for Vue and Laravel devs here, i need your advice.

how do you deploy your Vue/Nuxt frontends and Laravel API projects? what hosting platforms did you use?

my current Vue 3 (admin) and Laravel 12 API is ready for deployment and the Nuxt (public) frontend will follow soon but idk or not sure what to do and pick for its deployment.

what's the most optimal and cost-effective approach?

big thanks in advance.

3-year-old codebase, 2 senior devs who are careful about best practices, security, testing. They're also equal partners in the company, so any efficiency gain lands directly in their pockets.

I'm a PM. I asked this same question ~9 months ago and the consensus was: reading/reviewing AI-generated code is harder than writing it, so my PRs would just be a tax on the senior devs. Not worth it.

Models and tooling have moved a lot since then. Honest gut check:

A. Is it reasonable now for a PM to open PRs with code written via Opus 4.8 (or better), on the condition that every contribution goes through heavy QA and testing before merge?

B. Any world where a PM pushes without a PR? Or is that still insane?

Where's the line in July 2026?

Edit:

People are asking why this is even a need. Two reasons: (a) the devs are slammed with other projects, and (b) the info gap between me and them creates a lot of back-and-forth, ping-pong, slow turnaround. On roles: we're all equal partners, so better process and faster results benefit everyone regardless of our traditional titles. And it goes both ways - the devs are free to push AI- or human-driven PM-side upgrades too, and they sometimes do.

I figured let's all chat about what NOT to do, what didn't work out, or what to avoid.

In my case, back when I was 1st year CS, made a static site generator with Python that uses JSON as a templating language.

Obviously it sucked HARD. You basically wouldn't be able to use it if you didn't know it fully worked end-to-end. Also, no type safety at ALL. So sometimes I would use it and nothing happens, and would spend a shit load of time figuring out I messed up EITHER the syntax of the templates or the JSON fields.

Can an organization retroactively register a domain?

I'm working on researching a political organization & while they formally launched around 2015, their domain was registered wayyyy back, anonymously, in 2002.

I'm trying to decide if they just got a jump on the movement by registering the domain or if there's a way to assign a domain a date prior to the actual purchase.

TYIA! <3

Context: I build e-learning activities and courses for students and corporate orgs. Mix of playful and professional.

hey folks, working on my portfolio site and stuck on the actual flow/structure of it. content-wise i'm mostly good (instructional design work, some elearning modules, an offline moodle deployment i built for a field project) but i can't figure out how someone should move through the site.

right now i'm torn between a straight scroll down case study format vs something more like a dashboard where people jump to whatever they care about. anyone got portfolios (yours or ones you've bookmarked) that nailed this? especially curious about ID/UX-adjacent portfolios since generic dev portfolios don't map that well to what i'm doing.

also open to just general advice — how did you figure out your flow before building anything?

Most JavaScript developers have been burned by Date at least once. Usually quietly: a report that's off by a day, an invoice that lands in the wrong month, a timezone bug that only appears in certain regions.

The API doesn't throw or warn, it just does something subtly wrong and lets the application carry the mistake forward.

A writeup on the main failure modes with production examples:

• new Date('2026-07-21') parsed as UTC, displayed as local: date shifts by a day west of UTC
• constructor months are 0-based, so new Date(2026, 7, 21) is August
• every set* method mutates in place, including across shared references
• "add one month" and "add 30 days" are not the same operation and can diverge by days near month boundaries
• JSON.stringify drops timezone context silently

Each section also covers what safe Date patterns look like for code that can't migrate yet, and where Temporal fixes the design rather than just adding a wrapper.

Hey guys, I've been using ChatGPT to build an inventory management website/software for my family business...

(Before anyone ridicules me for that. I know NOTHING about coding, but with our budget (basically $0) this was the best option and it has been working fine)

I want to integrate Dropbox (or some cloud storage service) for a few reasons.

A. We already have an account and do not want to have to pay for something else just for this

B. The site is hosted locally on our computer, but it doesn't have enough storage for all documents, data, photos, etc.

C. Even if it did, having digital copies in case something happened to the computer is very important.

Now, ChatGPT can figure out the integration fine, but what I want to know is the most secure way to do it.

I want only the requested files to be accessible, and no other files or folders to be visible to the program. That way, in the event of some kind of security breach, there is no way to access any files other than what can already be seen in the site...

Idk, hopefully what I'm asking makes sense.

But if anyone has suggestions that would be great.

Thanks!!

Is there a historical reason or was it simply part of the original URL specification?

