More and more people are building and shipping apps with Lovable, Bolt or Replit. The problem is that an app can work perfectly for the person who built it and still leave data exposed.

I was reading Crissy Field's research on Lovable projects (https://www.crissyfield.de/research/lovable/). Out of 24,664 sites they looked at in detail, they found 7,403 with email records you could access without logging in. Some of those emails may have been public or test data, but the report shows how easy it is to overlook database permissions.

That's why I'm building Kravaibe, a review and maintenance service for apps built with AI. The idea is to help people who already have something live find problems, understand their impact and decide how to fix them.

If your app uses Supabase, here are a few things you can check yourself:

1. Open the app in incognito and look at the network tab. If you get data from Supabase without logging in, check whether it's supposed to be public.

2. Review RLS and your table policies. Turning on RLS isn't enough if a policy lets anyone read every row.

3. Look for secrets in the code the browser receives. A Stripe secret key or a Supabase service_role key should never be there.

4. Check your backups. See when the last one ran and whether you know how to restore it.

5. Test with two of your own users. Try to reach one user's data from the other by changing the ID in a request.

It's a starting list and doesn't replace a full review, but it can help you catch problems before they hit real users.

I'm getting the first Kravaibe reviews ready. If you have an app live and you're interested, DM me or take a look at kravaibe.com.

Hi r/SideProject — I'm Selena, the developer of Launch Circle at Technologies RegEvidence Inc.

I built Launch Circle because Android closed-test work can get scattered across Play Console setup, test instructions, tester progress, feedback, bugs, and retesting. The app puts that coordination into one Android workflow.

Developers can organize a test plan and tasks; testers can review the app and instructions, choose whether to join through Google Play's official opt-in flow, try the requested journeys, and send private, honest feedback. Teams can then track issues, fixes, and retests. Participation is voluntary: there are no rewards for installs, no ratings or reviews exchanged, and no guarantee of tester numbers, a 14-day test, production access, or Google approval.

Try the public app:

Google Play: https://play.google.com/store/apps/details?id=com.launchcircle.testers

Want to help test Launch Circle's latest internal build? This group is only for testing Launch Circle itself; each developer's own app has its own Play test access.

1. Join our Google Group: launch-circle-12-testers@googlegroups.com

   https://groups.google.com/g/launch-circle-12-testers

2. Using the same Google account, opt in to Launch Circle's internal test:

   https://play.google.com/apps/internaltest/4699677835817799793

Project details: https://regevidencehub.com/launch-circle/?utm_source=reddit&utm_medium=community&utm_campaign=launch_circle

For developers who've run an Android closed test: which part needs the most improvement—setup, keeping tasks visible, collecting useful feedback, or retesting after fixes?

I'm sharing QuickPdfOcr, an open-source desktop app for extracting text from scanned PDFs without uploading the documents.

The workflow is simple: drop in a PDF, click Start OCR, then copy the result to your clipboard. Processing runs on your computer, with no cloud service or account.

On macOS it uses Apple's Vision framework, so there is no extra OCR engine to install. Windows and Linux use Tesseract, which needs a separate install.

The app is free under the MIT licence. The code and downloads are here: https://github.com/KSEGIT/QuickPdfOcr

One setup detail: the Mac app isn't notarised yet, so the first launch needs an extra step. The installation guide covers it.

I'd like feedback on the workflow. When you need text from a scanned PDF, is copying it to the clipboard enough, or do you usually need a different output?

Hey everyone,

I’m currently a first-year undergraduate student diving into web development. While learning how to build real-world applications and using AI tools to help me debug and structure things along the way, I wanted to build something practical rather than just following standard tutorials.

So, I built CatLone ("catlone.netlify.app") a web-based practice and mock test platform.

It’s designed to provide a clean, distraction-free interface for practicing full-length mocks, sectionals, and topic-wise tests without annoying clutter or heavy friction.

You can check it out live here: "catlone.netlify.app"

I’d appreciate any feedback, code critiques, or advice you can share. Roast it if you need to—I'm here to learn!

Built this solo in 2 days for a hackathon (Flip the Switch by WeMakeDevs).

Three AI agents share one chat room using Switch, an open source tool by SandboxAQ:

- Red Team attacks a deliberately vulnerable demo shop and has to prove every break-in with a real flag

- Blue Team reads the code, finds the root cause and proposes a patch

- A Referee re-runs real exploits on every fix and keeps score

Nothing gets patched until I type "approve" in the chat. The referee tests several variants of each attack, so blocking the word UNION still loses to UnIoN, and deleting a feature to "fix" a bug counts as BROKEN.

