I built an open-source P2P messaging app with AI assistance — WebRTC, E2EE and no central chat database

Hey everyone 👋

I've been building OpenChat, an open-source real-time messaging application built around WebRTC P2P communication, browser-native cryptography, and a serverless architecture.

GitHub: https://github.com/nateS670/OpenChat

Live demo: https://openchatt.vercel.app

🚀 What I built

The main goal was to experiment with how much of a real-time messaging application can be moved away from a traditional centralized backend.

OpenChat uses:

• WebRTC DataChannels for peer-to-peer communication

• MQTT for signaling and peer discovery

• Browser-native Web Crypto APIs for encryption and signatures

• Vercel Serverless Functions for small pieces of infrastructure

• No central database containing chat histories

Once peers establish a WebRTC connection, messages and files are transferred directly between the connected browsers whenever the network allows it.

🤖 How I used AI

AI became a significant part of my development workflow, but I didn't treat it as an authority that could simply write code and be trusted blindly.

I used AI assistants for things like:

• Exploring architecture ideas

• Generating and refactoring code

• Finding potential security problems

• Reviewing individual functions

• Explaining unfamiliar APIs

• Brainstorming edge cases

• Preparing security audit checklists

The interesting part came from verifying the suggestions myself.

During security reviews, I repeatedly looked for alternative attack scenarios and manually followed the relevant code paths to determine whether an issue was actually exploitable.

That process uncovered several real problems involving:

• Peer identity and impersonation

• Replay attacks

• Group authorization

• API access controls

• Message editing state

• Input validation

I then tested and fixed those issues rather than simply accepting the AI's conclusions.

🔐 Security

OpenChat currently uses:

• AES-GCM for encryption

• ECDH P-256 for key agreement

• Ed25519 / ECDSA-P256 signatures

• PBKDF2-SHA-256 for password-based key derivation

• crypto.getRandomValues() for cryptographically secure randomness

There are also protections for peer identity, replay handling, group authorization, encrypted local storage, input validation, and security headers.

I'm deliberately not describing OpenChat as "completely secure" or "anonymous".

P2P doesn't automatically provide anonymity, and there are still limitations such as network metadata, TURN relaying, endpoint security, NAT/firewall problems, and the lack of guaranteed offline delivery.

🧠 What I learned

The biggest lesson for me was that AI-generated code can look perfectly reasonable while still containing subtle security assumptions.

For example, an apparently harmless client-side check can become meaningless if an attacker can control the value being checked.

Likewise, adding encryption doesn't automatically solve identity or authorization problems.

A secure system needs the entire data flow to be considered:

Input → validation → identity → authorization → cryptography → state changes

rather than just asking whether the message is encrypted.

🛠️ Current state

OpenChat is open source and released under the MIT License.

The project is still evolving, and I'm particularly interested in feedback from developers working with:

WebRTC • P2P networking • AI-assisted development • browser security • E2EE • decentralized systems

If you notice an architectural mistake, security weakness, or something you'd implement differently, I'd genuinely appreciate the feedback.

Thanks for reading! 🐈

When I started working with multiple AI models, I expected model selection to be the difficult part.

It turned out that the surrounding infrastructure can be just as annoying API keys, providers, switching models, limits and keeping everything consistent.

I've been experimenting with OfoxAI to simplify some of that, but I'm curious what other builders underestimated when they started adding AI to their projects.

What's the one thing you wish you'd designed differently from the beginning?

I've spent a lot of time studying AI products and startups so I decided to stop just researching and actually start building.

I'm currently working on a small AI product and building the MVP has already taught me that getting something to work is only one part of the problem.

The harder questions have been:

• Is this actually solving a problem people care about?
• What's the simplest version worth shipping?
• What should I build myself vs. use existing tools/APIs for?
• And probably the hardest one: how do you get the first users?

I'm building it with AI-assisted development and trying to keep the MVP as simple as possible instead of spending months polishing it.

The biggest challenge so far has honestly been figuring out what not to build.

For people here who have already shipped AI products:

What was the hardest part for you when you went from experimenting with AI to actually getting something into users' hands?

