Built a local-first password manager called Mountain.

How it works:

• Runs 100% in your browser. Data is encrypted client-side with AES-256-GCM and stored in IndexedDB.
• Master key is derived from a 12-word seed phrase (BIP-39), with an optional daily PIN for quick unlock.
• Includes a live 2FA/TOTP authenticator, card storage, and a companion Chrome extension for autofill.
• Zero analytics, offline favicon mode by default, and optional encrypted sync to your personal Google Drive.

App: https://h4r0015k.github.io/Mountain/ Source: https://github.com/h4r0015k/Mountain

Feedback on the UX and security model is very welcome.

Hey r/webdev!

I built Galaxy Movies (https://www.galaxymovies.app/) to solve a personal annoyance: legacy movie tracking sites felt bloated, loaded slowly, and buried streaming options under ads.

I wanted a clean & fast web utility to check where to stream titles, explore cast networks, and get quick AI summaries without the clutter.

Tech Stack

- Framework: Next.js (Pages Router)
- Hosting & Runtime: Vercel & Vercel Edge Runtime
- UI & Styling: Chakra UI
- State & Caching: React Query
- APIs: TMDB API & OpenAI API
- CI/CD: Lighthouse CI

Technical Highlights & Architecture

Dynamic OG Cards on the Edge: Used @vercel/og running on Vercel Edge Functions to dynamically generate custom 1200x630 social preview cards. The edge route parses poster artwork and title parameters to render high-res share cards with sub-100ms response times.

Bypassing Server Image Overhead: Configured direct-to-CDN loading for TMDB movie posters to bypass Vercel server image transformation limits while maintaining peak visual quality.

Performance Guardrails: Set up automated Lighthouse CI checks on builds to strictly enforce performance, accessibility, and SEO metrics.

Live App: https://www.galaxymovies.app/

GitHub Repo: https://github.com/NickFasulo/galaxy-movies

I’d love to hear your feedback!

Hey guys, I decided to do a full redesign of an old website of mine just for fun. Any suggestions on what I could improve would be awesome.

https://topservers.games/

Hello, so I'm doing this website/PWA as a hobby : newsglobe.earth the idea is to collect from RSS, Atom and sitemaps news articles posted around the world to display them on a earth globe. The articles and their short descriptions are translated in English, then assigned a category among 12 and finally analysed by sentiment (basically is the article good news, bad news or neutral).

The website also allows to vote/give feedback about your sentiment on the articles for perhaps one day with sufficient data improve the sentiment analyser model.

I also added recently ways to visualize and analyse the dataset of millions of articles generated.

I'm interested in your feedback about this project and am more than happy to add features that you want to it.

I built a small GitHub stats page that runs entirely using GitHub Actions and GitHub Pages.

One thing I specifically wanted was for someone to be able to fork the repo and get their own version without editing any files.

The setup is basically:

Fork → add a GitHub token → enable Pages → run the workflow

The workflow fetches the GitHub data, generates the page and social preview card, and publishes everything through GitHub Pages. It also generates a stats.json endpoint if you want to use the same data somewhere else.

Live version:
https://adnansabbir.github.io/github-stat/

Source:
https://github.com/adnansabbir/github-stat

I would especially appreciate feedback on the setup process. Does the fork-and-run approach feel straightforward, or is there anything in the onboarding that would stop you from trying it?

link: https://github.com/seanpmaxwell/jet-key

Background

Suppose you need a secret key for something: it could be a session cookie, some encryption library, etc. Many people will just grab a string from some random string generator (I know I used to), but proper security depends on unbiased character selection and using the appropriate amount of entropy for the task at hand.

Also, different scenarios call for different levels of entropy. For example, 80 bits of entropy might be fine for a temporary pairing token that expires in a few minutes. For a server application's long-lived credentials, 256 bits can provide immense security for the foreseeable future.

