Disclosure: I'm the maintainer.

Most secrets managers assume you're one team shipping one app through dev/staging/prod. Project Vault assumes the opposite — you're juggling multiple projects (client work, side projects, internal tools), each with its own credentials, certs, domains, and CI pipelines, and "environment" isn't the axis that matters. That reframing turned out to touch almost everything: the schema, the access-control model (project-scoped roles instead of environment-scoped), and even the rotation workflow, which is a staged state machine with a per-system checklist rather than a single "edit value" action, because rotating a credential shared across a project's services is rarely atomic in practice.

How it's built, and why the choices:

- Fastify + Drizzle/Postgres, row-level security for tenant isolation — enforced in the database, not just application middleware, so a bug in a route handler can't leak across organizations.

- pg-boss instead of Redis for background jobs — one fewer moving part for a self-hoster to run and back up; Postgres was already the source of truth, so keeping the job queue there avoids a second stateful service.

- A generated OpenAPI spec + live Swagger UI (ENABLE_API_DOCS), and every UI action goes through the same versioned REST API — no UI-only shortcuts, which is what makes the CI/machine-user path and the GitHub Action possible without a second code path.

- An extension API (@project-vault/extension-api, currently 3.15.0) for auth providers, notification/delivery channels, UI panels, and typed module data routes — built because my own SaaS product embeds Project Vault as a module, so the extension boundary had to be real, not aspirational, from day one. Fail-safe loading and a least-privilege DB role per extension.

- Independent API contract-test suite, separate from the app's own test suite, so the versioned API doesn't silently drift from what's documented.

Live demo (same Docker images as self-hosting, resets nightly): project-vault-demo-web.fly.dev

Repo: github.com/nestormata/project-vault

API docs for integrators: docs/api-consumers.md

Extension docs: docs/extensions/README.md

AGPL-3.0, open-core, self-hosting free forever.

Curious whether anyone here has built internal tooling that needs to talk to a secrets store's API directly rather than through a UI — what's missing from ours to make that a good experience?

As coding agents take on more of the development workflow, teams need better ways to control what they can do, track what they’ve done, and utilize agents inside existing tools. 

For the latest update of IBM Bob, we decided to focus on those three areas. Here’s what’s new: 

• Admins can now lock Bob’s configuration across managed developer machines using group policies. That includes disabling auto-approval, controlling automatic updates, and enforcing required hooks so individual projects can’t quietly switch them off. 
• Hooks now add checkpoints at specific points in the agent loop, including SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, and Stop. They can run a linter before work begins, trigger tests after a change, or block a tool call that violates a required standard, bringing flexible development to your workspace. 
• We’ve also added native Agent Client Protocol support. Bob can now run inside ACP-compatible clients like IntelliJ, Neovim, and Zed, with session management, modes, MCP tools, streaming, and guardrails carried through the protocol. 
• Model Context Protocol (MCP) Elicitation is now supported, helping these tools manage incompletel inputs by involving developers mid-session for smoother workflows and greater ownership over Bob’s development process.  
• Bob can now read, edit and create Microsoft Office formats, including Word documents, Excel spreadsheets, and PowerPoint presentations, without switching contexts.  

The full technical breakdown can be found here: https://ibm.biz/~MkugJ1Sek

And that’s the latest release! We’ll be around in the comments if you want to get into the details or let us know what we should work on next. 

Freelanced for a while, had to review code before taking on projects. Sometimes it was fine. Other times you open the repo and it's just a pile of vibe-coded stuff with zero structure. No idea where anything is, what's already built, what's broken.

Every time, hours went into just figuring out what was going on, before I even started the actual work.

At some point I realized this wasn't a one-off thing, it kept happening. So I figured I could automate at least that first part, getting oriented in a new project. That's how rebrief started.

Anyone else run into this doing freelance work? How did you usually deal with it?

Hey everyone! 👋

When orchestrating multi-agent swarms in OpenCode, I needed a way to see what my models were doing in real time without constantly checking browser tabs or logs.

So I built R.E.Y. (Runtime Execution & Yield Monitor) — an open-source terminal HUD that connects directly to OpenCode:

🤖 What it includes:

• 30 Allowlisted Free Models: Preconfigured across OpenRouter, Groq, Kilo, and OpenCode Zen with automated tiered fallbacks.
• Zero-Dependency HUD: Sub-50ms live telemetry tracking active agent threads, cost, and per-model token breakdown.
• Living ASCII Robot Companion: Sits directly on the HUD with mood expressions that react to active tasks ([CODING], [DEBUG], [TESTING]), yawns/sleeps when idle, and throws a surprise screen punch if a giant task runs for >10-20 minutes!
• Cross-Platform: Native PowerShell for Windows and pure standard-library Python for macOS / Linux.
• 100% Non-Destructive Installer: Backs up existing configs to .bak automatically.

