标签：#web

Hey everyone, I recently landed a freelance gig to build out a complete SaaS platform from scratch. The client is incredibly generous and is treating this as an opportunity for me to learn and implement things as we proceed with development. I want to make sure I choose the right architecture from day one. I can't reveal the exact idea, but it functions as a two-sided platform connecting service providers with end-users. I need to pick a tech stack that plays to my strengths while keeping infrastructure costs as close to zero as possible. Here is my profile and the project constraints: - My Background: I am a frontend-heavy developer. My backend knowledge is only "okay-ish," so I’m looking for a stack that minimizes complex backend boilerplate and dev-ops headaches. - Timeline: I have 4 to 5 months maximum to build and fully deploy the MVP. - Strict Budget: The monthly budget for deployment, database, and any necessary transactional emailing cannot exceed $40/month for the MVP phase. - Expected Scale: To start, the web app needs to comfortably sustain 100 service providers and roughly 1,000 active users. - Payments and subscription : Stripe - Team Size: It's just me (Solo dev). Based on current trends, I've been leaning toward a meta-framework (like Next.js) paired with a BaaS (like Supabase or Firebase), but I’d love to hear from folks who have recently shipped something similar. Questions for the community: What specific tech stack would you recommend that allows a frontend dev to move fast without getting bogged down in backend setup? - Are there specific databases, ORMs, or auth providers you'd suggest that will confidently keep me under that $40/month limit for my expected user count? - Any hosting or deployment "gotchas" I should watch out for when launching a two-sided platform on a shoestring budget? Appreciate any guidance you can share! Note : Used AI for articulation. submitted by /u/chutneypow [link] [留言]

Hi r/webdev , As web developers, we frequently get stuck fighting the tools we use for e-commerce. You find a great framework, but it forces you to use a specific database, or it only deploys nicely to one cloud platform. I built Storecraft to solve this frustration. It is an open-source, headless e-commerce core that treats both the database and the runtime hosting environment as completely swappable dependencies. Why it makes building easier: Deploy Anywhere: It runs identically on traditional servers (Node), modern runtimes (Deno, Bun), or lightweight edge infrastructure (Cloudflare Workers). Choose Your DB: Switch between Postgres, MongoDB, or SQLite by simply changing your driver configuration. Purely Headless: Connect it to any frontend stack you prefer via a clean, predictable API. Whether you are building a small storefront for a local client or a globally distributed edge application, the engine adapts to your infrastructure—not the other way around. Repository link: https://github.com/store-craft/storecraft website: https://storecraft.app/ I'd love to get your feedback on the setup ergonomics. What are the biggest pain points you usually hit when deploying open-source e-commerce backends for your clients? submitted by /u/hendrixstring [link] [留言]

We run Quackr, a virtual phone number platform that lets developers and individuals receive SMS verifications without exposing a real number. We just published our first inventory transparency report and the data was surprising enough that we thought the dev community would find it useful. The Numbers Right now, 97.6% of our entire virtual phone number inventory is actively rented. 66,214 out of 67,815 numbers assigned and in use across 15+ countries. Over 1,000 numbers available at any given moment but they move fast. That utilisation rate tells you something about how the market has shifted. Virtual numbers are no longer a niche throwaway tool. Developers, businesses, and privacy-conscious users are holding them long term. What Developers Actually Use Virtual Numbers For The obvious use case is SMS verification during testing. Spin up a number, verify an account in staging, move on. But that is not what drives the bulk of demand on our platform. The real volume comes from: Multi-account management — developers and businesses running multiple instances of platforms that require unique phone verification per account. Privacy layers in production apps — applications that need to verify users without collecting their real numbers. A virtual number sits between the user and the platform. Automated verification pipelines — this is where our API and MCP Server come in. If you need to provision numbers programmatically and retrieve OTPs without manual intervention, this is the use case we built for. Geographic flexibility — needing a UK number from Australia, a US number from Ukraine, or any combination that your real SIM cannot provide. The OTP Blocking Problem Something worth knowing if you are building anything that involves SMS verification: platform-level VoIP blocking has become significantly more aggressive over the past two years. WhatsApp, Telegram, Google, and TikTok all run detection on incoming verification requests. A VoIP number gets flagged and the OTP simp