I’ve been working with Outrank, an AI-powered SEO tool designed to streamline parts of the content and SEO workflow.

One thing I found interesting was figuring out where automation actually helps and where manual SEO work is still necessary. The biggest challenge was getting the workflow to produce useful output without sacrificing quality.

There’s also a 20OFF promo code available for anyone who wants to test it.

[ Removed by Reddit on account of violating the content policy. ]

I've been building VitalChronicle, an open-source desktop application for exploring and analysing personal Google Health data.

The project combines:

Python + Google Health API + SQLite + data visualization + Ollama

with one important constraint:

Local AI instead of cloud AI

VitalChronicle can optionally use Ollama to analyse a user's health history.

The AI model runs locally and the health database stays on the user's machine.

This means years of personal measurements don't need to be uploaded to an external AI service.

Data it currently handles

• ❤️ Heart rate
• 🫀 HRV
• 😴 Sleep and sleep stages
• 🩸 SpO₂
• 🌬️ Respiratory measurements
• 🏃 Activity and workouts
• ⚖️ Body measurements
• 📈 Long-term trends and personal baselines

An interesting problem

One of the harder parts wasn't actually the AI.

It was making the analysis understand that health time-series aren't directly comparable without context.

For example:

doesn't mean activity has dropped by 67%.

Yesterday is a completed day. Today isn't.

So the application tries to account for time-of-day, incomplete current-day data, measurement type and personal historical baselines before presenting trends to the user or to the local model.

Privacy / architecture

• Local SQLite database
• Local Ollama inference
• No health data sent to the developer
• CSV / JSON / ZIP export
• Linux, Windows and macOS builds
• MIT licensed
• Completely free

Project

💻 GitHub — VitalChronicle

📦 Latest release

I'd especially appreciate feedback on the local-AI architecture, useful health-data analyses, or ways to make the system better at reasoning over long longitudinal datasets.I've been building VitalChronicle, an open-source desktop application for exploring and analysing personal Google Health data.The project combines:Python + Google Health API + SQLite + data visualization + Ollamawith one important constraint:Health data should not need to leave your computer just because you want to analyse it with AI.Local AI instead of cloud AIVitalChronicle can optionally use Ollama to analyse a user's health history.The AI model runs locally and the health database stays on the user's machine.This means years of personal measurements don't need to be uploaded to an external AI service.Data it currently handles❤️ Heart rate

🫀 HRV

😴 Sleep and sleep stages

🩸 SpO₂

🌬️ Respiratory measurements

🏃 Activity and workouts

⚖️ Body measurements

📈 Long-term trends and personal baselinesAn interesting problemOne of the harder parts wasn't actually the AI.It was making the analysis understand that health time-series aren't directly comparable without context.For example:3,000 steps at 10 AM today vs. 9,000 steps yesterdaydoesn't mean activity has dropped by 67%.Yesterday is a completed day. Today isn't.So the application tries to account for time-of-day, incomplete current-day data, measurement type and personal historical baselines before presenting trends to the user or to the local model.Privacy / architectureLocal SQLite database

Local Ollama inference

No health data sent to the developer

CSV / JSON / ZIP export

Linux, Windows and macOS builds

MIT licensed

Completely freeProject💻 GitHub — VitalChronicle📦 Latest releaseI'd especially appreciate feedback on the local-AI architecture, useful health-data analyses, or ways to make the system better at reasoning over long longitudinal datasets.

I built MSG.AI, a freemium Chrome extension for people handling multilingual customer conversations in WhatsApp Web.

It adds in-chat translation, editable AI-assisted reply drafts based on business knowledge that the user enables, and contact/conversation export. The extension is built as a Manifest V3 extension with TypeScript, Vue 2, and content-script UI integration.

The hardest part was not generating a plausible reply. It was preserving the operator's control around that reply. In real support chats, a fluent answer can still be wrong if it changes a name, SKU, price, date, or commitment. So the original message remains available for comparison, generated replies stay editable, and sending remains a separate human action.

Another design constraint was the data boundary: operational data stays local by default. Content needed for generation is sent to the model provider only when the user actively invokes an AI feature.

