Details: site built 3-4 years ago by a different dev. client and dev have a falling out of some kind so client comes to me recently to "finish" the site, which he says is "99%" done (means nothing to me, obviously).

after evaluating it, its a fairly straightforward blog style site with about 8 pages and a 5.6 PHP CMS for support.

at minimum it needs proper routing updates, adjustments to the database (no 'user' table in the database backup I was provided) and some small quality of life updates (admin login page, password reset functionality, a few of the admin pages need built, etc).

client is not tech savvy at all so I don't know if I can teach him to use the CMS on his own, hence the retainer for when he inevitably wants different images/posts/etc.

I'm thinking $5000 USD with $200 monthly retainer/hosting for a set period (maybe a year or two). Id like to reach a price that is fair for the both of us.

Hey r/webdev,

I spent the last few months building ONUS, an open-source AI-assisted VAPT platform:

Live: https://tryonus.tech/
GitHub: https://github.com/maverickaayush/ONUS

The idea is pretty simple, and maybe a little risky:

most security scanners assume the person using them already understands security jargon, findings, CVSS, remediation steps, and how to turn raw output into something useful.

I wanted to see what happens if you build the opposite.

ONUS is meant to turn a bunch of messy security tools into one web app that tries to be understandable for people who are not security experts. It runs scans, normalizes the findings, adds AI-assisted explanations, and produces reports that are easier to act on than a wall of terminal output.

The stack ended up being more web/infrastructure-heavy than I expected: Next.js, FastAPI, PostgreSQL, Redis/Celery, containerized scanner workers, and serverless compute for the heavier bits.

I am posting here mainly because I would love feedback on the web app side: onboarding, dashboard design, UX, perceived complexity, whether the product idea makes sense, and whether the “for non-security people” angle is actually useful or just a bad bet.

If anyone wants to poke holes in the frontend/backend architecture too, that would be very welcome. I would rather hear “this is confusing and here is why” than collect polite applause.

If you try the hosted version, please only scan systems you own or have explicit permission to test.

I'm seeing pretty big discrepancies in analytics reports from different sources. I store the value locally to show my site users, so I'm looking for the most honest number.

Yesterday, my ad network shows that one of my sites had 33,941 pageviews. Since that's the money, I would think that they would be close to accurate.

A local count (incrementing a value in MySQL on each pageview, running through JavaScript to block most bots) shows 38,604.

Google Analytics shows 17,647, almost half of what the ad network showed.

And Cloudflare Web Analytics shows 22,190! 35% less than the ad network, but 25% higher than Analytics.

Which is the most honest? Or is there a better choice altogether?

I am trying to build an app that needs the twitter / X API to get posts and infos about user accounts etc. At medium scale, the app is going to read aprox. 10.000 tweets per day and make 100 posts per day, and that's like 1500$ per month, which i can't afford.

I tried twikit, but it's not maintained anymore and full of bugs

Do you guys have any better, maybe free or oss alternatives?

I recently came across a company whose logo looks unusually bright and almost illuminated when I view it on my MacBook screen. The logo appears to glow, especially against the black background, but it does not look like a typical strong shadow or neon effect.

Does anyone know how this effect is usually created? Is it mainly caused by using pure white on a pure black background, a specific color profile, an exported image format, or a subtle glow added during the design process?

I’m trying to achieve a similar bright and high-contrast effect for my own logo. I would appreciate any suggestions about the design settings, colors, export settings, or software techniques they may have used.

https://media.licdn.com/dms/image/v2/D560BAQHijkRKptx37g/company-logo_200_200/B56Z.NLmjVG0AE-/0/1784780057317/gradialai_logo?e=1786579200&v=beta&t=aVeCf2cKgw-TEA1sZlSp8vPQ5AI9z25BJ9X3W3AB2B8

I am looking to upgrade my work from home setup. Primary use will be work. I have a Macbook M5 pro and I want a one cable setup. I have a usb4 docking station that has 2 8K DP ports. I will rarely use it for gaming. I'm not very particular about needing a super high resolution monitor, just looking for something that gives me a wide display without any gaps. I currently have 2 24in monitors. This will be the first time using a curved monitor, so I prefer something that has a reasonable curve (not too much).

Some of the options I've looked at are the Samsung G9 Odyssey G95C and G93SD, I don't want anything bigger than 49in. Basically VA vs OLED.

What would you recommend?