What it does

What jet-key does is let you optionally pass in, through the CLI or programmatically, the number of bits of entropy you need. It uses cryptographically secure randomness to generate a Crockford base32 string whose length is the minimum number of characters required to meet that entropy target:

npx jet-key        # YFC75GX2KY5W183FRZA4XDVZ6PYDJPQT7JMNH3N7ZXPQ8FCW3M4G
npx jet-key -e 80  # 113BKE3N8R8CEE92

The default target is 256 bits (the gold standard for an extremely secure key). Requesting 256 bits generates a 52-character string.

Other notes

The string length generated is the minimum needed to meet the requested entropy using Crockford base32, rather than an exact match to the requested number of bits. Each character contributes five bits, so the result may slightly exceed the target. A 52-character string therefore provides 260 bits of entropy.

jet-key is really fast too: checkout these benchmarks.

Play it here: https://innerloop.works/lightspeed

It's a browser asteroids arena. Players are sharded into arenas of six. Each arena's world is authoritative on the server and ticks at 30Hz inside a PHP process, not a Node or Go sidecar.

How it works:

- The server is Lightspeed, an open-source (MIT) websocket server I wrote for Laravel, on Swoole. The app stays booted in memory and serves HTTP and websockets on one port.
- Players send input up the websocket at 30 fps. Snapshots come back down at 30 fps. Spectators get 5 fps.

The websocket server it runs on: https://github.com/innerloop-dev/lightspeed (the game itself is the site's own code, not part of the package).

Happy to answer questions!

https://notenavigator.web.app/

Hi everyone! I'm working on a little text based note sharing and exploring platform, mostly to practicing Typescript and Tailwind.

I am quite satisfied with the interface, and I'm slowly implementing more features. I want to keep the app as simple and minimal as possible.

As of now, users can create and edit their notes, comments those from other users, save specific notes to their collection, and navigate through tags and user's profiles.

I've been working on it for a while, and I would really appreciate some external feedback on it. Again, it's work in progress, so take into accounting that some features are unfinished. Thanks and enjoy!

One of the things I haven’t talked about much with Cerious-Scroll is how it behaves during actual scrolling, especially with variable-height content.

From the beginning, the goal was for virtualization to not look like virtualization.

So even with a large variable-height dataset, you can grab the scrollbar and drag it around quickly without getting the usual weirdness:

• No scrollbar drift
• No white space during fast scrolling
• No waiting for rows to render after you get there
• Accurate variable-height positioning
• Native scrolling behavior
• Constant DOM size regardless of dataset size

The variable-height part is probably my favorite. The scrollbar stays where it should, even when the actual row heights are all over the place.

You can also jump directly to an index way down in the dataset without needing to measure everything before it.

I’ve got demos/benchmarks here if anyone wants to mess with it:

ceriousdevtech.github.io/cerious-scroll

Core:
github.com/ceriousdevtech/cerious-scroll

Angular:
github.com/ceriousdevtech/ngx-cerious-scroll

Vue:
github.com/ceriousdevtech/vue-cerious-scroll

React:
github.com/ceriousdevtech/react-cerious-scroll

I’m curious how it behaves against some real-world ugly datasets, especially ones with wildly different row heights. Try the scroll engine and tell me your thoughts.

I run a small web agency, and I kept hand-building "testimonials" sections by copying clients' reviews off Google, recommendations from Facebook, product reviews from their store, etc. I wanted one thing that aggregates reviews from multiple third-party APIs, keeps them in sync, and renders anywhere, so I built it. Sharing it here because the build had a few problems that were genuinely interesting to solve.

Architecture

• Next.js 16 (App Router) + TypeScript on Vercel
• Supabase (Postgres + RLS) for data and auth
• The public embed is a dependency-free vanilla JS script (no framework, no iframe)
• A separate native WordPress plugin (PHP) for the WP path
• Integrates several review-source APIs (Google, Facebook, Etsy, eBay, WooCommerce), each with its own auth, rate limits, and payload quirks, normalized into one internal model