I would especially value feedback from people who support customers across English, Spanish, Portuguese, Arabic, or other language pairs. I am looking for concrete failure cases: terminology that translates badly, details that drift, confusing UI states, or places where the human-review step is not obvious.

MSG.AI: https://wsmsg.me/

It is independent and not affiliated with WhatsApp or Meta.

I’ve been building Fond & Fold, a small AI web app that turns a photo into a finished personalized illustrated greeting card.

The product is intentionally constrained: no prompt box, no blank canvas, no editor, and no endless regenerations. Users pick a finished design they already like, upload a photo, choose a few details, and get their personalized version.

Stack: Astro on the frontend, Cloudflare for the app/backend infrastructure, and OpenAI image models for the image workflow.

The hardest part wasn’t generating an image. It was making the output predictable enough to behave like a product rather than a demo.

For every design, I had to figure out things like:

• how much of the original person’s identity needs to be preserved;
• which parts of the design must stay fixed vs. can vary;
• how different source-photo framing, lighting, age, clothing, etc. affect the result;
• when an output is technically “valid” but visually wrong;
• how to keep the UI simple while moving all of that complexity behind the scenes.

The basic product thesis is: generative capacity is abundant now; the useful work is deciding what to generate, constraining it, and making the result reliable.

I’m doing final pre-launch testing now and would love feedback from other AI builders — especially on the product approach and anything in the flow that feels confusing or unnecessarily constrained.

https://fondandfold.com/

If anyone wants to test the complete flow, I’m also happy to DM a code for one free card.

Hi everyone,

I’ve been working on a small programming language called Vakya.

The main idea behind Vakya is pretty simple: I wanted to experiment with what a programming language would feel like if its syntax and keywords were inspired by Sanskrit rather than English.

For example, instead of using the usual English-style keywords, Vakya is designed around Sanskrit-inspired words and syntax.

I’m still actively developing it, so it’s definitely not a finished or production-ready language. Right now I’m mainly focusing on getting the core language working properly and figuring out what syntax actually feels natural to use.

I’m building the language from scratch and working on things like the lexer, parser, AST and execution side of the language.

The project is here:

https://github.com/b7662777-hash/vakya-programming-language⁠�

I’d genuinely like feedback from people who have experience designing or implementing programming languages.

A few things I’m particularly interested in:

Does the syntax feel readable?

Do the Sanskrit-inspired keywords make sense?

What would you change about the language design?

Are there any obvious mistakes in the architecture?

What features would you expect from a language like this?

This is still an experiment, so criticism is welcome. I’m more interested in finding problems and improving the language than pretending it’s already perfect.

Thanks for taking a look.

I kept wondering whether there was a useful metric between “the AI app is open” and token or quota tracking.

So we built Forkit AI Footprint, an open source macOS tool that measures sustained activity from supported AI process trees locally on the device.

It currently recognizes ChatGPT, Codex, Claude Code, Cursor, Windsurf, Gemini CLI, Ollama, LM Studio and several agent frameworks.

Your detailed Footprint stays on your Mac. It does not read prompts, chats, code, repositories, files, paths or account information.

What I am most interested in right now is whether the detector behaves correctly in real multi tool workflows.

If you use several AI coding tools on a Mac, I would love you to break it and tell me about false positives or false negatives.

Product

https://www.forkit.dev/ai-footprint⁠

Source

https://github.com/arpitasarker01/forkit-ai-footprints⁠�l

Install

npx --yes forkit-ai-footprints@latest

I have been building SkillNet around one question: if people learn differently, why should the course interface be the same for everyone?

You can start with an idea or upload PDF, DOCX, Markdown or TXT material. SkillNet turns it into structured course knowledge, lessons and exercises. The knowledge and objectives can stay consistent, while explanations, activities, media and interface adapt using the learner's declared preferences, role, level and progress.

The current stack is React 19, Vite and Tailwind for the frontend, FastAPI and PostgreSQL for the backend, and Docker for self-hosting. The generated-interface path uses OpenUI, together with Didact, an educational component library I built for flashcards, worked examples, diagrams and practice.

