wrestling with Docker, CUDA versions, and VRAM limits. I felt like a real engineer. But the reality was different. The Hidden Costs My $500 was just the start. I rented cloud GPUs because my 3090 wasn’t enough for the models I wanted. A single A100 on AWS costs about $3.50 per hour. For a model like Llama 2 70B, you need at least 48GB VRAM, which means a multi-GPU setup or a high-end instance. Here’s a quick breakdown of what I actually spent over three months: Item Cost GPU rental (spot instances) ~$350 Storage for model weights ~$30 Time debugging (conservative) 40 hours Power/electricity (home GPU) ~$40 Total ~$420+ And I never got it running reliably. The 70B model would crash after a few hours. The 13B model was decent but slow—about 10 tokens per second on my 3090. For a chat app, that’s painful. Compare that to an API call: import openai client = openai . OpenAI ( api_key = " sk-... " , base_url = " https://api.tai.shadie-oneapi.com/v1 " ) response = client . chat . completions . create ( model = " gpt-4o-mini " , messages = [{ " role " : " user " , " content " : " What ' s

What if you could take an existing class and say "I want everything this already does, plus a few...

When I started working on a WooCommerce slider plugin, I noticed that many existing solutions were packed with features that a lot of websites simply don’t need. More features often mean more CSS, more JavaScript, and a bigger impact on performance. So I asked myself a simple question: What would a WooCommerce slider look like if performance came first? My goals Instead of creating another all-in-one slider plugin, I focused on a few principles: Lightweight codebase Fast loading times Responsive by default Easy integration with Gutenberg Elementor support Shortcode support Clean and maintainable architecture Performance matters Every additional request and every unnecessary asset affects page speed. Some optimizations I implemented include: Assets are loaded only when required. Local libraries instead of unnecessary external requests. Server-side rendering where appropriate. Clean HTML output. Developer experience I also wanted the plugin to be simple for users. Instead of a complicated interface, the goal was: Install Create a slider Insert it into a page Done Lessons learned Building a public WordPress plugin taught me a lot: Documentation is almost as important as the code. User feedback quickly reveals edge cases you never considered. Keeping the codebase simple often leads to better long-term maintainability. What’s next? I’m continuing to improve the plugin by adding new features while keeping performance as the top priority. I’d also love to hear how other developers approach WordPress plugin development and performance optimization. Thanks for reading! ⸻ If you’re interested, you can check out my project here: WordPress.org: https://wordpress.org/plugins/amitry-product-category-slider/ GitHub: https://github.com/amitry-de/amitry-product-category-slider Live Demo: https://slider.amitry.de/

The evals for my agent skills scored 0% for as long as I had records. Not low. Not noisy. Exactly zero, every skill, every run. And I believed it. For months I thought my skills were bad, because the number said so and the number never wavered. Then one night I actually read the harness. It had fallen back to the wrong auth token. Every call it made came back 401, and it quietly graded each one a failure. The skills never got a chance to fail on their own. I was not measuring them at all. I was reading a broken thermometer. Real weakness is jagged Here is what took me too long to see. When a system is genuinely bad, it scores 40% one week and 60% the next. It passes the easy cases and trips over the hard ones. It has good days. Incompetence has texture, because an incompetent system is still in contact with the world, and the world varies. A flat number has no texture. A flat number means the measurement stopped touching the thing being measured somewhere upstream, and what you are reading is the instrument's resting state. Doctors know this. A heart monitor drawing a perfectly straight line does not mean the patient is calm. Only a broken thermometer writes the same number every time. Key insight: A performance number with no variance is a reading of the instrument, not of the thing being measured. The same bug in three industries I run systems in advertising, in healthcare billing, and in agent operations, and the same shape shows up in all of them. In advertising I found a dashboard figure that had been hardcoded for two years. Nobody questioned it, because it looked right, and it looked right because it never moved. In agent operations, an account-rotation bug in one of my pipelines overwrote every real error with the same generic message, "no active accounts," so for a while every distinct failure in that system looked identical. And in the denial-assessment engine I run for a medical-billing operation, an agreement metric came back at 44.7%, alarmingly low, un