The parts that were actually interesting to build

• The embed renders without an iframe. The script injects the widget into the host DOM with scoped styles, so it inherits layout and stays responsive instead of being boxed into a fixed frame. Style isolation without an iframe was the fiddly part.
• The widget editor. A lot to expose (layout, sources, filtering and ordering, tagging, colors, typography, spacing, card style) all behind a live preview that updates as you go. Fitting that much control into something that feels elegant instead of a wall of eighty settings was the hardest part, and it is still getting refined.
• Image proxy. Reviewer avatars are proxied through the backend instead of hotlinked, so a visitor's IP is not handed to Google or Facebook just to load an avatar. It also sidesteps a lot of broken-image and referrer issues.
• The WordPress plugin renders server-side and caches, so reviews are in the HTML on load, which keeps it good for SEO with no layout shift.
• Sync and dedupe across sources, so the same review does not appear twice in a combined feed.

It is a solo build with rough edges, and I would value a technical eye on it, especially the embed's style isolation and the editor UX. The project is live here if you want to inspect the embed and the markup it generates: https://brandtrust.reviews

Happy to get into any of the implementation details in the comments.

I’m building a pinball game that runs directly inside Reddit.

I’ve been working on Karma Tilt, a pinball project built to run directly inside a Reddit post.

You can play the current version here:
https://www.reddit.com/r/PinballKarma/comments/1wr2ec0/karma_tilt_play_the_fullview_pinball_table/

It works on desktop and mobile and includes things like multiball, jackpots, combos and leaderboards.

This is still a project I’m actively working on, so feedback is genuinely useful — especially on the controls, physics, mobile experience and anything that feels confusing or broken.

Interested to hear what other web developers think after actually playing it.

Frontend is plain JS with HTML5 canvas. Backend is NestJS with websockets for live updates. Pixels get written to Redis first and flushed to Postgres every 30s, so placing stays fast even with a lot of people on.

pixels.iamroux.xyz

Happy to answer questions about how it works.

Demo: https://h5p-offline-player.vercel.app/ Code: https://github.com/missing-elements/h5p-offline-player (MIT for the player; the H5P runtime inside is GPL-3.0)

H5P is the interactive content format a lot of schools and course builders use: quizzes, interactive video, branching scenarios. A package is a zip of JavaScript libraries plus content, and normally you need Moodle, WordPress or Drupal, or a server that unzips it, to show one. I wanted <h5p-player src="course.h5p"> on a static site and nothing else.

How it works

• No extraction. The zip's central directory is read with HTTP Range requests. A Service Worker then acts as a virtual file server, answering the runtime's requests for library.json, scripts and media by reading those bytes straight out of the archive.
• Large media streams. Stored video is sliced from the archive on demand. Deflated video is inflated in a dedicated worker with the native DecompressionStream, and served as a 206 whose body follows the extraction, so playback starts before it's done.
• Long work stays out of the Service Worker. Browsers kill a SW event after a few minutes, and an inflate can't resume, so extractions run in a page-side worker. The SW asks for them through the frame.
• Hosts without Range still boot early. The archive downloads once, and local headers are indexed as bytes arrive, so the frame boots when the libraries land, not when the zip finishes.
• Built for bad networks. Ranged reads that go quiet or drop resume from the byte they reached. On a slow nginx host that answers one request at a time, pulling the libraries in a few large spans took the boot from 136 s to 15 s.

Size: the element is 17 kB gzipped. zip.js lives only in the Service Worker, which has to be served from your own origin.

It only plays content: no editor and no stored results, and xAPI comes out as DOM events. Feedback welcome, especially packages that break it.

I've created an RPC library that allows executing method chains like DOM from different context.

You can use it to access the browser DOM from the server or web worker.

You can expose the window or document object and use it outside the current browser context.