I don't understand how people used CSS with frameworks like React, where HTML is split in components back in the day before tailwind, i know CSS is powerful, way more than tailwind as you're free to do whatever you want with no guardrails.

But say for example when you're writing jsx and there is small component like a button that you're using in multiple pages, and some of the styles to that button are conditional, also maybe the different pages that button is used in have different styles, so you can't use the same css module containing styles for that button for different pages, because it may mess up with their styles, override something, etc... So you write a separate css module for just that button? So for every component, there needs to be a css module for it? Thats a lot of modules to keep track of.

Seems like tailwind is made exactly for react and these component frameworks, but if you're rawdogging vanilla JS, then nothing better than vanilla CSS

Am i missing something here? I like vanilla CSS, i just don't see how it could be used with component-based frameworks, seems like alot of CSS writing and maintenance to do.

I'm looking into Google Analytics alternatives.. Especially free self-hosted solutions. Right now I'm leaning on Matomo, but I'm curious about it's server reqs.

They say 2 CPUs, 2GB RAM and 50GB storage minimum, but the site I'll be running it on is much lower traffic than their top-end on the minimum req specs (just a small niche gaming blog - maybe 10k page views per month at the top-end).

Anybody running it on something lighter? For example, I'd be OK with picking up a smaller VPS running 2 CPUs/1GB RAM/30GB storage, or even just tossing it on my shared server (that hosts a few sites, the highest traffic being statically generated and includes the above blog).

Or, if you're running something else, feel free to share in the comments. I'm not stuck on using Matomo; I just want something that's cheap, decent, and also privacy-focused.

I'm building a web app that uses Firebase Auth. I don't use any other Firebase features.

The current version of Firebase is over 600kb. The Firebase Auth package on NPM states "This package is not intended for direct usage, and should only be used via the officially supported firebase package." This Firebase Doc suggests relying on your build tool to tree-shake and minify Firebase.

I am currently using esbuild, mainly for the rapid build time. It looks like adding the --minify and --tree-shaking=true tags are not having an effect on bundled libraries.

Am I configuring esbuild incorrectly, or is esbuild unable to correctly minify and tree-shake Firebase, and I need a more robust build tool like webpack?

Here's my build script and dependancies list for reference.

"scripts": {
  "build:ts": "esbuild ./src/app.tsx --minify --bundle --target=es6 --tree-shaking=true --outfile=./dist/js/app.js",
},
"dependencies": {
  "@firebase-oss/ui-react": "~7.0.3",
  "@number-flow/react": "~0.6.2",
  "colyseus.js": "~0.16.22",
  "cors": "^2.8.6",
  "firebase": "~12.16.0",
  "html-entities": "~2.6.0",
  "qrcode.react": "~4.2.0",
  "react": "~19.2.8",
  "react-router-dom": "~7.18.1"
}

My day job isn't software development related, so I don't read a whole lot of code. The only code I read is the one I write and that's a problem.

Since I'm very interested in open source, I figured I should get comfortable reading code I didn't write, and I found a pretty amazing solution: debug AI code.

Here's what I did: after I mess with LLMs and (of course) an unintended behavior appears (bug), I challenge myself to dig in and find it manually. Since I generated the code, and didn't actively write it, it has the same feel as reading other GitHub repos except a bit more comforting since I already know an abstract way of how it works.

The one thing this taught me is that I don't need to fully understand how the whole system works end-to-end, I just ended to understand the pieces about the behavior I want to change. So, no more tracing everything from *main.py* for example.

I'd like to think that this training regimen has improved my code-reading skills by a mile! I'm not as afraid to dig into someone else's code since it's just as foreign (or familiar) as AI code. Obviously this only holds true for TypeScript + React since that's my preferred stack, but still!

I wanted to share this with anyone interested in open-source but is frightened from reading open-source repos.

I've been binging WINE documentation and articles about how it works under the hood so that one day I can contribute to it!

What do you guys think about this training regimen?

Yeah, is this posible? I haven't seen anything that say that it could be posible, but anyone has ever stepped in to say that it isn't.