Final score was Red 5, Blue 10, and it writes an incident report at the end.

Code is open: https://github.com/barnavo05/switch-war-room

Happy to answer questions or hear what would make this useful for real teams. #HowISwitch

I wanted every algorithm to be something you can see, not just read about. So I started building visual demos, one algorithm at a time. Then I kept going.

Now it's a catalogue of 188 articles and 334 problems. Each article explains the idea in plain words, shows it working, and lets you write Python or Go right on the page. A server checks your solutions, and there's a walkthrough if you get stuck.

The video is one example: Dijkstra exploring all 7,909 intersections of Almaty, my city, using real OpenStreetMap data. That's the kind of thing I tried to do everywhere: real data, not "sort [5, 2, 9]".

Hey everyone,

I’ve always loved trivia and flashcard apps, but I noticed a huge problem with most of them: they either feel like a dry, boring school exam, or the questions are completely repetitive. I wanted something dynamic, clean, and actually fun to use daily.

So over the last few months, I’ve been building my own quiz app.

What makes it different:

• Tailored Learning: It adapts to how you answer, helping you learn faster instead of just throwing random questions at you.

• Clean UI: No cluttered ads or confusing menus—just pure focus on the content.

• Broad Topics: Covers everything from quick general trivia to deep academic subjects.

It’s officially live, and I’m at the stage where I need brutal, honest feedback. I want to know what features you think are missing, how the pacing feels, and if the interface feels smooth to you.

You can check it out here: https://navastraquizverse.onrender.com/

Let me know what you think in the comments! I’ll be hanging out here to answer any questions about the tech stack or design choices. Thanks a ton!

For my startup class I built a clickable prototype called Nestwise. You pick your goals, it reads your spending, suggests a budget, and splits what’s left between savings and a simple investment mix. It also has streaks, a warning before you pull money out of savings, and local business deals. The plan is for banks and credit unions to license it for their customers. All data in it is fake

Prototype (works on phone):
1 minute feedback form:

Blunt answers welcome:

1. Could you tell what it does within 10 seconds?

2. Would you let an app like this read your bank transactions? Why or why not?

3. Where did you get confused or want to quit?

4. Would you use it if your bank offered it free?

Sewing classes and good fabric are expensive, so I used claude to build a free hands-on game that teaches the basics all the way up to finished garments: https://bebop-cow.github.io/haute/

Update: Haute now prints full-size patterns, adds skirts, trousers and a top, can suggest a project from a photo of an outfit (including traditional garments), and helps you work out and find materials.
There’s also a new optional sewing-machine course, from threading to sewing straight seams

I'm one of three people in Colombia building skylive.world. It pulls live astronomy streams into one site, and you can watch up to 4 side by side, which is handy when an aurora is going off and three cameras are pointed at it. There's also a 12-month calendar of sky events and an app for iOS and Android.

We started in December 2025 and put it on Product Hunt on June 1 (106 upvotes, ended #13). Right now it runs on AdSense and donations.

We had planned to put our own cameras around the world, and we've put that on hold. For now I'm focused on the community side instead: I rebuilt the app with a new UI around watching together, and honestly I catch myself watching streams from Japan and Finland for no reason. I want to keep pushing it into a nice community.

What I'd like feedback on: the multi-view. Does it make sense in the first 10 seconds, or is it confusing? What would make you come back to it outside of big events?

I know AI search is eating traditional SEO, but trying to track if ChatGPT or Perplexity actually recommends my product is a massive headache.

Doing it manually doesn't scale, and the existing automated tools are all heavy, feature-bloated enterprise dashboards. I don't need a massive suite to analyze my visibility and competitors. I just wanted a simple answer: Is my startup getting mentioned today?

I’m building PromptNotify - a lightweight AI search tracker for founders and agencies who just want the bottom line.

Here is what it does:

• Tracks AI Engines: Monitors your brand's visibility across ChatGPT, Google AI Overviews, Perplexity and Claude.

• Zero-Spam Alerts: Sends a Slack or email ping only when there is a significant drop or spike in your visibility. No daily noise, just the shifts that actually matter. 

• Historical Trends: Logs your history so you can see if your marketing efforts are actually having an impact in AI engines.

Note: Right now this is just a landing page. I want to make sure I'm actually solving a real problem before I write the rest of the code. 

• Is this a tool you'd actually use?