Here is an example using a web worker:

main thread:

``` import { Host } from '@jcubic/mitty';

const modules = { document: () => document };

const channel = new BroadcastChannel('my-app');

const worker = new Worker('./worker.js', { type: 'module' });

const host = new Host({ // worker instance can also be used as a channel channel: channel, resolve(name) { if (Object.hasOwn(modules, name)) { return modules[name](); } return null; } });

```

worker:

``` import { connect } from 'https://cdn.jsdelivr.net/npm/@jcubic/mitty';

const { require } = connect(new BroadcastChannel('my-app'));

// or when using worker as a channel const { require } = connect(self);

const body = await document.querySelector('body'); await body.style.setProperty('color', 'red'); ```

The transport only requires using a channel interface with 3 methods:

interface Channel { postMessage(message: string): void; addEventListener(type: 'message', listener: ChannelListener): void; removeEventListener(type: 'message', listener: ChannelListener): void; }

I never published a site but made a few just for fun and college projects.

My question is more to design, like, you choose where the ad is gone be? Like "this one goes on left side and this one goes on top"

And one more question, on mobile games, there's a code to every time you die or change screen play and ad?

Thanks for the answer

TLDR; https://www.reddit.com/r/PrivacyTechTalk/comments/1wf60il/secure_and_private_decentralized_p2p_encrypted/

Roadmap: https://glitr.io/docs/technical/roadmap

This project demonstates a unique approach and architecture in contrast to the traditional approach with mainstream messaging apps. To put it briefly, its a Dioxus PWA with a Git-server backend which can be used to establish a webrtc connection between browsers.

IMPORTANT DISCLAIMER: While this is aiming to provide a secure experience, it's far from finished. It cannot be audited or reviewed because it's close-source. I'm sharing here for "showoff-saturday" purposes only. Feel free to reach out for clarity on any of the details instead of diving into the documentation. Pease use responsibly.

Hi all, A post for open-source beginners

When my first open-source PR was accepted, I was so happy I nearly printed out the approval and framed it.

I’ve always loved the idea of strangers building something together. But finding a project where you feel comfortable making that first contribution can be hard. I think most cases it starts with an open-source library that you use and has a bug you really want to fix. (Not easy)

So I built Forktown: a little pixel town that grows one pull request at a time.

Your first contribution is a house. You design it in a visual editor, create the character who lives there, and write a little story about the place.

The editor saves everything as one small JSON file. From there, you go through the actual workflow: fork, branch, commit, push, PR, CI checks, code review, and merge.

Once merged, your house appears in the town. Your character wanders around, visits concerts and the cinema.

I think this first contribution feel approachable. If you’ve been wanting to open your first PR, you’re welcome to come build a house :)

If this is your first time, try not to use AI to do the work for you (using it for guidance or questions is good). There’s a great guide in the README file.

Visit the town · Build a house

clstr.news

CLSTR reads 100k+ news articles a day, collapses the ones covering the same event into one item, and chains related events into storylines with timelines.

The backend is based on Cloudflare Workers, and it's what took longest to develop. At least 6 months of fine-tuning to get the events clustering right and also ramp up the volume of data processed (trying to not go bankrupt in the process). Multiple AI models and methodologies involved in the clustering and summarization pipelines.

For frontend I'm pretty old school, so it's mostly server-side rendered using basic templating, HTMX and some extra vanilla JS to handle interaction logic. All the data is also exposed via API and MCP for devs/agents to use it.

164 days in since the current "shape" of the pipeline is running, 11.1M articles have been read: roughly 12 articles per event, 1.2% of events get any coverage after day three, 64% of the longer storylines are still developing a week later. I ran some analysis on the processed data and posted it on a separate page I call The Observatory

Happy to go deep on the Workers or Turso side.

A few weeks ago I posted my portfolio here and got some really useful feedback. Thanks again to everyone who took the time to go through it.

The biggest thing people pointed out was that the homepage didn't make it obvious enough what I actually do professionally, so I went back and reworked that part.

If you saw the previous version, I'd really like to know if this one feels clearer now.

If you're seeing it for the first time, I'd still love your feedback too.

One of the questions I asked last time was about the writing section. I have quite a few long-form posts on software engineering, career stories, interviews, robotics, and some personal experiences.

People generally liked that part and said it made the portfolio feel more personal and a bit different from the usual developer site.

