标签：#indie

Building NICHLYST: How to Code a Survival Engine When You Are Failing to Survive I track everything. It is an occupational habit of a systems architect. You cannot fix what you do not measure — not a failing build, not a leaking color, and not developer burnout. And if you are reading this while grinding through the RevenueCat Shipaton 2026 yourself, you already know that the hardest metric to log honestly is your own state. So, let me share some metrics. Clinical Baseline: A PHQ-9 Depression Score of 21 On May 11, 2026, my clinical assessment scores were: PHQ-9 (Depression): 21. Severe. Immediate professional intervention required. GAD-7 (Anxiety): 11. Moderate. On August 22, 2026, in the middle of the RevenueCat Shipaton, I took the assessment again. PHQ-9: 21. No improvement. GAD-7: 16. High anxiety. Daily functioning severely impaired. If you have never read a GAD-7 anxiety assessment, 16 sits deep in the high-anxiety band — the zone where "daily functioning severely impaired" stops being a clinical phrase and becomes your actual schedule. While I was typing the very first lines of this post, a massive explosion went off, loud enough to make my ears pop. About an hour later, the local news feeds brought the context: an attack drone had been shot down over a park roughly two and a half kilometers from my house. According to the updates, the falling debris killed a two-year-old child and injured two adults. I am developing a narrative game about survival, the fragility of life, and human behavior under immense pressure. But here, in Kyiv, these are not abstract game mechanics or dramatic tropes to be monetized. They are the immediate, absurd, and brutal reality outside my window. I am exhausted. The clinical scores haven't moved in months. I sleep in the middle of the day because my nervous system simply shuts down. I am looking at this hackathon as a final, desperate push to build something sustainable. But here is the thing about the antifragile development plan

I run a small tech-interview-prep site. It has 8,664 individual pages, one per concept — each with a real question, what it's actually testing, a model answer and the mistake that sinks candidates. Programmatic SEO, the whole playbook. Here's what 28 days of Google Search Console says: Impressions 6,511 Clicks 9 CTR 0.14% Average position 45.9 Pages with at least one impression 1,575 of 8,664 (18%) Nine clicks. In a month. From nearly nine thousand pages. I want to walk through this honestly, because the conclusion I reached is not the one I expected, and it's not the one most posts about programmatic SEO land on. What I assumed was wrong My working theory for weeks was "Google isn't indexing them." That's the standard programmatic-SEO failure story: you publish thousands of pages, Google decides your new domain hasn't earned the crawl budget, and most of them sit in Search Console under Discovered — currently not indexed forever. And early on that was true. A few weeks ago only 6 pages had ever received an impression. It's now 1,575. Google is indexing them, steadily, without me doing anything new. The crawl budget arrived on its own schedule. The clicks did not. The actual failure mode Here's the distribution that explains everything. Across 1,206 distinct queries: Position Share of queries 1–10 12% 11–20 6% 21–50 23% 51+ 59% Median position: 58. That's page six of the search results. Nobody has ever been to page six of the search results. So the pages aren't missing from the index. They're in the index, ranked below anything a human will scroll to. Indexed and invisible are close to the same thing, and the second one is more annoying because the dashboard fills up with numbers that look like progress. 6,511 impressions is real. It's also what position 58 produces: Google shows your result to enough people that you see the impression, and none of them scroll far enough to see it. The queries are the tell These are my top queries by impressions: 11 imp pos 52.2 com

As a developer who works remotely from an RV, I often find myself juggling multiple projects and tasks at once. One of the biggest challenges I face is keeping track of the numerous tabs I have open on my browser. I recall a particularly frustrating incident where I accidentally closed a tab with crucial information, only to spend hours trying to find it again. This experience led me to create Tab Reminder, a simple yet powerful Chrome extension that allows users to schedule tabs to reopen later. From a technical standpoint, one of the key insights I gained while building Tab Reminder was the importance of leveraging the Chrome extension API to access and manage browser tabs. By using the chrome.tabs API, I was able to create a seamless experience for users to schedule tabs to reopen at a later time. For instance, the chrome.tabs.query method allows me to retrieve a list of all open tabs, which I can then use to populate the scheduling interface. One lesson I learned from building and using Tab Reminder is the value of creating tools that simplify our workflows. By automating the process of reopening tabs, I've been able to free up mental energy and focus on more complex tasks. If you're like me and often find yourself drowning in a sea of open tabs, I recommend checking out Tab Reminder (available at https://go.sg1-labs.us/tab-reminder ) to see how it can help streamline your browsing experience. With Tab Reminder, you can schedule any tab to reopen at a later time, ensuring that you never lose important information again.