Node.js will change its release schedule starting with version 27 in October 2026, moving from two major releases per year to one. All releases will become Long-Term Support (LTS), removing the distinction between odd and even versions. An Alpha channel for early testing will also be introduced. This decision addresses maintenance challenges and aims to align with user needs. By Daniel Curtis

Hello Dev Community! 👋 It is officially Day 12 of my journey to master the MERN stack! Today, I wrapped up Lecture 3 of Apna College's JavaScript playlist with Shradha Didi, focusing on a fundamental data type we use every day: Strings . Before today, I thought strings were just plain text wrapped in quotes. Today, I learned how much power JavaScript gives us to manipulate, slice, and dynamically format text. 🧠 Key Learnings From JS Lecture 3 (Strings) I explored how JavaScript handles text strings and the built-in properties and methods that make text manipulation effortless: 1. Template Literals (The Ultimate Game Changer) Shradha Didi introduced Template Literals , which use backticks ( ` ) instead of standard quotes. This allows us to perform String Interpolation —embedding variables directly inside a string using ${variable} . It makes code look clean and professional: javascript let obj = { item: "pen", price: 10 }; // Old way: console.log("The cost of", obj.item, "is", obj.price, "rupees."); // Modern way: console.log(`The cost of ${obj.item} is ${obj.price} rupees.`);

Honest question: Besides running AI agents interactively, while you work, do you also keep them running after hours, so that work continues or not? I am just trying to figure out how much software development has shifted towards this direction. At my workplace, we only use them while we're at work and always review the output. But I am getting the feeling that many have gone further, by having the agents work continuously. Please share your experience! submitted by /u/kagelos [link] [留言]

So, what does full-stack web development even mean with AI around these days? I mean, if I say I'm a full-stack web developer, I should probably be handling the frontend, backend, database, deployments, and all that jazz. But now, with AI advancing so much, what skills are a must for someone who wants to call themselves a full-stack web developer? Should we also be thinking about product engineering, like what architecture to pick for our projects? And should we even start thinking about shipping, the business side of things, and working with distributions? What do you all think, where should this full-stack development process begin and end now? submitted by /u/zonayedahmed [link] [留言]

pluckmd exists so an agent can pull blog posts into markdown, index them into a wiki, and generate interactive HTML to learn from. This post is about the first step, the part with no per-site code, because the design is the interesting bit. If you want the practical side, how I actually use it day to day, I wrote that up separately: https://dev.to/taisei_ide/how-i-use-pluckmd-to-read-blogs-with-an-ai-agent-1jpe It downloads articles from a blog without any per-site code. No handler for Medium, no handler for Substack, nothing keyed on a domain. Here's how that works. The core idea: treat extraction as data, not code. AdapterSpec Instead of branching on which site you're on, pluckmd resolves an AdapterSpec . It's a plain object that says which selector finds article links, what the URL pattern looks like, and how pagination behaves. interface AdapterSpec { listing : ListingExtractionSpec ; // how to find article links article : ArticleExtractionSpec ; // how to pull the body pagination : PaginationSpec ; // none | scroll | button-click | next-url | auto evidence : string ; } Because it's data, the same shape can come from a heuristic, an LLM, an agent, or a person typing it by hand. They all produce the same thing, and they all go through the same checks. Resolving it, cheapest path first cache -> heuristics (local, free) -> LLM (only if needed) Cache first, rechecked against today's DOM so a stale entry can't sneak through. Then local heuristics. The LLM only gets called when the heuristics aren't sure. Every result that works gets written back, so the second run on a site is basically instant. How the heuristics find an article list This part has no idea what site it's looking at. It takes every link, normalizes the path, and collapses the parts that vary into wildcards. / blog / my - first - post -> / blog /* / blog / another - article -> / blog /* / about -> / about Group by that shape. Any group with the same pattern repeated three or more times is a candidate f

Is it safe? I know nothing.. help me submitted by /u/Free-Ant-463 [link] [留言]

It's free and open source with markdown files on how to setup it for your team and host it yourself. No more paying for votes or not being able to have sessions persist longer than a few days. Enjoy and please don't eat me alive! This is my first public repo (that is actually substantial) I've put out in the world haha. JIRA Planning Poker Website submitted by /u/brut3F0rc3 [link] [留言]

Crypto APIs are no longer just tools for fetching Bitcoin prices. In 2026, they are becoming the...

