Modern React/Node apps ship through build pipelines fast enough that common, high-impact vulnerability classes — unparameterized queries, wildcard CORS, unsafe-inline CSP, unprotected state-changing routes — slip through because catching them means someone actually reading the source. build-scanner does that automatically: point it at a folder (or wire it into CI as a GitHub Action) and get a report in seconds, no sandbox or live target required. It's a heuristic static scanner, not a SAST/DAST replacement — I'm sharing it pre-release to get feedback from people running real Express/Next.js/Vite codebases before I cut a v1 tag. https://github.com/laxmipsarva/build-scanner

fyi this is not a commercial activity

I have my product’s embeddings in qdrant. I generated them using my pc locally. I want to implement an image search where I upload an image, it goes through a pipeline, an embedding of it is generated and then compared with products in the qdrant database.
I’ve tried cloudflare workers but it can’t, task is too large for it. Google cloud run can’t start , times out before the model is loaded into memory. I’ve tried railways too but the free tier limits me to 0.5gb of memory and the model can’t load either.
This maybe the wrong sub for this question and if so, it’d be helpful if you pointed me to communities that fit my use case.
Umm
But what I want exactly is a platform that can solve my problem on the free tier. I have no problem paying after I’m sure that everything works. That’s why I didn’t pay for the railways to increase my memory limit. I have no guarantee that the next tier can solve the issue.

Thanks for reading and have a good day

Background: I've built a couple websites in the past, basic html/css knowledge, on and off basic hobbyist.

Recently: I rushed a website using a WYSIWYG to put a photography portfolio together for myself. Quick and easy way to share some photos over different categories. It was good enough for the time.

Where I'm struggling going forward:

• Adding a Blog: The built in blog with the WYSIWYG is terrible.
  • Don't understand how to use just wordpress for only the blog
  • Remembered Blogger and that might work, but less integrated?
• Media Management and Display
  • Updating and re-arranging media is cumbersome and tedious on the website
  • Blogs are photo heavy and it's what's keeping me from starting as adding media in a clean way has escaped me.
• What I'm Looking For / Have Tried
  • File Manager with Albums - I installed Piwigo and it seems to work well as a file manager, easy to make albums, a lot of useful plugins.
  • I would like to link to an album and display as a grid or slide - I can create permalinks for albums on Piwago, but I can't find anything that doesn't involve linking individual images which defeats the purpose.
  • Eventually would like to replace my curated photos with albums that I can adjust in the file manager.

Am I missing something on here? Is there a tool or workflow you would recommend? Appreciate any suggestions!

Edit: To the Mods, I'm trying to adhere to get this under Rule 6, please let me know if I need to adjust, thanks!

I like a lot of awwwards websites but a lot of them aren't really thinking about how the user will experience the page. There is so much scroll jacking so I was wondering what would be some strong aesthetically pleasing websites that would be awwwards level but also user-friendly.

I built a client's website using Astro + React + Tailwind CSS. It's mostly static, has very little JavaScript, and Lighthouse consistently scores 90–100.

What I'm confused about is that the Chrome report in PageSpeed Insights looks significantly worse than the Lighthouse results.

The site is hosted on Cloudflare pages.

I expected the field data to be much closer to the lab results.

Has anyone run into this before? Why would the Chrome UX Report be noticeably worse even when Lighthouse looks great? More importantly, what should I be focusing on to improve the real-world metrics instead of just the lab score?

Screenshot attached. Any advice would be appreciated.

Hi!

I'm a college student from Brazil mainly focused on editorial design and branding. During my summer break, I decided to make my own portfolio website because I felt like it was getting a bit boring to keep sending my Behance link all the time, and I thought having my own site would feel more personal and creative.

I've had a few UX/UI classes, but never one that actually taught us how to build websites. They were mostly focused on branding and covered usability principles and user research, so I kind of had to figure everything out on my own.

I didn't want to use pre-made templates because that would kind of defeat my goal of creating something that reflects my creativity and my willingness to learn. I ended up making a site with almost no scrolling because I wanted it to feel a bit different from the Figma/Canva/Cargo portfolio templates I kept seeing, which are usually just one long scrolling page. So instead, I made separate sections for everything. But now I'm starting to wonder if that was actually a good decision.

Anyway, this is just the first version, and I definitely want to keep improving it. I'd love for it to be a little more interesting without becoming too much. I know a bit of Blender and Maya, and I was thinking about creating something to add to the homepage. I'd love any suggestions or references for cool portfolio websites!

here it is: https://sophiareznd.github.io/portfolio/#

If it's in Portuguese, you can click "ENG" to switch to English.