I manage the YouTube longform queue for my BuilderStack channel as JSON files in content/yt-longform-queue/ . A spec file lands there when a generator script commits a new dialogue; the publish workflow picks the file, renders it to MP4, uploads it, then moves the file to uploaded/ . No external queue service, no database rows, no management dashboard. This has worked for three months without a major incident. Four patterns kept it from collapsing. Archetype-priority picking, not FIFO First-in, first-out publishing breaks when you have product walkthrough videos, educational deep-dives, and weekly recap specs all in the queue simultaneously. A recap spec committed yesterday would block a product walkthrough from two weeks ago if the queue ran FIFO — and the product content is what actually grows the channel. The picker uses an explicit priority rank: RANK = { " product_findindiegame " : 0 , " product_ossfind " : 1 , " hidden-gem " : 1 , " build_in_public " : 2 , " technical " : 3 , " curated " : 4 , " meta " : 4 , " contrarian " : 6 , " recap " : 7 , " ai_tools " : 7 , } DEFAULT_RANK = 5 Archetypes not in the dict fall to DEFAULT_RANK = 5 — the middle, not the bottom. New formats I haven't classified yet still air rather than sitting perpetually at the end. Within each rank tier, files sort by filename (oldest-first). The archetype value comes from the spec JSON's top-level archetype field, falling back to a prefix match on the filename for older files that predate the field. One consequence: adding a new archetype name to the dict can reorder the queue overnight. I've done this intentionally to let a backlogged product video jump ahead of a stale recap. 21-day stale expiry Queue files include a date prefix: YYYY-MM-DD-<slug>.json . The picker removes files whose date is more than 21 days old before selecting what to publish: MAX_AGE_DAYS = " ${ QUEUE_MAX_AGE_DAYS :- 21 } " CUTOFF = $( date -u -d " ${ MAX_AGE_DAYS } days ago" +%Y-%m-%d ) for f in content/yt-longform

"How much does it cost to put an app on the App Store" gets answered inconsistently online because most answers either only count Apple's fee, or only count hardware, or quietly assume you're renting expensive cloud infrastructure you don't actually need. Here's every cost, split into what's mandatory and what's a choice. Mandatory: Apple Developer Program — $99/year This is the one cost nobody can avoid. To submit any app to the App Store — free or paid, one app or fifty — you need an active Apple Developer Program membership, which is $99/year, billed annually, direct to Apple. There's no one-time version and no way around it. (There is a free-tier Apple ID for personal on-device testing without paying this, but it doesn't let you submit to TestFlight external testers or the App Store — for an actual public release, the $99/year membership is required.) Required, but where you have genuine choices: building and signing To submit a build, something has to run Xcode's command-line signing and archive tools — that part isn't optional. Where you have a choice is what runs it: Option Cost Recurring? Buy a Mac ~$799+ (Mac mini, entry price) No Rent a cloud Mac ~$20–100+/month Yes GitHub Actions, public repo $0 No GitHub Actions, private repo $0 up to a monthly allowance, then per-minute Only if you exceed the free allowance The short version on that last row: on a public repo, this line item can legitimately be $0, indefinitely. Optional or one-time: the things people assume cost more than they do App Store screenshots and marketing assets. You can generate these yourself for free — from the Simulator or a physical device — no paid tooling required. A physical iPhone for testing. Not strictly required to submit, but you'll want one to sanity-check the finished app before release. TestFlight itself. Free, included in the $99/year membership. App Store listing itself. Free — no fee to list an app beyond the membership. Adding it up For someone shipping a side project on a

