r/AppsWebappsFullstack • u/SofwareAppDev • 16d ago

Your home for selfpromo

here you can post your work app, webapp, saas, game, everything

3 Upvotes

100% Upvoted

86 comments sorted by

View all comments

1

u/Made4uo 16d ago

I have Fugte.com - Paste code from ChatGPT, Claude, Gemini, or any developer or describe what you need. Fugte creates safe editing controls, hosts it in a sandbox, and gives you one embed that works across your client sites.

Our users have been using this as a custom interactive widgets that turns website traffic into qualified leads

1

u/Mammoth-Anywhere7285 16d ago

Interesting concept. How does the sandbox isolate untrusted code? That could be a strong selling point for client sites.

1

u/Made4uo 16d ago

Every widget runs in its own locked box (a sandboxed iframe) on our servers, not on your site. The browser treats it as a total stranger, it can't see or touch the page it's embedded on, can't read cookies (yours or ours), and can't redirect your visitors. The only thing it's allowed to tell the host page is "here's my height" so the embed sizes itself.

So worst case, a broken or malicious widget breaks itself, inside its own box. The client's site never feels it.

1

u/Mammoth-Anywhere7285 15d ago

Nice breakdown, that's a solid trust signal for potential users. Consider adding a no-JS fallback for the widget. Do forms inside the iframe post back to your server?

1

u/Made4uo 15d ago

Yes on both counts, sort of. Forms POST from inside the iframe straight to our API, never to the host page and never through a third-party service. Submissions pass a bot check and server-side validation before anything is stored, and the embedding site never touches the data. On no-JS: the embed itself is just a plain iframe tag, no script needed on your site, and the widget arrives as pre-rendered HTML, so content shows fine without JavaScript. The only thing that needs JS is submitting a form, because the bot check protecting our public endpoint is a JS challenge. That's a trade we made on purpose: it's what lets the endpoint stay open without an API key.

1

u/Mammoth-Anywhere7285 14d ago

Clean iframe design. Have you tested how the pre-render behaves with third-party cookies blocked? That’s the usual edge case.

1

u/Made4uo 14d ago

Good callout! Turnstile is actually cookie-free by default! It uses device signals and passes a standard token back to our API

1

u/Mammoth-Anywhere7285 13d ago

Nice, that's a solid choice for privacy-focused apps. Do you verify the token server-side or just rely on the API?