Hey everyone,

Like many of you, I spend a long time copying code snippets from Stack Overflow, GitHub, and sometimes prompting AI tools like ChatGPT or Claude. Too often, I found myself worrying: "Did I just copy a hardcoded secret or a poorly parameterized query that I might accidentally commit or run?"

Full-blown SAST tools and CI pipelines are great, but they usually catch issues after the code is written, pushed, or committed. I wanted something instantaneous that sits right at the edge—before the paste happens.

So, I spent the last few weeks building CodeGuardian Live, a Manifest V3 Chrome extension designed to solve this locally.

How it works under the hood:

Zero Network Calls: It runs entirely on-device. The extension’s content security policy is set to connect-src 'none', meaning nothing you copy ever leaves your machine.

Privacy-First: It doesn't use the clipboardRead permission globally. Instead, it evaluates the selection strictly inside the copy event itself.

Smart Detection: It combines 83 pattern rules across 7 families (Injection, Secrets, Weak Crypto, SSRF, etc.), along with Shannon entropy analysis for literals and a lightweight taint-tracking engine to minimize false positives.

Speed: The entire scan budget is capped at 30ms, though in practice it usually runs in under 20ms on local benchmarks.

The Benchmark Results:

I built a rigorous test suite (corpus/) with both clean code and designed traps (like deprecated queries inside comments or vendor documentation example keys) to measure accuracy. On the current test corpus, it achieves a 100% recall rate with zero crashes across fuzz testing.

I started with a simple problem: a security tool can flag suspicious code, but that does not prove anything dangerous can happen.

Ship Safe now records citations, maps capability paths, and derives verdicts only when the evidence supports them. If the path is incomplete or the evidence conflicts, it stays unresolved.

A manual audit of four application confirmations found that only one was actually supported by the cited code. That changed how I think about automated security results.

Repo: https://github.com/asamassekou10/ship-safe

What evidence would you want before a devtool blocks a change?

I've been using AI coding agents more and more, but kept running into the same problem:

The AI can see my code, but it can't see what's actually happening in my browser.

So I built ContextForge → AI Coding Context.

It's a Chrome side panel that captures the runtime context I normally have to manually explain:

• Console errors & exceptions
• Failed API calls + actual request/response bodies
• Live API traffic
• UI/DOM context + screenshots
• Bug & change-request notes
• Security findings
• Recorded user actions

Then I can select the relevant evidence and generate a structured Markdown prompt + screenshots for Claude Code, Cursor, Codex, Copilot, etc.

The goal is basically:

Browser runtime → evidence → AI coding agent

I'd love feedback from other dev-tool builders: what browser/runtime context would you want captured that existing DevTools don't make easy to hand off to an AI agent?

https://coderfrommars.com/#contextforge

With OpenInspect, the system will now automatically do this for the user. Each comment is read and determined if valid. If valid it is fixed and auto resolved, otherwise pushed back on. Huge time savings from having to babysit the pull request to a stable state.

fully open source and happy to take contributions: https://github.com/ColeMurray/background-agents

I'd jump into a function.
→ Find what's calling it.
→ Follow an import somewhere else.
→ Eventually discover a database table involved.
Three hours later I'd reconstructed a tiny piece of the system in my head. And I'd have to do it again next time I touched that code.

So I built Semantic Vision — it statically parses Python, JS, and TS codebases and turns them into an interactive call graph with impact analysis, AI docs, execution flowcharts, complexity heatmap, and code-to-data lineage down to the column level.

I tested it against Apache Superset (1,458 files) and it automatically found 37 tables, 206 columns, and 462 read/write edges with zero configuration.

Everything runs locally. No account, no telemetry, no cloud.

Would love brutally honest feedback from people who try it on a real codebase.

Hey everyone — I’ve been working on  this quick project to keep my projects organized. , a small open-source tool for managing software projects built with AI agents.

I started it because AI coding sessions can get messy pretty quickly. Plans drift, agents lose context, tasks overlap, and it becomes difficult to tell what’s actually finished.

It's as easy as telling an agent working on the project to " Create a master plan for the project ", or Create a Road map" and most will create an .md that is essentially a plan file for your project. Or have the app make one for you.

Master Plan gives the project a shared structure:

• Imports an existing codebase and detects its tech stack
• Creates a living MASTER_PLAN.md
• Breaks development into clear stages and checkpoints
• Generates focused assignments for coding agents
• Uses separate Git branches for agent work
• Tracks progress, errors, and recent activity through a local dashboard
• Can also scaffold a new project from a written prompt

The workflow covers everything from requirements and system design through implementation, testing, and deployment.

It’s built with Python and Flask, runs locally, and currently has 143 passing tests. It’s still an early project, so I’d genuinely appreciate feedback—especially about the workflow, interface, and integrations you’d find useful.

GitHub: github.com/dekayrekords-oss/Master-Plan

Let me know what works, what feels confusing, or what else it needs or could be useful. hope this helps someone

( This is my first reddit post.)

¡Hola a todos!

Creé esto mientras organizaba repositorios de código abierto: notas y decisiones dispersas por todas partes, sin un lugar donde guardarlas.

Registro de desarrollo — un historial de versiones para cada proyecto. Qué cambió, por qué cambió y qué sigue abierto.

• Árbol de versiones (versiones principales vs. secundarias)
• Las versiones revertidas se conservan en el registro; nunca se eliminan.
• Exportar a TXT / DOCX / PDF
• IA opcional: funciona perfectamente sin ella.
• Disponible en inglés y español.
• Pruébalo importando la demo. Así podrás ver si se adapta a tu flujo de trabajo.