Marketplace sellers often discover image problems too late. A product photo may look fine in an editor, but after uploading it to a marketplace it can become: cropped in search thumbnails too small for zoom previews the wrong aspect ratio for a sales channel risky for Amazon-style main image requirements awkward when reused across Etsy, Amazon, TikTok Shop, Shopify, eBay, or Walmart I wanted a simple preflight step before publishing product images, so I built ListingPic : 👉 https://listingpic.com/ What it does ListingPic is a browser-based marketplace image checker and resizer. You upload a product photo, choose the marketplaces you care about, and get a readiness report covering things like: image dimensions aspect ratio file type file size thumbnail crop risk safe-area positioning marketplace-specific warnings The goal is not to replace manual review. It is to catch obvious image risks before sellers waste time uploading, previewing, deleting, resizing, and re-uploading. Why local-first? A lot of product photos are sensitive: unreleased SKUs private product photography branded assets client images images sellers do not want copied or stored elsewhere So ListingPic processes images locally in the browser. Your images are not uploaded to our server for analysis. That also makes the tool fast for quick checks: drop in an image, review the warnings, adjust before publishing. Current checkers The MVP includes marketplace-focused checks for: general marketplace readiness Etsy image checks Amazon product image checks TikTok Shop image checks There are also entry points for Shopify, eBay, and Walmart workflows. Example use case Imagine you have one product photo and want to reuse it across multiple channels. ListingPic can help answer: Is the image large enough? Will the product be cut off in thumbnails? Is the image close enough to square for a channel that prefers square previews? Is the product too close to the edge? Do I need a separate crop for Etsy or TikTok Shop? D

I built 109 tools that never touch a server - here is the architecture Most "tools" sites you have used do this: You upload a file It goes to a server The server processes it You download the result Sometimes the server stores it. Sometimes it leaks. Sometimes it disappears with the company. I wanted something different. Every tool on korelyy.com runs 100% in your browser . Zero backend. Zero upload. Zero tracking. Here is the actual architecture, the real numbers after 90 days, and what I learned. What "no server" actually means For each of the 109 tools: The entire app is a static HTML + CSS + JS file It is served as-is from a CDN (Cloudflare Pages) All file processing happens in your browser via FileReader , canvas , Web Crypto API , or OffscreenCanvas Your file never leaves your device Closing the tab = the data is gone (no cookies, no localStorage, no account) This is not a marketing claim. It is verifiable: Open DevTools -> Network tab Use any tool that requires a file (image converter, JSON formatter, etc.) Reload. The only network request is for the static HTML/CSS/JS bundle. No fetch() to a server. No XHR . No upload. The file is read, processed in-memory, and downloaded. The 4 browser APIs that do 90% of the work When you remove a backend, you are left with the browser. The browser is more capable than most people think. 1. FileReader and URL.createObjectURL Read any file the user gives you: const file = document . querySelector ( ' input[type=file] ' ). files [ 0 ]; const url = URL . createObjectURL ( file ); const img = new Image (); img . onload = () => { // process image canvas . toBlob ( blob => { const downloadUrl = URL . createObjectURL ( blob ); // trigger download }); }; img . src = url ; Image conversion, PDF generation, audio trimming - all the same pattern. Read blob, process, create new blob, download. 2. crypto.subtle (Web Crypto API) Hashing, encryption, signing - all client-side: const hash = await crypto . subtle . digest ( ' SHA-256 ' , a

As I sit here in my RV, typing away on my latest project, I often think about the community that has formed around my indie apps. One story that stands out is when I released ShipDrop, a simple one-click hosting tool for developers. I was overwhelmed by the response from the developer community, who appreciated the ease of use and simplicity of hosting their projects. One user even hosted a website for their local animal shelter using ShipDrop, and it was amazing to see how such a small tool could make a big impact. From a technical standpoint, building ShipDrop taught me a lot about the importance of simplicity in code. When I started working on the project, I was tempted to add a lot of features and complexity, but I realized that the core value of the app lay in its ease of use. By keeping the codebase small and focused, I was able to create a seamless user experience that allowed developers to host their projects in just a few clicks. For example, using a simple drag-and-drop API, I was able to abstract away the complexities of hosting and deployment, making it accessible to a wider range of users. One lesson I've learned from building and sharing ShipDrop with the community is the importance of listening to feedback and being open to iteration. When I first released the app, I thought it was perfect, but the community quickly pointed out areas for improvement. By being receptive to their feedback and making changes accordingly, I was able to create a tool that truly met the needs of my users. This experience has taught me the value of community involvement in the development process, and I'm grateful to be a part of the DEV community, where I can share my experiences and learn from others.