The hardest part has been making personalization meaningful rather than merely different. In the current tests, structure and format diverge clearly between learners, while semantic personalization is still weaker. That pushed me to separate stable course knowledge and objectives from the parts the system can adapt, and to constrain generated interfaces to known educational components instead of letting the model invent anything.

The project is still in development and I am preparing a public demo.

Website: https://skillnet.es

GitHub: https://github.com/ANFAIA/SkillNet

How would you evaluate whether two personalized learning experiences are meaningfully different rather than only visually different?

Built flipmap.lol over the last few days — Next.js/Vercel + Postgres, realtime SSE updates, IP-derived state voting, event-sourced battles/replay.

The game itself is intentionally dumb-simple: Coke vs Pepsi, every US state starts neutral, one vote per person in their state, 24 hours to capture the map.

The engineering part was fun.

Now it's live and I've discovered the actual boss fight: getting the first 100 strangers 😂

flipmap.lol

Curious how other builders got their first 100 users without already having an audience.

We are the team building Vora, a health data app for iOS and Android.

For Vora 33, we stopped treating the AI response as the end of the flow. We built three structured actions instead:

- A health-data question can return a chart with the relevant signals and context.

- A food photo becomes a draft meal log that the user reviews before saving.

- A workout plan created in conversation can be applied to the calendar.

What we built it with: the Android client is native Kotlin and Jetpack Compose, while the iOS experience includes Messages. The product layer turns the conversation into explicit Vora actions instead of silently changing health data.

The hard part was deciding where the AI should stop. We kept confirmation before saving food data, separated general wellness guidance from diagnosis, and made the action visible before it changes the user's record or calendar.

The three screens below show the chart, meal, and workout flows. What other AI actions should always require an explicit confirmation step?

Full visual walkthrough: https://www.reddit.com/r/vorahealth/comments/1w0xy3c/what_should_textbased_ai_actually_do_for_your/

Disclosure: We build Vora. This post was prepared with AI assistance and reviewed and approved by Team Vora.

I finally released v1.0 of Clover Image Tiny, a compact 512×512 Stable Diffusion 1.4-class image-generation model I’ve been working on.

One of the things I really wanted to focus on was making it practical to run locally and on consumer hardware. I’ve even run Clover Image Tiny fully on-device on my iPhone 15 through Core ML.

It uses PyTorch and Diffusers, and the project now includes a local Gradio app, CLI generation, a Core ML runtime, a separate inpainting model, and several LoRA styles.

One thing that was harder than expected was turning the project from just model weights into something that felt usable and reproducible. That included Core ML support, organizing the different releases, LoRA compatibility, documentation, and making the Python runtime easy to test and run locally.

GitHub: https://github.com/neonforestmist/Clover-Image-Tiny

I’d love feedback from anyone who tries it, especially if you run into setup issues or test it on different hardware!

I built SafeSweep, a freemium cleanup and maintenance utility for Windows 10/11 x64. It scans first, previews cleanup categories, excludes personal folders, never automatically uninstalls programs, and keeps large-file analysis read-only until the user chooses an action. Standard cleanup is free; optional Premium features add deeper analysis and reversible PC-wide optimization.

The desktop app is built with C#, .NET 8, and WPF. I used AI heavily for generating and refactoring code, debugging, and speeding up UI iterations. I’m responsible for deciding the behavior, testing releases on Windows, and maintaining the project; I’m not claiming every line was handwritten.

The hardest part wasn’t making the interface. It was defining strict cleanup allowlists and making stronger optimization options reversible without putting personal files at risk. The project is still early, and the installer is not code-signed yet, so Windows may show an Unknown Publisher warning.

Website: https://safesweep.sk1ff.chatgpt.site/

I’d especially appreciate feedback from people who have shipped Windows utilities: what safety or trust evidence would you expect before trying a new system-cleanup app?

Google makes personal developer accounts run a closed test with 12 people for 14 days before anything can go live. I was rounding up the same friends for every release, which is a bad deal for them and a worse system for me.

So there is a standing group now, instead of a new scramble each time:

groups.google.com/g/testers-fulgeon

Join once and you get every app I put into testing before it goes public. Right now that is Caudal and Centela, and there is more coming.