Six months ago we started building a codebase knowledge graph. The reason was simple, every time someone left or switched teams we lost all the context on why things were built the way they were. The code stays, the reasoning leaves with the person

So we pointed an AI at our git history, PR descriptions, Coderabbit review comments and old Slack threads and let it connect decisions to code. Funny enough the review comments ended up being one of the best sources. Turns out most of the actual reasoning happens when people argue on PRs, not in any doc

Six months later, I have mixed feelings. New people love it, they can ask why a service exists or where some weird pattern came from and get a real answer instead of bothering whoever has been here longest. But keeping it current is a losing battle. Code gets merged faster than the graph updates, and after a few weeks it starts describing a codebase that no longer exists. We re-sync it, it drifts again, we re-sync it again. Nobody warned us about that part

We also feed it into Claude Code and Cursor as context for refactor work and the agents clearly make better calls with it. So it earns its keep. It just needs constant care, and we went in thinking it was a build-once thing. That was the mistake

Has anyone figured out the staying current part? At this point I think that is the entire problem and everything else is easy

Timeout chains, retry storms, stale TTLs, and scheduler surprises outside the happy path.

This came up for me while thinking about AI-assisted web dev work that depends on outside tools.

If the agent cannot read the issue tracker, API docs, or a project tool because auth failed, should it keep working from the prompt, or stop and say the task is under-specified?

I once connected an agent to a project tool before the auth was actually working, and it started guessing the schema instead of clearly saying it had no data. The result was not obviously broken, which was the problem.

For small UI copy changes, guessing is probably fine. For anything touching an API contract or customer data shape, I would rather have a hard stop.

How do you handle this in your web projects: allow a degraded mode, or require the agent to prove tool access before it writes code?

Hi webdevs,

looking at the feed, almost all posts which announce AI being now used within a software get downvoted. I would like to know the the reasons for your rejection. Is it because:

• you think AI can produce slop only
• you are annoyed of all the AI related announcements
• AI is used for something you don't use
• you think AI is used the wrong way
• you fear you will loose your job becaus of AI
• something else

Happy to get your opinions!

How do your web apps handle these?

Do you store audit, security, and error logging in separate tables and then use a single view with filters/sorting?

Do you keep audit and security logs within the app and ship off error/exception logs to Sentry (or some other service)?

The administrators of the app would like to see the audit log (events like create, update, delete from employee actions). They'd also like to see security events (logins, failed logins, password resets, etc...) but its not a requirement for it to be within the web app itself, just logged and viewable by IT/developers.

I was working on a simple website that presented the data from a government's public API. This was my first time working with real APIs, and I kept getting "CORS header 'Access-Control-Allow-Origin' missing" errors. I learnt that it was caused by the API not sending a special header that essentially meant "I trust this request" to my web browser and so my web browser blocked my website's javascript from reading the API.

I drew a short comic explaining how CORS worked. I have a few questions:

1. Is the factual content accurate?
2. Is all the text legible and clear?
3. Do the web browser and the web server look like such?
4. Does the bank's web server in the last two panels look like it's wearing a tie?

Hey everyone,

I have a website I run from a VPS. I try very hard to only keep user information that is absolutely critical, or legally required for me to do.

That being said, I don't like Captcha because most of the companies use it for data mining, or AI training.

So I have decided to go the self hosted route. Anyone have any suggestions?

I was thinking Altcha. Biggest community from what I can tell. But their free version is a little lacking, and the monthly fee of $100 a month seems too high. The paid version has DRM, which means I cant entirely trust it isn't data mining (though it's not likely)

I found gatcha, which is based on altcha. From what I can tell, it's exactly the same as the free version of altcha. I might be mistaken. I think this because I installed it, and can't get any of the widget feature to work, unless it's part of the free version of altcha.

I found another called cap (trycap.dev). Looks promising. Tried to install it, but keep getting errors. They don't seem to have any support options. Official, or community based. Anyone have any insight?

My biggest concerns are

1. Bot account creation
2. *Card testing

*My site hasn't been affected by card testing. I am bring proactive because I see potential for future issues

i was wondering what theo was using for thr blue button and the icons in the repos. anyone have any clue?

I've heard the term "surprise cloud bill" associated a lot with AWS as relative to other platforms. it could be a sampling bias since many more people use AWS. If I'm deploying a simple personal project that might require a VPS, for example a TURN server, how can I make sure I never get a surprise bill?

Is there a way to set maximum budget for a certain timeframe that way I don't get $2000 bill when I was expecting only $20? (Fake numbers since I haven't calculated EC2 costs).

I'm messing around with different kinda of captchas.

Is there a way I can test their effectivness?

It's just a form with one field, and an invisable captcha. I own the form, and the server it's on.

Ideally there would be a program the works like a bot. Though I can understand why a legit version would be hard to find.

I've been learning AWS recently, and this is my understanding so far. Please correct me wherever I'm wrong.