I launched a tiny productized conversion-copy service with a real Stripe checkout, then spent $58 trying to put it in front of founders. Revenue so far: $0 . That is not a case study. It is a useful measurement problem. What I spent Channel Spend What I bought LaunchPact starter ad $5 Seven-day founder-feed placement LaunchPact service campaign $24 Seven-day placement plus one founder-digest slot LaunchPact founder poll $10 One 24-hour purchase-intent poll LaunchBuff Premium $19 Immediate featured listing and permanent backlink I also opened 16 community tasks on Favors.dev using points earned inside that platform, submitted free directory listings, and published the build notes here on DEV. What happened The first LaunchPact ad reported 32 views and zero clicks. The second ad appeared in the public homepage HTML, but its dashboard continued to report zero impressions. That difference mattered. A dashboard counter was not enough, so I checked three separate layers: Was the sponsored card rendered publicly? Did my server receive a request carrying the campaign parameters? Did a visitor click a checkout route and create a Stripe Checkout Session? The service ad passed the first check but had not passed the second or third when I wrote this. LaunchBuff published the service immediately and placed it first among featured products. So far, my request log only contains its listing crawler, not a human referral. Favors.dev made the service the top upcoming launch for its date. None of the 16 paid-in-points helper slots have been filled yet. One earlier visitor reached the $19 starter checkout. The session remains open and unpaid, with no email entered. I cannot recover that checkout or honestly explain why it was abandoned. Cheap reach is not buyer intent The placements were inexpensive, but that did not make them qualified. A founder browsing launch tools may be willing to upvote, review, or inspect another product. That does not mean they currently have a B2B landing pag

A finished browser game is a bundle of static files. Whether you built it in Phaser, Three.js, Babylon.js, Godot, or plain canvas code, the output uploads anywhere, which is exactly why the publishing decision trips people up. Every channel accepts the same build, so the choice is never technical. It is about who owns the audience, who owns the money, and who owns the URL. Here is how the three channels actually compare once you have shipped to all of them. The Three Channels Game portals aggregate thousands of titles, monetize with ads, and share revenue. Indie platforms like itch.io act as storefronts you control, with community feedback attached. Self-hosting on your own domain gives you everything except an audience. Most developers who do this well use more than one at the same time. The marginal cost of adding a channel is usually just reading the submission guidelines and wiring up an SDK, so treating them as either/or leaves reach on the table for no reason. What Portals Actually Require CrazyGames reaches over 20 million monthly players and runs a two stage process. Basic Launch takes your game with minimal integration and tests it with a limited audience for around two weeks. Hit their engagement benchmarks and you are invited to Full Launch, which needs the full SDK for ads, auth, cloud saves, and analytics. Their technical bar for Basic Launch is an initial download under 50 MB, fewer than 1,500 files, and PEGI 12 content. Poki is curated and editorially reviewed, leans mobile-responsive, and pulls strong search traffic with a younger audience. GameDistribution syndicates across hundreds of publisher sites through an embed widget, so you get reach but little brand visibility. Newgrounds still rewards experimental work with a community that engages rather than an SDK that monetizes. The trade in all four cases is the same: the portal brings the players, and in return it owns the player relationship and can change terms whenever it wants. Self-Hosting With