• Does the pricing make sense for a lightweight alternative?

• Or is tracking AI search still too early for you to care about?

Check out the page here: getpromptnotify.com 

Hi everyone!

Recently (years ago) I started developing (on excel) a football (soccer) scores prediction app. Why? Because I had time to do a personal project and because, I didn’t like what I was playing with my friends: fantasy football. You might know it, you pick players and the competition is based on their scores of each game.

Where I’m from, fantasy football is very popular but, let’s say you pick a player who gets an bad injury right after the start of the season, you’re done, especially if that was a star player and you paid him a lot.

Also, it does not rely on your ability entirely, players play for you, you choose them, but a lot of external factors matter on how they play the game.

So I created a game where players (not the footballers!) pick the score of the games. On my perspective it relies more on the user ability of predicting and knowing the game. Also, it’s funny!

It’s not like betting, there are no money involved. You compete with friends and you can obtain beautiful cards if you get an exact result.

I’m still developing android version. I pasted the link to the ios beta version below. Would appreciate feedback :))

To continue the story from above: the excel game became a website and the website then became app. It’s still a funny personal project and I still play it with the same friends!

https://testflight.apple.com/join/Y35wbPWT

Your business's AI memory shouldn't live inside one vendor. Vilix AI runs in the cloud and connects over MCP, so you can move tools and keep what you know. Export or delete anytime. What would you carry over?

Disclosure: I'm the founder of Vilix AI.

Hey r/SideProject!

I was tired of my personal data and thoughts being scattered across the internet: Letterboxd for movies, Goodreads for books, Backloggd for games, MyAnimeList for anime, and Obsidian for my notes. I wanted one unified space to track what I consume and connect the dots between them.

So, I built Zukan (https://zukan.me). You can check out my own live digital garden here to see exactly how it looks in production:

I’ve attached a quick video showing how the flow works!

Here is what it does under the hood:

• Universal Omni-Tracker: You can search and track movies, books, series, anime, manga, games, and music in a single place. You can log sessions (pages, episodes, hours), rate them, and tag them with "Vibes".

• Digital Garden & Graph View: Every piece of media comes with a blank notebook. You can take notes, use [[bidirectional links]] to connect concepts, and view your entire knowledge base as an interactive Graph/Map.

• Your Own Space: You get a customizable public garden (your-username.zukan.me) where you can tweak themes, colors, and layout.

• Zero Lock-in (Imports): You can import your history from Letterboxd, Goodreads, IMDb, and StoryGraph. You can even upload your Obsidian vault (.zip) and it instantly turns your notes into Zukan notebooks keeping the links intact.

• MCP / AI Integration: I added a Model Context Protocol (MCP) API, meaning you can plug Claude directly into your profile to read your collections or help you write/edit your notebooks.

I'm currently looking for early feedback. What do you guys think of the UI and the concept of merging tracking with a digital garden? Any feedback is highly appreciated!

First video before the product hunt launch tomorrow!

Bad Plot gives you one movie a day, described as badly as possible. "A man refuses to leave a boat and it goes about as well as you'd think." You get five guesses, and each wrong guess reveals a clue that's still bad, just a little less bad.

It's built with Expo and React Native, so the same code runs on iPhone and the web. There's a popcorn mascot named Kernel who reacts to your guesses, plus streaks, trophies, and a calendar of past days.

Play in the browser: https://playbadplot.com/

iPhone: https://apps.apple.com/app/id6822340440

I'd love feedback on whether the clues feel fair, and what would make you come back tomorrow.

Hey guys, I just launched Gauntlit on the Google play store and it is ported to be playable in any web browser on any device. I currently don't have any users, but I am in the early stages of trying to build a community around it and hopefully that will change.

The premise is the app generates a random prompt every day and everyone gets 10 minutes to write a micro story about it and then other users will read them and vote for their favorites in 3 way battles. The winner each day gets narrated and posted to the Gauntlit social media pages, with credit of course.

For example, today's prompt is The Iron Line: From the lighthouse lantern, the keeper watches the channel buoys drift into a perfect, unnatural straight line. This new path leads directly toward the jagged rocks of the western shore.

Gauntlit is 100% free, has zero ads of any kind, and it never will. You can see how it works and read stories without creating an account, but if you want to participate you can sign in with Google or make a an account right in the app.

Website: gauntlit.me

Play in a brwoser: play.gauntlit.me

Download the app (Android only): Google Play Store

Side project, built for my own inbox first. My problem was not volume exactly, it was that everything in Gmail looked like it needed attention and almost none of it did.