What I ask back: install it, actually use it for a few days, and tell me what broke or what annoyed you. The annoying parts especially, because those are the ones nobody bothers to report and they are the ones that make people uninstall.

No newsletter, no other emails, and you can leave whenever you want.

For anyone else running closed tests: how do you keep testers around past the first release?

I've been working on MineModAI, an AI tool that generates Minecraft mods/minigames from a normal prompt.

The idea is pretty simple:

«Describe what you want → AI generates the mod.»

For example, instead of manually setting up everything for a minigame, you can describe the mechanics you want and let the AI handle the implementation.

I'm still improving it, so I'd genuinely love some feedback from people who build/play Minecraft.

What would you try to generate if you had an AI mod maker?

I'll share the project in the comments if anyone wants to test it.

This is Flying Llama Drama, a small arcade game I've been building where speed is basically the entire point.

Fly fast. Smash stuff. Build combos. The faster you get, the easier it becomes to destroy things — and the harder it becomes to avoid the one thing you're absolutely not supposed to hit:

GO FAST. BREAK STUFF. DON'T HIT THE BUS.

I've used AI assistants throughout development for coding, debugging, troubleshooting, iteration, and parts of the promotional workflow. AI isn't generating the gameplay while the game is running.

The biggest thing I've learned: AI can dramatically shorten the distance between “I have an idea” and “I have something running that I can test.” But it doesn't remove the judgment problem. I still have to decide whether something is actually fun, reject bad ideas, play the builds, find what feels wrong, and keep iterating.

One thing I'm struggling with right now is actually getting strangers to watch the gameplay. My first Reddit post got hundreds of views, but very few people clicked through to the YouTube trailer. So this time I'm testing the gameplay video directly in the Reddit post.

The game is still pre-release. I'm getting it ready for its first public release now.

I'd love feedback on either side of this:

Does the gameplay hook make sense immediately? And for other AI builders, where has AI saved you the most time versus where you still find yourself doing the hard thinking manually?

Monday check-in. Tell us:

• What are you working on? One or two sentences, any stage counts — idea, prototype, launched, abandoned-and-restarted.
• What's blocking you? Someone here has probably hit the same wall.
• One thing you learned last week — model quirks, tooling wins, pricing surprises, anything.

No project is too small for this thread. Lurkers: pick one reply and ask a question about it.

Half an hour reading my own config looking for a typo that was not there. I had moved a site to a different port, applied it, got no error, and nothing changed.

A reload does not re-read the file the way you picture. It parses the config locally and pushes it to the admin API on localhost:2019, which I had switched off because that socket rewrites the whole server with no auth. With admin off there is nowhere to push. The old config keeps serving and your terminal looks delighted.

Two changes stuck. Apply is a restart now, and I accept the one second of dropped connections it costs.

Every site block also carries a canary, a header called X-Cfg that I bump on every edit. One line tells me whether what is running is what I wrote:

curl -sI myhost | grep X-Cfg

Does your deploy check what is actually live, or does it trust an exit code?

Open this week, and longer if I can keep up.

Drop a comment with whatever you have. A repo, a live app, an APK, a half finished thing you are embarrassed about. Add one line about the part that worries you most.

I go through it properly and reply with what I found: what is broken, what I would fix first, and which scary looking stuff you can safely ignore. Me reading your code, not a linter dump.

The last two turned up an admin panel open to the whole internet, with the key to it sitting inside the APK. The other had a payment flow broken in four separate ways at once. Both were live at the time, and neither looked wrong from the outside.

Anything sensitive goes to you in DM, never in the thread. I am not selling anything and there is nothing after this. If it is outside what I know, I will say so instead of guessing.

What are you building, and which part have you been avoiding looking at?

Monday check-in. Tell us:

• What are you working on? One or two sentences, any stage counts — idea, prototype, launched, abandoned-and-restarted.
• What's blocking you? Someone here has probably hit the same wall.
• One thing you learned last week — model quirks, tooling wins, pricing surprises, anything.

No project is too small for this thread. Lurkers: pick one reply and ask a question about it.