We've all done it. You spin up an RDS instance to test something on a Friday afternoon. You attach an EBS volume to a t3.micro that you kill three days later — but the volume just... stays. You allocate a static IP for a load test, and the load test ends, but the IP doesn't know that. None of this shows up as an error. Nothing crashes. There's no red banner in the console screaming at you. It just quietly sits there, accruing charges, until you open your AWS bill a month later and go "wait, why are we paying for that ?" I call these zombie resources — infrastructure that's technically alive (and billing you) but functionally dead. It's happened to me enough times on side projects and client work that I've started designing a small tool to stop it: CloudZombie . Heads up: this is early. There's no working product yet — I'm validating the idea and building in the open, starting with a waitlist. If that's not your thing, no hard feelings, but if you've felt this exact pain before, I'd love your take. The problem, more specifically Cloud waste isn't usually one big dramatic mistake. It's death by a thousand cuts: Orphaned EBS volumes — you terminate an EC2 instance, but the attached volume doesn't get deleted with it, so it just sits in an "available" state forever. Idle databases — that staging or QA RDS instance nobody remembers spinning up, quietly running at under 1.5% CPU for weeks. Abandoned static IPs and load balancers — cloud providers actually charge more for an Elastic IP that isn't attached to anything, which feels like a small act of cruelty. Individually, each one is a few dollars a month. Collectively, across a handful of side projects or a growing team's sprawl of staging environments, it adds up to real money leaking out of your runway — with zero warning. What CloudZombie is meant to do The plan is for CloudZombie to connect (read-only) to your AWS account and scan specifically for these patterns: Unattached EBS volumes sitting idle Databases with sust

The hot new roguelite twin-stick shooter lives up to the hype.

Two weeks ago I wrote here that I killed my SaaS subscription 7 days after launch and rebuilt it as a buy-once product. I ended that post with a promise written down before I could talk myself out of it: 3 real purchases in 14 days of relaunch, or I move on and leave UIPrompt in maintenance mode. Either way I would post the numbers. The 14 days are up. Here are the numbers. Purchases: 0. New organic signups during the window: 0. The last real signup was a free account three days before the relaunch even went live. They looked once and never came back. So by my own written bar, this is a move-on. UIPrompt goes to maintenance mode today. I want to be useful about why, because "it didn't sell" is a result, not a lesson. What I did in those 14 days Quite a lot. That turns out to be part of the problem. I shipped a real product. The buy-once model was clean: a free playground with no signup, one $39 price, and an AI Design System Pack export that survives a blind test (a fresh AI session got only the exported files and matched 34 of 34 specced properties, inventing zero colors). I bought a custom domain. I launched on Product Hunt with a video, posted a Show HN, cross-posted the pivot article, made a 20-second promo video in Remotion with licensed music, put it on YouTube and X, and submitted to Peerlist, Dev Hunt, Indie Hackers, SaaSHub, and a stack of directories. None of it produced a single sale. Not one. The lesson I did not want On the first launch I blamed pricing. I killed the subscription, and I was right that a burst-usage tool should not bill monthly. But here is the uncomfortable part: fixing the pricing changed nothing, because pricing was never the binding constraint. Demand was. Two different pricing models, same zero, should have told me the problem lived upstream of the checkout page the whole time. I was tuning the part of the funnel I could see and control (the offer) while the actual leak was at the top: not enough of the right people, with pain acute

Ship log — first $3 in 3 days (or learn what fails) Aimed at fellow indie hackers: I'm running a "first $100" experiment. One pack, one platform, full learnings shipped. Here's what worked, what flopped, and what I changed. Day 0 — packaging Built headlines-no-ai-wrote , $3, single markdown file + JSON mirror. Stack: Gumroad for checkout, just markdown for delivery. Why markdown? Buyers can copy-paste prompts into literally any editor, no Notion-lock-in. Day 1 — posted to Reddit r/SideProject: drafted post (see post_reddit.md ). Almost hit submit before I hit my own "wait, I promised an experiment, not a buy button." Result: 0 paid, 1 heartfelt comment from a writer friend who told me the headline itself was the best one . Day 2 — the move I sent the full 50 (not the trimmed 10) to 5 newsletter-writer friends with one line: "yo bro, take it, no ask." Don't ship to millions, ship to 5. Day 3 — what's next Trying Show HN with a tight "here's what worked, here's what didn't" framing. If 0 sales after Day 7, the lesson is "Reddit can't find you from zero". Move 2 = HN. Takeaway so far $3 is real money when you sell 33 of them. Reddit / HN hate wall-of-text, but hate wall-of-CTA more. A useful free preview (10 lines here) > a useful paywall (50 lines there). Ship log footer I post the daily update as part of an experiment to get to first $100 with a public ship log. Tiny wins, real numbers. If you do this too — link me up in the comments. — Cross-post: this is part of an automated indie experiment; the only human-written bits are the prompts and the structure.