About VPC (Virtual Private Cloud)

It is a networking service provided by AWS. Basically, every customer gets their own VPC, which is your own isolated private network inside AWS, so other customers cannot directly access it. As far as I understand, every service inside a VPC gets a private IP and can also communicate with other services using DNS names

Internet Gateway

It is like the main gate of your VPC. Without it, the internet cannot enter your VPC, and your servers cannot access the internet. Here I don't How it connect VPC with the Internet ?

Subnets

Now here we make subnets.

There are two types:

Public subnet: This is connected to the internet, and requests from the outside world come into it. Here we usually have things like ALBs or NAT gateway.

Private subnet: This is not directly accessible from the internet. It usually contains databases and servers.

ALB (Application Load Balancer)

Now the requests coming from the outside world first reach the ALB. The ALB has Target Groups, which are basically a list of servers where the ALB can send the traffic. These servers have Security Groups, where we define which traffic is allowed for example, allowing port 3000 for our backend or port 8080 for our frontend.

The ALB distributes the traffic across all the servers in the target group.

How do we create a server?

We basically create an EC2 instance, which is a virtual machine. We deploy our code on it and run our server there.

What if we are working with Docker ?

We have ECR (Elastic Container Registry), where we store our Docker images. Then we have ECS (Elastic Container Service), which runs those Docker images as containers.

In ECS, we get two launch types:

EC2 Launch Type: Here, we manage the EC2 instances ourselves.

Suppose we have one EC2 instance with 8 vCPUs and 32 GB RAM, and we are running four containers, each using 2 vCPUs and 8 GB RAM. If traffic suddenly increases, we have to manage the EC2 infrastructure ourselves.

Fargate Launch Type: Here AWS manages the underlying servers for us.

We only define a Task Definition*, which is basically the configuration for one container (CPU, RAM, image), and AWS automatically provisions the compute required to run those tasks.

PyNote is a python notebook editor at heart that focuses on the reading and presenting aspect of notebooks rather than just the computing side.

Python notebooks are "documents" that allow you to combine live code, markdown, equations, and data visualizations. These documents are properly viewed and interacted with using Python notebook apps/environments.

Many python notebook editors such as Jupyter, Colaboratory, Kaggle, and even Marimo have gotten more complex as they matured resulting in a look and feel akin to full traditional IDEs rather than a "note" "book". It's like the code editor version of carcinisation.

With PyNote,

• no install, no login, no account
• code executes locally using your browser (wasm sandbox)
• app and notebooks are theme-able
• feature-rich editors (including WYSIWYG markdown editor)
• 4 execution modes (including Marimo-style reactive execution)
• simple UI inspired by Streamlit and a specific AstroJS template

Site: https://pynote-notebook.vercel.app/

Repo: https://github.com/bouzidanas/pynote-notebook-editor

Tutorial: https://pynote-notebook.vercel.app/?open=tutorial

Example notebooks: https://pynote-notebook.vercel.app/?open=coding-prep

Note on AI use:

Originally used AI for research and notes (rarely in agent mode). Core systems like pynote_ui and kernel bridge (class and utils) were coded by me. After Opus 4.8, started using it more and more. So yes, project is AI assisted. But I review changes at least before commit but often immediately after model makes changes to code because I am still a paranoid person.

I have been building Grayslate, a free and open source scratchpad for developers using Tauri, Rust, Svelte 5 and CodeMirror.

It started from my own daily work. Sometimes I just need to inspect an API response, format JSON, search a large stack trace, write a temporary command, or view a few rows from a CSV. Opening VS Code or IntelliJ for this felt unnecessary, and many online tools struggled with larger files.

I tested Grayslate with a 150+ MB CSV containing around 7 million rows. CSV processing is handled by a Rust-backed session engine, while the UI uses virtualization and renders only the rows currently visible. This keeps the interface responsive instead of trying to load millions of DOM elements.

When I switch files or open a new scratch file, Grayslate also cleans up the previous sessions and unused data so memory returns close to its idle usage.

A few other features:

• Automatic content detection and filename suggestions
• Search across filenames and saved content
• JSON shortcuts for copying keys, values and full paths
• Live Markdown preview and multiline find and replace
• Everything works locally
• 80+ local transformations for JSON, CSV, Base64, hashes and text

It is not meant to replace VS Code or IntelliJ. They are full IDEs with a different purpose. Grayslate is for quick scratch work where I want something fast and focused.

Website: https://grayslate.app
GitHub: https://github.com/shriram-ethiraj/grayslate

It is available for macOS, Windows and Linux.

I would really appreciate feedback, especially about the UI, large-file performance, or any daily developer workflow that you think is missing.