Originally published on hexisteme notes . I have a small pipeline that crossposts my notes to dev.to. It parses a Markdown file's front matter, builds a payload, and calls the dev.to API to publish. It has 19 gate tests, and every one of them was green the whole time it was shipping. It published nine articles. All nine went live with their titles broken — the front-matter quotes were sitting right there in the title, visible to anyone who looked, for nine days, and nothing in the pipeline noticed. I didn't notice either. A human had to open the dev.to profile page by accident before anyone found out. This is the postmortem, and the reason I'm writing it up as a general essay rather than just a fixed-bug log is that the root cause isn't specific to dev.to, or to Markdown front matter, or to Python. It's a category of mistake that any pipeline with an external endpoint on the other end can make: testing the payload you build, and never testing what the other system does with it. The pipeline that had "passed everything" The shape of it is ordinary. A draft file has YAML-style front matter — title: "Some Title" — because that's the convention. A parser reads the front matter and pulls out the title. A payload builder takes that title and a few other fields and assembles the JSON body for the dev.to API. The API gets called, dev.to accepts it, the article is live. Nineteen gate tests cover this path — the front-matter parsing and the payload/API contract of the pipeline's own code. All green, every publish. The gap is in what "parses the front matter" actually means. The parser isn't a real YAML parser. It's closer to line.partition(":") — split each line on the first colon, take the right-hand side as the value. That works fine for tags: testing, devops where there's nothing to unwrap. It does not work for title: "Some Title" , because the quote characters are part of the string on the right-hand side of the colon, and a partition-based parser has no concept of "this

Introduction As developers, we're often drawn to the fast-paced and ever-evolving world of technology. The thrill of learning new skills, the rush of solving complex problems, and the satisfaction of building something from scratch can be incredibly exhilarating. However, this enthusiasm can sometimes tip into an unhealthy obsession, leading to burnout. The Psychological Impact of Constant Learning The tech industry is notorious for its fast pace, with new technologies and frameworks emerging every month. This creates a sense of FOMO (fear of missing out) among developers, who feel pressure to stay updated and relevant. The constant learning curve can be mentally draining, leading to feelings of anxiety and stress. Example: Consider the popular saying 'You can't be good at everything.' This is a crucial fact to acknowledge in our ever-evolving tech world. Example of prioritizing learning paths learning_paths = [ ' AI ' , ' Cloud ' , ' Cybersecurity ' ] priority_path = input ( ' What path do you want to prioritize? ' ) if priority_path in learning_paths : print ( ' Great choice! ' ) else : print ( ' Consider your options carefully. ' ) Environmental Factors: Workplace Culture and Resources The workplace culture and availability of resources can significantly impact a developer's likelihood of burnout. A toxic work environment, lack of support, or inadequate resources can exacerbate burnout, while a supportive and inclusive culture, mentorship, and access to resources can help mitigate it. Recognizing Early Signs of Burnout and Implementing Self-Care Burnout can sneak up on us, but there are early warning signs to look out for. If you're consistently feeling exhausted, disconnected from work, or struggling to focus, it may be time to take a step back and reassess your priorities. Implementing self-care practices, such as exercise, meditation, or hobbies outside of work, can help maintain a healthy work-life balance. ## Conclusion As developers, we need to acknowledge

AxonASP is a high-performance Classic ASP engine written in Go — but here's the twist: it runs JavaScript (JScript) natively on the server side. You get a synchronous, predictable execution model, full ECMAScript 5/6+ support, and zero dependency on Node.js or any third-party JavaScript runtime. And yes — you can build an entire production website with it. Why AxonASP Changes the Game for Server-Side JS Most developers associate server-side JavaScript exclusively with Node.js. And Node.js is great — until you're drowning in async/await chains, package.json conflicts, and the 47th minor version bump of a dependency that broke your build. AxonASP takes a fundamentally different approach. Instead of wrapping everything in an event loop and forcing asynchronous patterns everywhere, AxonASP's JavaScript engine executes code synchronously by default . You write your server logic the same way you write your frontend logic — line by line, top to bottom. It compiles through a high-performance AST parser and runs directly on a custom Go-based virtual machine. The result? Cleaner code, simpler debugging, and a massive reduction in cognitive overhead. What You Get Out of the Box Full ES5 + ES6 support (classes, arrow functions, template literals, destructuring, proxies, for...of , Map , Set , Symbol , typed arrays — 37+ modern features documented) Synchronous execution — no callback pyramid, no promise chains for basic I/O ASP intrinsic objects — Request , Response , Session , Application , Server — all accessible directly from your JS code No npm install required — just write .asp or .js files and point the server at them CLI execution — run JavaScript files from the command line for automation, batch processing, or testing The Philosophy: Simplicity Over Complexity Here's a hard truth: most web applications don't need 2,000 npm modules. They need to read a database, render HTML, handle form submissions, and maybe serve a JSON API. That's it. The modern JavaScript ecosystem ha