Despite predictions that AI agents could make traditional apps obsolete, developers are shipping new software faster than ever. From smarter bookmarking tools and neighborhood marketplaces to digital pen pals and nature journals, here are the latest App Store finds worth adding to your Home Screen.

The notch on a MacBook is strange real estate. It is always there. It sits at the top of the screen, close to the menu bar, close to system controls, close to whatever you are doing. But most of the time it is treated like a cutout to design around instead of a place software can use. That felt like a missed opportunity. So I built SwiftNotch , a macOS menu bar app that turns the notch area into an expandable productivity dashboard. Hover near the notch or press Option + Space , and the quiet black shape becomes a small command center for widgets, files, media, shortcuts, developer tools, and window actions. Website: swiftnotch.xyz Demo video: Launch note: SwiftNotch 1.x is free during beta . I want early Mac users to try the full experience, share feedback, and help shape the app before SwiftNotch 2.0 introduces paid plans. The idea I did not want to build another large dashboard that asks you to leave your current app. The goal was the opposite: make useful tools available in the smallest possible space, without breaking flow. The notch is perfect for this because it already behaves like a visual anchor. You know where it is without thinking. If it can expand only when needed, it becomes a temporary interface layer instead of another permanent panel. SwiftNotch starts collapsed. When activated, it opens into a compact dashboard with the widgets and actions you choose. What SwiftNotch does The current app includes 31 built-in widgets across productivity, system utilities, media, automation, and developer workflows. Some examples: Media Control for Spotify, Apple Music, VLC, YouTube, and browser players Shelf for drag-and-drop file staging, quick sharing, paths, iCloud actions, and zip workflows Clipboard History for snippets, links, and quick paste Calendar Events , Reminders , Notes , Weather , World Clock , and Pomodoro Quick Toggles for Wi-Fi, Bluetooth, Dark Mode, and volume Window Snapping with layouts for halves, thirds, quarters, and custom grids Developer H

I'm the developer of DeviceShelf, a local-first network scanner for desktop, mobile and a headless server edition. Until this week the iOS app only existed on TestFlight. Apple has now approved version 1.3.0, so for the first time you can get it straight from the App Store: DeviceShelf on the App Store . What the app does on a phone The iOS app is not a companion viewer. It runs the same scanning engine as the desktop version: it scans the network you're on, identifies devices (vendor, type, OS fingerprint), shows open ports per device, builds a security report, and raises presence alerts when devices appear or drop off. You can export and share results from the phone. The multicast entitlement iOS restricts multicast traffic for ordinary apps, and SSDP/UPnP discovery depends on it. Apple grants the multicast entitlement on request, and DeviceShelf's App Store build has it. In practice, UPnP/SSDP devices show up in scans on the phone the same way they do on desktop. Licensing The download is free and comes with a trial. Full features unlock in one of two ways: activate a DeviceShelf license, which covers desktop, mobile and the server edition with a single purchase, or use the in-app purchase upgrade on iOS. Pricing is on the website if you want the details. Local-first, on mobile too Scans stay on the device. There is no cloud account, and the AI-assisted device identification is bring-your-own-key; no key is bundled or required. The app is still young, and a phone is an unforgiving place for a network scanner. If it mislabels a device on your network or misses one entirely, I'd genuinely like to hear about it. Website: deviceshelf.app