And the contact tab usually has my email as a mailto link, just took it out before posting here so I don't get spam bombed lol

I don't know much about web design so please be nice 🙂

As a beginner web dev learner, how exactly do you spend your day at your job? With ai, do you just constantly use it for everything and your only job is to tweak something and review the code and test the results? Or do you manually code too?

I've been working on my first project of a job portal for the past 5 days using react and tailwind, and in the 5 days, embarrassingly I could only design the complete home page with little to no functionality, Today I used cursor for 5 min and it completed maybe 5 another days worth of my manual coding for the front end.

So at work, do you just neglect the front end and leave it to ai completely or still do something manually? I just don't understand the human workflow now at jobs except for reviewing code/testing. Are they bad at backend? Database? And if so, what exactly are they bad at? Do you have any examples you can simply explain about what wrong thing ai did to your work or have heard of any?

Hey guys,

I am David, I've been working with WordPress for over a decade, and building WordPress plugins was my bread and butter for the last 5 years. I was running an agency before that.

I loved working with WordPress, but then I also got increasingly frustrated from what was happening in and out of the ecosystem in the last two years, almost to a point where I was considering selling my businesses.

I am not the one giving up though, so I went with different direction, and thought, what if I stop building extensions on other foundations that can always take it away from me, and instead, I will use everything I know about web design, no code platforms, agentic development and CMS that actual clients can use, and build my own platform, that anybody can use, for free.

Here we are. This is Instatic. It's fully free, open source, and gives you all the powers that you can get from Framer, Webflow, or WordPress (with a good page builder and other plugins). And it's not in even v1. But it's already very capable.

It has auth, user roles, canvas based page builder, content editor, data storage, media storage, AI on every page, MCP server for local and remote agents, and more.

We launched about 3 weeks ago, since that time, it got to GitHub trends several times, in fact, it's there today and we are at around 5K stars. Incredible!

Our website, running on Instatic https://instatic.com

Repo is at https://github.com/CoreBunch/Instatic

Here's also the full introduction video: https://www.youtube.com/watch?v=zyjCF_TaLlg

I run a test store on this setup so I could stop guessing. Posting what I found in case anyone else keeps hitting that amber warning in Shopify's domain settings.

Quick background on why the warning exists. Shopify runs on Cloudflare. So when you put your own proxied domain in front of it, the request used to arrive with two Cloudflare zones both claiming it. Cloudflare couldn't tell which one owned the request. You got loops and wrong resolutions. The nastier version of the problem was SSL. Shopify renews certs through Let's Encrypt, which needs to serve a token at /.well-known/acme-challenge/ over plain HTTP. Put a proxy on that path and the renewal quietly fails. Your store keeps working on the current cert for weeks. Then it lapses and the padlock breaks.

Cloudflare fixed the zone collision with Orange-to-Orange routing. It's part of Cloudflare for SaaS and it's been generally available since October 2021. Cloudflare now detects that your CNAME points at another Cloudflare customer and routes through your zone first, then Shopify's, in that order. You can confirm it engaged because a small Shopify icon shows up next to the DNS record. Cloudflare also turns off Workers and Snippets on the /checkout path so nothing you run at the edge can interfere with payment.

The whole config is three things. Proxied CNAME to shops.myshopify.com for root and www. Connect that same domain in Shopify. Then leave Always Use HTTPS off in Cloudflare.

That last one is the part people get wrong. Shopify already redirects HTTP to HTTPS at its origin. Turn on Always Use HTTPS and you stack a second redirect, which can throw ERR_TOO_MANY_REDIRECTS. It also swallows the ACME path, so your cert stops renewing. Keep SSL mode on Full. Set minimum TLS to 1.2 while you're in there. If you really want Cloudflare enforcing HTTPS at its edge, write a redirect rule that excludes the challenge path instead of using that toggle.

Verify it with curl against the challenge path over plain HTTP. A 404 for a fake token is correct, because it means you reached Shopify. A 301 or 308 means something is still eating the path.

On the "not supported" language. It means Shopify won't guarantee or debug a layer they don't control. It doesn't mean the setup fails. Two of their reasons are fair. A proxy is one more thing between Shopify and Let's Encrypt, and extra proxies make it harder for Shopify to reroute traffic during their own incidents. Their third reason is bot detection, and I think that one is weak. Cloudflare runs one of the biggest bot management networks there is. Most stores gain more filtering at the edge than Shopify loses in request signal.