In today's world where websites and web applications play a very important role in businesses, choosing the right tool for developing a project is of great importance. Developers usually use frameworks to build websites faster, more securely, and more professionally. One of the most powerful and popular web development frameworks is Django . Django is a powerful and open-source web framework built with the Python programming language that allows developers to create complex and professional websites and web applications in a short amount of time. From simple websites to large systems, online stores, social networks, admin panels, and professional APIs — all can be developed with Django . In this article, we will thoroughly examine what Django is, why it has become popular, what its use cases are, and why many developers and large companies use it. What is a Framework? Before we get to know Django , it's better to understand the concept of a framework. A framework is a collection of pre-built tools, libraries, and rules that help developers build software faster and with better structure. In the past, developers had to create many features from scratch; for example: User login system Database connection Request management Application security Page structure File management But by using a framework, many of these capabilities are already prepared, and the developer can focus on the core logic of the project. Simply put, a framework is like a ready-made skeleton for building software that increases the speed and quality of development. What is Django? Django is a server-side (backend) web development framework written in Python . This framework is designed for building web applications and provides developers with many features by default. The main goal of Django is to make web development faster, more secure, more organized, and more scalable. Django's official slogan: The web framework for perfectionists with deadlines This slogan indicates that Django was built for

Introdução O nome do princípio vem do próprio nome do projeto de pesquisa (que remete a Deméter, deusa grega da agricultura — a metáfora era "cultivar" software que cresce de forma incremental e adaptável, não do princípio de acoplamento em si). O projeto Demeter investigava como reduzir o custo de manutenção de sistemas orientados a objetos observando que boa parte das mudanças de software quebrava código muito distante do ponto onde a mudança real acontecia — um efeito cascata causado por classes que conheciam profundamente a estrutura interna de outras classes. Essa observação foi confirmada empiricamente alguns anos depois: em 1994, Chidamber & Kemerer publicaram as famosas métricas CK ( A Metrics Suite for Object Oriented Design ), nas quais o CBO (Coupling Between Objects) — quão acoplada uma classe é a outras — se tornou um dos preditores mais fortes de defeitos e esforço de manutenção em estudos empíricos posteriores de engenharia de software. Ou seja: a intuição por trás da Law of Demeter (menos acoplamento = menos bugs ao mudar código) tem respaldo em dados de décadas de pesquisa empírica em qualidade de software. Definição Também chamada de "Principle of Least Knowledge" , a formulação clássica é: Um método M de um objeto O só deve chamar métodos de: O próprio O Os parâmetros recebidos por M Qualquer objeto que M crie/instancie internamente Os componentes diretos de O (seus atributos/campos) Variáveis globais acessíveis a O Resumo popular: "use apenas um ponto" — evite código como: pedido . getCliente (). getEndereco (). getCidade (). getNome () Isso é conhecido como "train wreck" (trem de vagões) — cada . é um vagão acoplado ao anterior. Se a estrutura interna de Cliente ou Endereco mudar, todo código que fez essa travessia quebra, mesmo estando em um módulo completamente não relacionado. Porque isso importa na prática? Quando o método M faz objeto.getX().getY().metodo() , ele passa a depender da estrutura interna de X e Y , não só da interface pública d