I’ve been building a small set of calculator pages for freelancers and small-business owners. The first version was pretty simple: put the formula on a page, add a few inputs, show the result. That works for a demo. It does not always work for a real user. The more I worked on it, the more I realized the hard part is not the math. The hard part is making the page feel trustworthy when someone is using it for a business decision. Here are the changes that mattered most. 1. Explain the assumption close to the input At first I wrote explanations below the calculator. Most people never read them. So now I try to put small notes near the input itself. For example, if a calculator asks for payment processing fees, the user should not have to scroll down to understand whether that means percentage fee, fixed fee, or both. This is boring UI work, but it reduces bad inputs. 2. Show intermediate numbers A single final result can feel like a black box. For business calculators, I’ve found it helps to show a few intermediate numbers: subtotal estimated fees estimated tax net amount break-even number Even if the final number is the same, users trust it more when they can see how the result was built. 3. Avoid pretending the answer is exact Small-business math has a lot of messy edges. Taxes vary. Fees vary. Local rules vary. Some people include owner salary in cost. Some do not. A calculator should not act like it knows every detail. I now prefer wording like: estimated monthly amount or rough break-even point That feels less flashy, but it is more honest. 4. Make the empty state useful A blank calculator page is not very helpful. I started adding realistic default numbers or examples where it makes sense. Not because the default is “correct”, but because it helps the user understand what kind of number belongs in each field. This is especially useful for people who are not spreadsheet-heavy. 5. Keep the result easy to copy A lot of users are not trying to stay on the page. They

If you've searched the App Store for a reliable third-party QWERTY keyboard on iOS, you know how that ends. Some are abandoned. Some are ad-riddled. Some feel like they were ported from Android and never touched again. The good ones are the ones that don't ship features so much as they don't crash. The system keyboard is fine. It's fine because Apple has been iterating on it for fifteen years. Nobody else has. Third-party keyboards on iOS are a graveyard. I'm building one that isn't. It's called Diction. Most people know it as a voice keyboard, and that's what I lead with, but under the hood it's a serious low-level QWERTY project too. This post is about that half of it, because that's the half nobody talks about. Why third-party QWERTY on iOS is a graveyard Building a good keyboard extension on iOS is hard. There's a strict memory ceiling. There's a permission dance the user has to opt into. There's no keychain access, no meaningful background work, and the extension can be killed the moment iOS decides it needs the RAM. Most keyboard makers ship a first version to check the box, then abandon it once they see how much work maintaining it takes. The result is what you see on the App Store today. Every third-party keyboard I've tried on iOS fails on at least one of these: Speed. You type a letter, the letter arrives. That's it. If there's a hitch you can feel, the keyboard is broken. Half the ones I've tried have a visible delay on every keystroke. Predictability. If you correct the same word back three times, that word should be yours. The keyboard should stop fighting you. Most never do. You fight the same wrong correction for a year. Recovery. iOS keyboard extensions are memory-constrained. Bad ones freeze under pressure. When you rapid-switch between apps, half the third-party keyboards on the store will lock up until you kill and reopen the host app. Autocorrect that isn't from 2014. Fix the obvious typos. Split words that ran together. Complete contractions. Ge

I've reviewed the launch post-mortems of dozens of indie devs who got hacked after shipping their first SaaS. The common thread isn't bad code. It's a checklist no one handed them before they clicked publish. This is that checklist. Eight items. Each one has: a curl command you can run right now, why the bug matters in plain English, and a concrete fix in under ten lines of code. If you can check all eight green before you launch, you've eliminated the majority of the low-hanging-fruit attack surface on a typical Next.js + Supabase MVP. You're not done with security — but you've moved from "will definitely get popped on launch day" to "a real attacker will have to actually work for it." No sales call required. No consulting firm. Eight items in your terminal before launch. Item 1: Every API endpoint has an auth check How to check: # Test an endpoint without a cookie/token curl -s -o /dev/null -w "%{http_code}" https://your-app.com/api/your-endpoint # Should return 401. If it returns 200, the endpoint is public — intentional? Why it matters: API routes in Next.js are not automatically protected. If you forgot to add getServerSession (or your equivalent auth check) to a route handler, it's open to the internet. The route might not be linked in the UI, but it's reachable. Fix: // At the top of every API route handler const session = await getServerSession ( authOptions ) if ( ! session ) return new Response ( ' Unauthorized ' , { status : 401 }) Run this check for every file under src/app/api/ . Better yet: write a middleware that protects all /api/ routes by default and use an explicit { public: true } annotation for routes that should be unauthenticated. Item 2: Per-tenant data scoping (BOLA / IDOR) How to check: # Log in as user A, grab a resource ID from the response # Then change the cookie/token to user B's and request the same ID curl -s -H "Cookie: your-user-b-session" https://your-app.com/api/items/YOUR-USER-A-ITEM-ID # Should return 403 or 404. If it returns