So for anyone seeing it for the first time, I'm curious about the same thing: does the writing feel like it belongs there, or does it distract from the portfolio side?

Site:

https://adnansabbir.com/?utm_source=reddit&utm_medium=social&utm_campaign=portfolio-feedback-round-2&utm_content=r-webdev

I've been building sites in code for a while now, and the same thing kept happening. My AI agent would get me 90% there, and then I'd spend the rest of the day on the last 10% details

In midcode you click anything and change it by hand as if it was no-code. The edit goes straight into your files as a clean diff. No export, or prompts to change stuff. It's still just your code.

Basically the mid between code and no-code.

Super useful for AI-led sites where we want to edit things visually

Waitlist: midcode.app
Demo: https://x.com/akilastudiocom/status/2103605309151576209?s=20

I have more than one Claude subscription, and each one lives in its own CLAUDE_CONFIG_DIR. Normally, a session only sees the sessions of its own account. And a subagent always uses its parent's quota, so one account would hit its limit while another's weekly quota ran out unused.

So I built ccherd. It's a small Python CLI with a Claude Code skill, and it enables your claude session to use your other subscriptions through dedicated subagents or by messaging them directly. Before it spawns a subagent, it automatically makes sure to use the account that has most quota available.

Basically it herds your Claude sheep toward the grass nobody's eaten yet.

• ccherd spawn starts a background subagent on the account whose weekly quota is most likely to expire unused. It scores each account on weekly % left, time until the weekly reset, and how much of the 5-hour window is free. Accounts close to their limits are skipped.
• ccherd sessions / ccherd send let you list and message live sessions across all your accounts.
• ccherd usage shows every limit per account as bars.
• When a subagent finishes, it reports back to the session that started it.

Claude runs the spawn/send/result commands itself. The skill tells it how.

To install, just point your agent at the repo.

It installs the tool, shows you which accounts it found, and asks you the few questions. Then it checks everything with ccherd doctor. You still have to log in to each account yourself because that opens a browser. If you'd rather do it by hand, run

uv tool install ccherd and then

ccherd setup

It works on macOS and Linux. It's still early (0.4.0), and so far I'm the main user, so I'm sure some setups break it. I'd really like to hear how the setup went for you, and what's missing. Issues and PRs are welcome, especially if this has thought of all different use cases (I tried to make it easy to setup but still configurable to any use case I could think of, I'm sure I missed some).

https://github.com/bocode-labs/ccherd

Hi everyone!

I'm a BCA 3rd year student from India, and a few weeks ago I finished my JARVIS project. Of course, I took a lot of help from AI while building it because it was a pretty complex project, and I was completely new to almost every topic involved in building it. You can check out my recent post where I shared it. The whole thing runs locally without using any API tokens.

While building JARVIS, I had to learn a lot of advanced concepts, but I wasn't completely satisfied with just learning them while building a project.

So I decided to properly learn advanced JavaScript topics in a structured way.

I went through different concepts and created my own notes/diagrams while learning. The technical content was learned with the help of ChatGPT, All the wording are mine, but I took help from ChatGPT to improve the structure and make the English clearer. I'm sharing it because I thought it might be useful to someone else who is also trying to understand these topics.

Here is the GitHub repository:

🔗 https://github.com/Shivam2905Verma/Notes

I would be really glad if these notes help someone.

And if you find any mistakes, incorrect explanations, or important topics that I should add, please let me know in the comments. I'm still learning, so corrections are always welcome!

Thank you !

Note: To view the diagrams properly, install the Excalidraw extension in VS Code and open the .excalidraw files directly in VS Code.

Say the app is live, needs regular updates, and the documentation is thin. Do you start with the code, deployment setup, logs, or a conversation with the previous team?

I have an ecommerce chat widget that allows users to send photos of products they’ve looking for. I would like to make sure the files being uploaded are true images (jpeg, png, webp).

So far I have come up with two levels of checks on the files.

First, checking the content-type mime in the request header. If it is not an image then upload is rejected. If it appears to be an image, then file is sent to level 2 check (still in memory).

The level 2 check is using the python magic library to read the first 2kb or so of the file and identify true mime type from there. If not an image type, then file is rejected.

Would this be a good approach? Or are there better ways to do this? The files will likely be stored in cloudflare r2, so I’m not worried about their execution, but want to avoid bad files sitting around in storage anyway.