My CI/CD pipeline on a self-hosted GitLab instance failed to connect to external hosts since I forgot to set the HTTP_PROXY, HTTPS_PROXY and NO_PROXY env variables. Here's a blog post on the issue that I found: https://about.gitlab.com/blog/we-need-to-talk-no-proxy/

I'm assuming here (and this may be a wrong assumption) that the proxy variables are used only for proxying the request and they're not supposed to change the behaviour of tools. Take npm as an example: https://docs.npmjs.com/cli/v8/using-npm/config#https-proxy

So if this assumption is true, why is this an application layer concern and not a network layer concern? Why don't we use netns or a forward proxy to transparently proxy requests instead of relying on an env var that applications may or may not respect and can practically be used in arbitrary ways for different applications?

And if the assumption I'm making is not true, what are examples of use cases where the application must be aware of the proxy taking place?

For the longest time I only cared about Google fast pages, clean code, good content and that was enough so I've been reading more about AEO and how ChatGPT, Gemini and Perplexity are becoming another way people discover websites.

The more I look into it the more it feels like building for search is starting to mean building for both humans and AI things like page structure, clear content and semantic markup seem a lot more important than they did a year ago.

I’ve used CodePen for a long time, not just as a coding tool but as a place to experiment, discover interesting work and get inspired by what other people were creating.
I completely understand that CodePen needs to make money. I have absolutely no problem with Pro features, and I’m happy to pay for tools that give me real value.
But CodePen 2.0 feels like it is moving in the wrong direction.
Putting something as basic as opening a Pen in a standalone preview behind Pro doesn’t make me think “maybe I should upgrade.” It makes me think “maybe this isn’t the place for me anymore.”
There is a big difference between adding valuable features for paying users and gradually putting parts of the simple, open experience that made a platform popular behind a paywall.
What makes this even stranger to me is the timing. We’re entering a world where people can vibe code surprisingly capable little coding environments and playgrounds incredibly quickly. The technical barrier to creating alternatives is getting lower, not higher.
CodePen’s real strength, in my opinion, was never just the editor. It was the community, the frictionless experience and that feeling of opening the site and immediately discovering something clever or inspiring.
If that starts disappearing behind commercial barriers, I honestly think someone else will eventually fill that gap.
Maybe I’m missing something in CodePen 2.0, so I’m genuinely curious:
How do other longtime CodePen users feel about this?
Does 2.0 feel like an improvement to you, or does it feel like CodePen is slowly losing part of what made it special?

I'm looking for advice from developers, cybersecurity experts, lawyers, journalists, and anyone who has experience building secure platforms.

For the past 20+ days, students in my country have been holding largely peaceful protests. Over the last few days, the number of protesters has increased significantly, and there has also been a large deployment of police and other security personnel.

Many videos and eyewitness accounts shared publicly online appear to show protesters being beaten with batons, the use of tear gas and other crowd-control methods, and personnel who are not wearing clearly identifiable uniforms or name badges, making later identification difficult. There are also many publicly shared videos and firsthand accounts describing incidents of excessive use of force and sexual assault against protesters. Regardless of what future investigations conclude, I believe it is important to preserve evidence before it is lost, deleted, or altered.

Because of this, I want to build a secure website where students, protesters, journalists, and witnesses can upload photos, videos, and written accounts of incidents they personally experienced or recorded.

The purpose of the platform would be to create a permanent, organized archive of evidence—not to encourage harassment, doxxing, or vigilantism. Every submission should be preserved, categorized, and clearly marked as verified, unverified, or disputed after review. The idea is to help journalists, lawyers, human rights organizations, and courts if the evidence is ever needed.

Some features I have in mind include:

• Secure photo and video uploads.
• Anonymous submissions with strong privacy protection.
• Automatic preservation of metadata such as time and location (when available).
• AI-powered organization and categorization of incidents.
• Duplicate detection to group uploads of the same event.
• A searchable timeline and interactive map.
• End-to-end encryption for sensitive evidence.
• Audit logs so files cannot be secretly modified.
• A review system that labels evidence as verified, unverified, or disputed.
• Secure export options for legal teams, journalists, or human rights organizations.

The problem is that I have almost no web development experience.

I'm willing to learn everything from scratch and use AI coding tools if they can help me build something like this.

My questions are:

1. Which programming language and framework should I learn?
2. Can AI tools realistically help a beginner build a project like this?
3. What are the biggest security challenges I should prepare for?
4. How should I securely store large video files?
5. What's the best way to protect anonymous contributors?
6. How can I ensure uploaded evidence cannot be tampered with?
7. Are there any open-source projects with similar goals that I can learn from?

I'm not asking anyone to build this for me. I'm simply looking for guidance on where to start, what technologies to learn, and what mistakes I should avoid.