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . Copilot started whispering random letters into my ear, like it was leaking secret tokens from the underworld! Cute, but also, a bug! This sounds like a classic data serialization or sanitization failure in the text-to-speech (TTS) pipeline. What is happening here is a classic disconnect between the UI layer (what you see on screen) and the data payload sent to the background engine. When you read a response on screen, the Android app renders clean Markdown or HTML. However, when you tap "Read Aloud," the app has to strip away all background formatting, structural code, and system metadata, converting the response into a raw, clean string of text before handing it off to the mobile TTS engine. In this case, the background script running the relay is failing to sanitize that data stream. It is accidentally passing raw control characters, escape sequences, or hidden system tracking tokens (like structural delimiters or character-encoding artifacts) directly into the text pipeline. Because the mobile TTS engine doesn't understand that these symbols are meant to be ignored structural code, it tries to do exactly what it’s programmed to do: it reads them literally. When the voice engine encounters unexpected symbols, raw strings of characters, or broken text boundaries in the middle of a sentence, it completely disrupts the engine's predictive text processing: ● Pitch and Speed Fluctuations: Mobile TTS engines use deep learning models to predict natural tone, cadence, and inflection based on context. Injecting random, non-linguistic characters completely derails the engine's context window, causing it to panic-adjust its pitch, speed, and emphasis mid-sentence. ● Mispronunciations: The hidden characters slice words in half semantically, forcing the engine to mispronounce standard words because it's trying to blend them with the rogue data trailing right behind them. Here is a direct, high-s

Every AI-generated site we have inherited was missing the same eighteen things. None of them are visible in a screenshot. All of them are visible to Google. July 10, 2026 An AI-generated site looks done. It has a hero, sections, a color palette, and copy that reads well in a screenshot. Then we open the page source, and the production work is missing. Not some of it. The same eighteen things, every time. None of them change what a human sees in a browser. All of them change what a crawler, a link preview, or a cache does with the page. Here is the list we run before we call anything live. Crawlability and indexing This is where the gap is widest, because a client-rendered single-page app hands crawlers an empty div and expects them to run JavaScript to fill it. Many will not. We fix that with static work. Prerendered static HTML per route , so the first paint is real content and not a loading spinner. A sitemap.xml generated from a single route manifest , so it lists every page and no page twice. A robots.txt that points at that sitemap and does not accidentally disallow the whole site. A canonical URL on every page , because a screenshot cannot show you a missing canonical tag. A meta title and description written per page , not one template repeated across the whole site. Structured data as JSON-LD for the page types that support it. IndexNow submission on deploy , so search engines learn about changes without waiting for a crawl. An llms.txt file describing the site for the AI crawlers that now read it. Sharing and presentation A link is content too. When someone pastes the URL into Slack or iMessage, the site is representing itself, and the defaults are usually blank. Open Graph tags for the title, description, and image. Twitter card tags , which are close to Open Graph but not identical. A per-page share image at 1200x630 in PNG. WebP renders unreliably in LinkedIn and iMessage previews, so we ship PNG here even though we prefer WebP elsewhere. Descriptive alt

Every developer has a "starter project." Some keep a GitHub template. Some duplicate their previous SaaS project. Some run create-next-app and spend the next two hours installing the same dependencies, configuring the same tools, and recreating the same folder structure. I was in the second group. Every new project started the same way. bun create next-app Then came the checklist. Install Tailwind CSS. Configure Biome. Add shadcn/ui. Organize folders. Set up a UI library. Configure TypeScript. Add environment files. Set up a monorepo. Copy utility functions. Configure path aliases. Install development tools. None of these tasks were difficult. They were just repetitive. After starting enough projects, I realized something: I wasn't building products. I was rebuilding the same foundation over and over again. The Starter Kit Trap Like many developers, I created a "starter repository." Whenever I wanted to build something new, I'd clone it. It worked... until it didn't. Eventually I had multiple starter repositories. One for a monorepo. One for a standalone project. One with authentication. One without authentication. One for experiments. One that was already outdated. Keeping them synchronized became its own maintenance project. Fix a bug in one. Forget to fix it in another. Upgrade Next.js in one repository. Forget the rest. The more starters I created, the less useful they became. Why Existing Starters Didn't Quite Fit There are already fantastic starter kits in the ecosystem. Some focus on minimalism. Others include every feature imaginable. The problem wasn't that they were bad. The problem was that they optimized for someone else's workflow. Every project I build starts with almost the same stack. Next.js TypeScript Bun/pnpm Tailwind CSS v4 shadcn/ui Biome Production-ready project structure I didn't want to answer twenty configuration questions every time I scaffolded a project. I wanted one command. npx create-notils my-app …and be ready to start building. Opini