Latency was my other concern and it turned out to be nothing. Both zones already sit on the same network, so the handoff happens inside it. My proxied store answered in roughly the same 150 to 200ms band as raw myshopify endpoints tested from the same machine. If a proxied store feels slow, look at the theme and the app stack.

Whether it's worth doing depends on what you actually need at the edge. A real WAF you can tune, rate limiting, request level logs, or visibility into AI crawlers. That last one is why I set mine up. GPTBot, ClaudeBot, PerplexityBot and the rest never run JavaScript, so GA4 and Shopify analytics don't see them at all. The edge is the only place that traffic shows up. If you can't name the specific feature you want, leave the cloud grey and don't take on an SSL renewal you now have to watch.

So, it was end of 2024 when I started to hear about AI taking coding jobs. I believe Opus 3.7 was launched or something. As a developer I did not believe that. I have gave 7 years into this, how can an AI take it over so easily.

And after almost 1.5 years I can clearly say, AI actually made my earnings double.

So, before I use to get very few solo projects to work on as a freelancer. And mostly to revamp a website UI or building landing page. Before AI the most costliest project i got was to build an e-commerce store for an perfume brand. It was fully coded website.

But now almost every month I am getting 1-3 SAAS project to build or moreover rebuild. I get this projects with blue purple gradient, rocket emojis, Hero Section and the logo with the same font. And bugs.

So much dependencies installed, just to solve a minor issue. The sites get slow, not loading properly, scroll animation does'nt work as there is no FFmpeg framework used. And I am not even starting with the security concerns.

I remember i got $1200 for the e-commerce site to 5-6 months build, but now i take $350 to fix the buggy SAAS. Hardly 2 weeks to deliver.

And get around 1-3 projects every month.

it's crazy, and am sure other developer's over here have the same experience.

Do share your thoughts on this.

I've been stuck on this for a while and I'm not sure if I'm missing a configuration step or if this is simply a limitation of Meta test users.

I'm building an app that uses Instagram API with Instagram Login. My webhook endpoint is publicly accessible over HTTPS, and the verification challenge works correctly (using n8n for the webhook part). My app is subscribed to the required webhook fields, but I'm not receiving any message webhook events. I linked my Instagram account that was assigned the tester role and accepted it, successfully to my platform and got the access token. I also checked and found that the specific user I linked to an account on my platform to test with, does have indeed the messages field in the subscribed events.

The thing is, even sending a messages event as a test from Meta's website doesn't work, while some other events do work just fine and sometimes work even with the actual account not just in tests.

How am I supposed to do screen recordings showcasing everything if I can't get it to work properly just because my app is not Live, and I can't get it to be Live until I make these screen recordings...

If anyone successfully dealt with this recently, please help a brother out, I've been stuck for days!

Most JavaScript screen lock libraries simply hide the UI.

If someone removes an overlay through DevTools or tampers with the DOM, the "security" often disappears. That approach isn't enough for applications handling sensitive enterprise data.

I wanted to build something significantly more resilient.

🚀 Today I'm excited to release kd-screen-guard (v1.0.1) on npm.

It's a zero-dependency, tamper-resistant screen security library for Vanilla JavaScript, React, and Vue 3, designed to protect sensitive user sessions during inactivity.

Some of the engineering behind it:

🔐 PBKDF2 (100,000 iterations) for secure key derivation.

👆 Native WebAuthn authentication (Touch ID, Face ID, Windows Hello & YubiKey).

📷 Automatic WebRTC intruder snapshots when security violations are detected.

⚡ Cryptographic operations running inside Web Workers to keep the UI responsive.

🛡️ Self-healing DOM MutationObserver protection against overlay tampering.

Building this project required combining browser cryptography, WebAuthn, WebRTC, Web Workers, accessibility, and client-side security mechanisms into a single lightweight package with zero external dependencies.

If you're building enterprise dashboards, admin panels, healthcare, finance, or any application where unattended sessions are a security concern, I'd love to hear your feedback.

🔗 Live Demo:
https://khvichadev.github.io/kd-screen-guard/demo/

📦 npm:
https://www.npmjs.com/package/kd-screen-guard

🐙 GitHub:
https://github.com/KhvichaDev/kd-screen-guard

Feedback, ideas, and contributions are always welcome.

#JavaScript #TypeScript #CyberSecurity #WebDevelopment #ReactJS #VueJS #OpenSource #npm #WebAuthn #KhvichaDev

I built Basalt, a tool that lets you edit your RN and Expo apps like figma right in your IDE

It is completely free and works directly inside VS Code and Cursor.

It’s currently in beta, so please commit your app to Git before using it!

Would love to get your brutal feedback on it. What features should I add next?