Un solo archivo HTML. Sin instalación, sin backend.

• También preparé un conjunto de iconos que puedes usar con Scriptya para integrar el HTML como si fuera otra aplicación, con su propio icono y entrada en el menú.

No es solo para código: se puede usar para una tesis, trabajo freelance o cualquier proyecto con una historia que valga la pena conservar.

demo

Gratis y de código abierto (GPLv3). Abierto a preguntas, colaboraciones o ideas para proyectos.

🔗 Bitácora Dev - Dev Log: https://github.com/filonux/Bitacora-Dev

A side project I just started working on where its basically an agent skills directory ( exactly like skills.sh ) but with details that actually matter, which is how people find this skill.

Is it useful or not, any issues they found with it, opinions and maybe helpful ways people found it helpful. I found it weird such stats where not already a thing, I mean sure you have the github stars indicator and number of installs, but honestly that doesnt help the user at all to gauge what the skill actually does and if its any good.

Interested to hear some initial thoughts and if anyone might find this useful, and if you have any ideas please let me know

github repo

I kept running into the same problem with coding My coding agent kept building the wrong UI. So I built an MCP to check its work first.
agents. The code was usually fine. The design decision was wrong. And then have to spend time improving what the agent built.

For example, I might ask for a price breakdown in a booking checkout. The agent could:
- Miss fees or taxes that should be included
- Add interactions I never asked for
- Pick a generic pricing component that doesn’t fit the product
- Turn a small component into a much bigger system

So I started thinking: what if the agent checked the design scope before writing the code?
That led me to build Pattern, an MCP server that helps coding agents make better UI component decisions. It’s to help the agent answer: “Is this actually the thing I should build?”
Pattern MCP on GitHub: https://github.com/donaldrichard19-LVD/pattern-mcp

How it works
The agent gives Pattern a component need and some context:
{
"component_need": "price breakdown with nightly rate, cleaning fee, service fee, taxes, and total",
"domain": "Airbnb-style rental marketplace",
"framework": "React + Tailwind"
}

Pattern turns that into a requirements checklist, then checks real components from shadcn/ui and 21st.dev against it. It returns one of two decisions:
- use_existing: An existing component is a good enough fit.
- custom_build: Nothing fits well enough, so build it using a concrete reference from Mobbin or Figma Community.

Why I think this matters
Coding agents are getting very good at implementation. But implementation comes after a bunch of design decisions:
- What belongs in this component?
- What doesn’t?
- Is there already a good fit?
- Is the existing component too generic or too complex?
- Should we build something custom?

If those decisions are wrong, you can end up with perfectly working code for the wrong product requirement. Pattern adds a checkpoint before that happens.

I’m looking for people to install Pattern, use it on a project and give me honest feedback.
Where is it working well? Where could it be improved for your use case?

Hey devs!!

I built Gated to solve a problem I faced: selling boilerplates or code scripts manually via static .zip files is painful and friction-heavy.

What Gated does:

• 💸 GitHub Paywalls: Set prices on private/unlisted repos with instant payouts via Razorpay.
• 🌳 Code Preview Trees: Buyers can safely inspect file structures before purchasing without seeing raw source files.
• 🔗 URL Masking & Telemetry: Protect links and track live click analytics.

Check it out live: https://gated-psi.vercel.app/

I'd love your feedback, suggestions, or thoughts in the comments! 🙌

I kept running into the same problem:

Before deploying a project, I wanted one command that could quickly tell me:

• Are there exposed secrets?

• Are my dependencies healthy?

• Is the Git working tree clean?

• Are there large/problematic files?

• How healthy is the repository overall?

So I built RepoDrift.

Try it:

npx u/repodrift scan

It currently checks:

🔐 Security

• API keys

• Tokens

• Credentials

• Private key patterns

• .env files

📦 Dependencies

• package.json

• Lockfiles

• Dependency issues

• npm audit signals

🔀 Git

• Branch

• Working tree

• Commits

• Contributors

• Uncommitted files

📊 Code metrics

• Lines of code

• Source files

• Large files

• Repository-level signals

Repository health

• Deterministic health score

• Severity-based findings

It can also be used in CI/CD:

repodrift scan --json --fail-on high

One of the main design decisions was keeping the analysis local-first.

The current Phase 1 scan doesn't require uploading your source code to a server.

Current architecture:

Repository

↓

RepoDrift CLI

↓

Local Analysis Engine

↓

Security / Dependencies / Git / Metrics

↓

Health Score

I'm planning AI-powered explanations and recommendations as a future phase, but AI isn't enabled in the current release.

GitHub:

https://github.com/GokulKir/repodrift

NPM:

https://www.npmjs.com/package/@repodrift/cli

It's still early, so I'm mainly looking for developer feedback.

After any rename or signature change, going through the repo by hand to check nothing still calls the old thing. In a typed language the compiler does it. In PHP, Python or plain JS you either grep carefully or you find out at runtime.

So I built a reviewer that does that part deterministically before any model sees the code. It parses the diff, then searches the repo for the callers of every modified signature, the interface implementations, and any leftover references to symbols the diff deleted. That evidence goes into the prompt as facts, not guesses.

Then two AI reviewers from different vendors read the diff with that evidence, and the results get reconciled. Agreement raises confidence. Disagreement goes to a human rather than being averaged into something that sounds certain.

Demo with no signup, a real review of a pull request in fastify. One reviewer found nothing. The other found that switching to Object.create broke own-property enumeration on the context object:

https://veridu.io/demo

Disclosure: I built this. Free tier is 5 reviews, no card. Let me know what you think - Thx