I'm trying to pick a stack to use for all my freelance web dev work. I plan on building scalable ecommerce websites. I am currently using Node, React, and Docker/Cloudify for deployment on VPS. What is the best option for database? I'm currently using Supabase but I heard they sometimes deactivate databses if you don't login so I want to explore my other options? submitted by /u/wobowizard [link] [留言]

I work for a nonprofit that’s had an outdated website for decades at this point. Upper management is kinda desperate and is getting quoted left and right. $15K for a Wix site which includes: event management, volunteer management, shop, donor management, and general blogs, etc. I thought Wix was one of the lower quality sites… especially as I can just go in and drag and drop elements myself. Are we being highballed? How can I convince my management who has zero website experience that this is not the route we want to go for that price point? submitted by /u/breezyb2310 [link] [留言]

AirDrop only works between Apple devices. Most alternatives require an app install, a cloud account, or route files through a third-party server. I wanted something simpler: Open a URL → discover nearby devices → send files. So I built LocalDrop — a peer-to-peer file transfer app that works entirely in the browser over local Wi-Fi. GitHub: https://github.com/akshaykdadheech/localdrop Live Demo: https://localdrop-4fddd39fb6ad.herokuapp.com How It Works Devices connected to the same Wi-Fi network automatically discover each other through a lightweight signaling server. Once discovered, WebRTC establishes a direct peer-to-peer connection: Browser A ──► Signaling Server ◄── Browser B └──────── WebRTC P2P ────────┘ The signaling server only helps devices find each other. File transfers happen directly between browsers via WebRTC and are DTLS encrypted, so the server never sees your files. Interesting Challenges Backpressure Handling WebRTC DataChannels on Chromium have a ~16 MB buffer limit. Sending data too aggressively can crash the tab. I solved this using: bufferedAmountLowThreshold Flow control based on drain events Cross-Platform Compatibility Different browsers expose different capabilities. Android Chrome supports the File System Access API iOS Safari does not This required separate file-receiving flows for each platform. Large File Transfers Keeping multi-gigabyte files in memory isn't practical. On Chrome, showSaveFilePicker() is triggered after the transfer completes, allowing transfer progress to remain visible throughout the process without buffering everything in RAM. Tech Stack Svelte 5 + Vite TypeScript WebRTC DataChannel Node.js + ws Docker Self-Hosting git clone https://github.com/akshaykdadheech/localdrop cd localdrop docker compose up -d Then open: http://your-ip:3001 from any device connected to the same Wi-Fi network. I'd love feedback from anyone who's worked with WebRTC DataChannels, especially on mobile browsers. If you find the project useful, a

I would like some advice from well experienced devs that you would give to junior devs submitted by /u/Dizzy_External2549 [link] [留言]

There's a specific feeling you get after your third production caching incident. It's not panic....

Are websites with background music still in and fashionable? This would be for the landing page of a website of a fashion/editorial male model The song would be this submitted by /u/Think_Equipment4449 [link] [留言]

Hi, I have a web app that serves cached JSON files via Cloudflare CDN. The data is generated by a proprietary algorithm and has significant competitive value. The JSON structure is simple to discover: /cache/_index.json → lists manifest URLs /cache/manifest_xxx.json → lists data file URLs /cache/data_xxx.json → actual proprietary data Anyone can write a 20-line script to crawl the full dataset in minutes. Rate limiting (Nginx, 60 req/min) slows it down but doesn't stop a patient scraper. The obvious solution would be JWT token authentication on the JSON endpoints, but Cloudflare CDN caches by URL — adding auth headers breaks caching entirely, defeating the purpose of having a CDN. Constraints: Must keep Cloudflare CDN caching working (performance critical) No user login/registration exists — it's a fully public site Data must remain accessible to legitimate browser users Cannot move away from Cloudflare Is there any real, production-proven solution to this problem? Or is "public CDN-cached data" fundamentally incompatible with "access control"? What would you do? submitted by /u/JosetxoXbox [link] [留言]