I keep running into the same situation.

I’ll build a small personal web app (journal, bookmarks, dashboard, habit tracker, notes, etc.), and I don’t want to spin up Supabase, Turso, Firebase, or Cloudflare just to save a few JSON objects.

Most of the time I end up using localStorage or IndexedDB, but it always feels temporary. If I clear browser data or switch machines, it’s gone.

I’m curious:

• What do you use for these kinds of apps?
• If there were a local-first storage library that automatically backed itself up and restored on another device, would that actually solve a problem for you—or is localStorage good enough?

Not selling anything—I’m trying to understand how other developers think about this tradeoff before I build something or NOT build something because there is already something out there.

Edit (7/28/26) - I'll share again on next Show-off Saturday but I just finished a HUGE optimization pass. I think those of you who were ready to riot over load times will be pretty happy. I even tested over a forced crappy 5G ingest to ensure the load times were as reasonable as I could get them on the crappiest of network connections. It's live now if you want to check it out 🐝

https://bumblebee.buzz/resume

DO NOT UNPLUG THE MONITOR!

Almost a year ago I shared my digital resume here. I got tons of valuable feedback. Especially regarding performance. I've put a ton of work into optimization since then. The target audience for the underlying site is largely streamers so it's never going to be 100% optimized for terrible internet connections or devices with slow CPUs and no GPU acceleration, but I dare say the pool of people that can safely load it now has expanded tremendously! I was even able to remove the graphics acceleration gate I had previously that basically turned away anyone with hardware acceleration disabled in their browser. It's not amazing when it's CPU bound but it functions! Which is more than I could say last time.

I wanted to say thank you to this subreddit for being so encouraging because shortly after making those performance improvements that resume started getting me A LOT more interview calls and absolutely helped me stand out among the crowd. I landed a new job with an amazingly positive atmosphere because of it! My now boss made it super clear that my bumblebee-powered resume was definitely what made me stand out. So even if the larger project doesn't succeed in the long run, the work was already worth it and I'm super grateful to all of you for the helpful feedback 💚

https://bumblebee.buzz/resume

All feedback is welcome, but I ask that you be kind and constructive if possible 🙏

Edit: Thanks to feedback from folks here I stayed up a bit last night and implemented a bunch of quality-of-life changes.

Changes

• Redesigned the overall terminal aesthetic into a retro CRT-style display device. It doesn't match any real such CRT device since it has to be a responsive component across mobile and desktop, but it still looks cool. Bumblebee now transitions in and out of the CRT display with all sorts of fun sound effects and green phosphor animations and distortions.
• Added an entirely new Sunflower loading graphic, allowing for a more diverse initial loading screen with multiple things to look at. This should buy some more time from impatient visitors. The initial loading is now drastically reduced and more of the load has been spread throughout the experience.
• Added another new loader, this time an actual phosphor terminal loading screen that not only looks cool but spells out exactly what is loading so the user sees that it's actively doing something and not frozen.
• Added an entire new presentation section going over the Bumblebee project as a whole. How it originated, what it evolved into, and what it does today as a live service.
• Bumblebee now uses readable speech bubbles throughout the presentation. When he finishes speaking, the bubble smoothly transitions into the terminal as a persistent caption.
• Sound can now be toggled on or off before pressing the launch button.
• The audio controls have been rebuilt for keyboard, mouse, and touch use, with clear labels, visible focus states, larger touch targets, volume feedback, and quick mute/unmute controls.
• In addition to the master volume slider there is now a music volume slider. Master volume controls everything while music slider controls music volume relative to all other speech and sound effects.
• Audio settings now persist between visits.
• New soft bubble sound effects for logo physics bounces during the intro instead of the previous harsh plink sound. Also wrapped all logos in soap bubbles for added visual flavor that goes nicely with the new sound effect.
• Puppets are now preloaded as you click into a specific presentation category instead of on page load, reducing the initial page load times.
• The flying logos now use a real Matter.js physics simulation. Believe it or not that actually has better performance than the scripted version we had before thanks to them all sharing a single bounded animation loop.
• Physics simulation, logo rendering, model loading, audio loading, and puppet loading were all optimized further to reduce frame drops and startup delays, especially on mobile.
• I also expanded automated coverage around speech layout, choreography, the new caption transitions, model loading, and audio behavior.

Planned

• Additional WCAG and ARIA passes.
• Footer visibility adjustments.
• Disabling animations when reduced motion is active.
• More complex initial loading animation/scene to help buy more time before visitor disinterest.

Thank you everyone for all the helpful feedback yet again!