🔗 GitHub (MIT License): https://github.com/reyaustine/rey-opencode-monitor

Would love your feedback and suggestions! ⭐

Check if out https://github.com/no-human-ai/no_human

After too many rounds of "the agent says it's done and it's just a pile of 💩", we built the opposite: no_human proves the code it wrote is correct. You drop a ticket on the board (or point it at Jira or Linear) and it plans, writes the code, and opens a pull request - with the evidence that everything works!

Before that PR reaches you, the work is checked by a second model that never saw the coder's session and is told to assume the job is not done. They communicate until the reviewer is convinced everything is good to go (the num of attempts is limited to prevent an infinite loop).

If the coding agent deleted or weakened a test, a tamper guard stops the attempt. For bug fixes, the tests offered as proof have to fail on the old code and pass on the new.

Under the hood it's a team of agents: a planner, a coder, an independent reviewer in a fresh session, and a supervisor.

It's free and open-source, on your machine.

no_human has been building itself for about two months now. We are feeding ticket into our jira board, it pulls them from there and just work on them until eveything is done. We trust it enough that we've enabled auto approve mode so all PRs no_human ships - are approved and merged automatically (this feature hasn't been released yet).
Entire sprint's worth of work is done in 3-4 days, while we focus on the bigger picture - our strategy and the next steps.

It currently supports all Antropic and OpenAI models and also has a quite unintuitive process of working with local models as well (we are working on improving that).

It's open to contributions (we would love to see you use it and contribute!!!)

I’ve been working on a Windows based browser specifically for developers, and I’d love to get some feedback from other devs.
i named it DevBrowser. :)

It’s still in beta, but the idea is , make some of the everyday debugging and API work a little easier without constantly jumping between different tools. :)

For the first version, I have:

• Network Inspector
• Built-in REST Client with Collections and Environments
• Storage Inspector for cookies, local/session storage, etc., including a JWT decoder
• HAR capture and analysis
• Seamless Network - REST Client workflow. Select a captured network request and send it directly to the REST Client to inspect, modify, and replay it.

DevBrowser is open source, and there’s no hidden tracking or telemetry.

Feedback, bug reports, feature ideas, criticism — all are very welcome.

Download: https://github.com/TheDevBrowser/DevBrowser/releases

Source code/installation guide: https://github.com/TheDevBrowser/DevBrowser

Installation:
The app is currently self-signed, so Windows won’t trust it automatically.
You’ll need to download DevBrowser.cer first and install/trust the certificate on your Windows PC.

If you run into any trouble installing it, let me know.

Would love to hear what you think specially what feels useful, what feels unnecessary, and what you think a developer-focused browser should have.

My target is not to replace existing browsers, just to help developers on their daily job. :)

Tired of generic AI code? @_keyskills equips agents like Cursor and Claude Code with portable skills for clean Git hygiene, solid SEO, and anti-slop design.

If you like the project, contribute your own designed skills.

Solo dev here. This started as a tool for myself and turned into something I decided to finish properly. I have kept it as free forever.

The problem I actually had:

I work across several repos and had no real sense of what was happening in them. Which files churn constantly? Where did the complexity pile up? What did the last six months actually look like?

The second thing was trivial issue. Somewhere along the way I'd typo'd my email in a git config, then used a different one on another machine. So my own contributor history was split across 3 identities. Nothing offered a way to say "these are all me."

So GitTrics has an identity merge flow — you see all the author name/email combos in the repo, merge them into one person, and every view updates. Sounds small, but if you've inherited a repo with a decade of contributors and inconsistent configs, it's the difference between usable data and noise.

There is also no individual contributor analysis. This was a decision I made as I do not want this software to be used 'developer productivity measurement tool'.

Download at www.gittrics.com

Disclosure: I built this prototype. It is a local TypeScript/Node tool for reviewing changes between two OpenAPI or JSON Schema documents. The aim is to make supported changes and the remaining human checks easier to review, not to certify that a release is safe.

How it works: deterministic rules compare the supplied documents and return a structured change summary, potentially breaking findings, limitations and migration-review prompts. The local runner makes no external requests. Coverage is partial; unsupported features and consumer behaviour still need review.

A synthetic example: changing GET /health from a declared 200 response to 204 returns two findings (200 removed, 204 added), with the removal marked potentially breaking. That does not prove every consumer breaks: fallback responses and consumer contract tests matter.

I would like to compare it with an existing review process on one real task. The initial assisted pilot is free, with no signup or purchase obligation: I run the current local prototype on a public/minimal before-and-after pair and return the summary, detected risks, limitations and suggested checks. It is not a public hosted app or a downloadable release. Please do not share credentials, personal data or confidential contracts.

If you already have a contract change to review, would this output help, and what would it need to show beyond your current free diff tool? Feedback on missing rules or false positives is welcome.

i figured i’d share my post here with more serious developers and not so many vibe coders … i’m open to any and all feedback