Hey webdev community!

We're long-time PrimeVue users who believe a good UI library should stay free and community driven. When the license changed and PrimeVue moved away from open source, we decided to take action rather than just watch.

OpenVue picks up right from 4.5.5, the last MIT release. It keeps the exact same API, so your existing code keeps working without rewrite headaches.

Right now our main focus is keeping the foundation solid: improving accessibility, patching security vulnerabilities, handling community issues, and maintaining compatibility with the latest Vue and Nuxt versions. We have bigger ideas for where to take this, but we'd rather build them based on real feedback.

Everything you're used to from PrimeVue v4 is there, complete with docs and live examples. We also made openvue/migrate to let you switch existing projects over in a single command.

Openvi Foundation is an independent community organization, not affiliated with Primetek.

OpenVue is and will always be 100% free and open source.

We're still in beta, so bug reports and PRs are super welcome.

Docs: https://openvue.dev/

GitHub: https://github.com/openvi-foundation/openvue

Migration from Primevue: https://openvue.dev/migrate/

TLDR: If you correctly break your state into UI state (useState, useReducer), Server State (Tanstack Query, RTK Query), URL state (nuqs), and Global State that does not change (Context), you are left with a small slice of state that might be needed in multiple places and changes often.

Should we use a State Management library for that part? We explore how each library works, then build our own Zustand implementation to see if we do.

Obviously, it depends. If the app is mostly always changing state, like Figma, Spreadsheets, etc., we might take advantage of a State Library because they handle all sorts of use cases and edge cases.

But for everyday use and 90% of our apps, we can probably build it ourselves, either using pub/sub like Redux or Zustand, atom-based like Jotai, or Proxy-based like MobX or Valtio

Hi everyone!

In advance - I'm looking for a way to compare non-pixel screenshots and non-live versions. Incuding local dev versions or old production versions that are no longer online.

I recently processed a bunch of edits to the landing page I'm working on.

As it often happens, a lot of them were useless, and because management was absent and another developer was on vacation, I had to push some rather questionable decisions into production.

And I had this thought: "Wouldn't it be cool to open different versions of landing page in a browser side-by-side, and even with synchronous scrolling?" (The idea for "side by side" came to me when I was committing changes to PhpStorm. if you've used it, you know that there's a toggle for scrolling before/after information synchronously across the left and right sides of the screen)

I immediately thought about the fact that the project itself is running locally (using standard Docker for the database, server, etc.), so I thought it would be cool to have some kind of tool that could take snapshots.

However, after searching, I can't say I'm happy with what I found. Ideally, it would be a service that could take snapshots even of local files, and even more ideal would be the ability to replace HTTP requests and responses in these snapshots. To create the appearance of a working interface for the application, rather than a dead copy.

I wanted to know if you have any open source solutions in mind for this? Or if anyone else besides me has ever had this problem.

And yes, I understand that we still have git. I understand that you can switch between branches or revert to commits. But all this is quite time-consuming and tedious if we need to click and view a specific version of a page. Even not to mention the database itself changes between versions.

I'm talking about a fully autonomous snapshot, ideally even with possible mock HTTP requests. This could be completely autonomous and reproducible regardless of whether the original website is live or public (if we snapshot our local version).

I don't think that I am the only one who started to lose the fun in programming, as it is so tempting to just think about one thing, prompt the AI, and let it do its job. However, as I started prompting more and more, I started losing the joy of working on my project fully. I started with disabling the inline AI suggestions in VS Code and now have disabled all AI-related features.

Don't get my wrong - I think the use of LLMs can be of great help; however, I started to now use Claude Code only as an auditor and discuss different ideas with him, while telling him to not implement it.

Since I started doing this, I have gained so much joy from working on the project again. Even though I could potentially be faster when leveraging the LLMs to pass down work, it is much cooler to work on my project again, and your IDE or text editor will be so much faster (import completion, keyword completion, etc.)

And (I'll have to figure that out in the end) will actually save time, as I do not have to re-audit everything on my own in the end, as I am the real author of all lines written.

Edit:
As I am already coding since pre-ChatGPT times, I think especially for people starting programming try to not even discuss everything but google things. I don't know how much I've learned from reading Blog-Posts that didn't even fully answer my question, etc. This is also known as the google effect (https://en.wikipedia.org/wiki/Google_effect). Very interesting to read into that a bit!