The AI agent security community has been converging on a problem. A researcher recently ran an experiment — feeding a memory-retrieval framework 10 scenarios involving certificate operations: signing, issuing, revoking, delegating. The system retrieved the right memory 8 out of 10 times. It matched the external authorization gate 7 out of 10. The conclusion: metadata per item isn't enough. You need a separate authorization gate over the proposed operation. That conclusion is correct. But I want to show what that gate actually looks like when you build it — because the primitive already exists, and it's older than LLMs. The problem is authorization, not retrieval Most agent frameworks today invest in memory and observability. The agent can recall what it did before. You can see what tools it called. Logs, traces, dashboards. What they don't have is a cryptographically enforced answer to the question: was this agent authorized to do this, before it did it? Those are different problems. Retrieval tells you what the agent remembers about its permissions. Authorization tells you what it was actually granted — signed, tamper-proof, at dispatch time. An agent that retrieves "I have revocation permissions" from memory and then revokes a certificate it shouldn't touch is not an authorization failure at the retrieval layer. It's an authorization failure at the gate layer — because there was no gate. Certificates are that gate A certificate is a signed declaration of what an entity is authorized to do. Issued once, verifiable offline in ~1ms, revocable instantly. We've used them for TLS, for IoT devices, for code signing. The same primitive works for agents. The model is simple: Orchestrator issues a certificate at dispatch time The certificate carries the agent's identity and its exact scope in meta Every tool call goes through a gate that verifies the certificate offline On completion — or abort, or timeout — the orchestrator revokes it // Orchestrator — dispatch const { cer

Co to jest WCAG 2.1? WCAG 2.1 ( Web Content Accessibility Guidelines ) to międzynarodowy standard techniczny określający, jak tworzyć strony www i aplikacje mobilne, aby były dostępne dla osób z niepełnosprawnościami (wzroku, słuchu, ruchu, poznawczymi). Wersja 2.1 rozszerza wcześniejsze zasady o wytyczne dla urządzeń mobilnych oraz osób słabowidzących. Struktura WCAG 2.1 i poziomy zgodności Standard opiera się na 4 głównych zasadach. Dzielą się one na wytyczne, do których przypisane są konkretne kryteria sukcesu wdrażane na trzech poziomach: Poziom A: Absolutne minimum. Bez niego strona jest całkowicie niefunkcjonalna dla wielu użytkowników. Poziom AA: Standard rynkowy i prawny. Wymagany przez polskie i europejskie przepisy dla sektora publicznego i biznesu. Poziom AAA: Najwyższy stopień dostępności, trudny do wdrożenia w całym serwisie. Zasady POUR – Fundamenty WCAG 2.1 Wszystkie wytyczne WCAG 2.1 opierają się na czterech głównych zasadach tworzących akronim POUR : P erceivable ( Postrzegalność ) - Treść musi być dostarczana w sposób czytelny dla zmysłów użytkownika (wzroku, słuchu). O perable ( Funkcjonalność ) - Interfejs i nawigacja muszą być możliwe do obsługi za pomocą różnych urządzeń (np. samej klawiatury). U nderstandable ( Zrozumiałość ) - Informacje oraz obsługa strony muszą być jasne, logiczne i przewidywalne. R obust ( Solidność ) - Kod strony musi być poprawny i kompatybilny z obecnymi oraz przyszłymi technologiami (przeglądarki, czytniki ekranu). Kto musi spełniać standardy WCAG? Dostępność cyfrowa to już od dawna nie tylko "dobra praktyka", ale twardy wymóg prawny, który stale się rozszerza: Sektor publiczny (Obecnie): W Polsce urzędy państwowe i samorządowe, szkoły, uczelnie, szpitale oraz spółki skarbu państwa mają bezwzględny obowiązek spełniania standardu WCAG 2.1 na poziomie AA. Wynika to wprost z Ustawy z dnia 4 kwietnia 2019 r. o dostępności cyfrowej . Za brak zgodności grożą kary finansowe. Sektor prywatny i biznes: Na mocy Europejskiego Akt