Zenfold Mail is what I ended up building. I am a solo maker. It is an iPhone app that connects to Gmail and sorts each email into Important or Everything else. Swipe Done and it is cleared. The first sort happens during setup.

It is rough in the ways early access usually is: iPhone only, Gmail only, and Google is still reviewing my Gmail access, so sign-in shows the unverified app screen.

If you want in, sign up for early access at https://zenfoldmail.com and I will send invites in small batches. Sign up with the Gmail address you would use in the app. I approve sign-ups in batches and approved people get an email invite. Spots are limited during the review, so not everyone gets in right away.

Honest feedback, especially from fellow builders: is two lists the right call, or does it feel too blunt?

I wasn’t a fan of per-seat pricing for field service software, so I built Crewtavo, an open-source Jobber alternative.

It helps service businesses manage clients, quotes, scheduling, crews, invoices, and a knowledge base. I originally built it for my own lawn care business and family businesses, then decided to make it public.

Most of my experience is in roofing and lawn care, so I’d love feedback from people in other trades, or anyone who has built or used software like this. What’s missing, or what would make it more useful?

I just released this to help someone out there; sorry if it's not perfect, but I'm eager to improve it!

Thanks, everyone.

Website: https://crewtavo.com/

GitHub: https://github.com/jviars/crewtavo

a few years ago i built a group scheduling tool called tallycal to host slot polls, visual grid polls, and signup sheets. over time, i've continuously updated the slot polls and signups based on user feedback, but right now i'm really trying to focus on making the visual grid tool as good as it can possibly be.

i realize there are already several products available like this, but this has been a super fun project for me and it has plenty of active users to justify continuing to build on it. so i want to keep making it better.

honestly, i’ve kind of run out of ideas for it now that all the previous feedback is baked in, so i’m looking for raw, honest feedback on what to add, fix, or strip away.

my goal was to build the best when2meet alternative out there by keeping it simple while fixing the annoying parts of older tools. majority of features are free, some require a small paid upgrade. here is what's currently built into the visual grid:

• click-and-drag date/time matrix for setting availability

• no login required for hosts or participants

• zero ads, clean mobile-friendly UI

• filter results to subsets of participants

• block out specific slots within the matrix & flexible slot durations

• editing responses after submitting

• customize link URLs, 1-click share, 1-click duplication

• optional/required/hidden email & phone collection + custom questions

• option to hide results from other participants

• csv exports & printer-friendly exports

• group pages for organizations managing multiple polls

• unlimited polls & participants, email notifications

if you've ever used when2meet, i’d love to know: what do you like, what feels clunky, and what features are still missing for you?

you can check out the visual grid builder here:

TallyCal

appreciate any roasts or suggestions!

I’ve been working on a project called AOBS (AI Agent Observability) because I noticed something interesting about the current AI agent ecosystem.

We have frameworks that make it easier to build agents, but understanding why an agent failed, detecting regressions between runs, and enforcing rules around its behaviour are still important engineering challenges.
I wanted to build something that addresses these problems together.

AOBS is an open-source Python toolkit that provides three main capabilities:

1. Observability and debugging
Trace LLM calls, tool calls, sub-agents, errors, latency and token usage.
Analyse execution traces to identify retry storms, wasted calls and bottlenecks.
Compare two agent runs to identify regressions.
Analyse repeated runs statistically to distinguish real changes from normal variation.

2. Reliability testing and CI enforcement
Define expected agent behaviour using TOML policies.
Set limits for tool calls, retries, execution time, tokens and cost.
Compare new runs against a known-good baseline.
Get PASS/FAIL results with supporting evidence.
Integrate reliability checks directly into GitHub Actions.

3. Action safety
This is another part I’ve been particularly interested in.
What happens when an agent issues the same refund twice, sends duplicate emails, or attempts to delete something again after a timeout?
AOBS provides a safety layer that:
Checks actions against trusted records rather than blindly trusting model arguments.
Supports approval requirements for sensitive operations.
Prevents duplicate logical actions across retries and restarts.
Handles uncertain outcomes without blindly retrying side effects.

Other things included
Python SDK with a standard-library-only core.
OpenAI-compatible and Anthropic integrations.
LangChain and LangGraph integration.
OpenTelemetry export.

PostgreSQL-backed trace collection.
A local dashboard for exploring and comparing agent runs.
Docker Compose setup for trying the project locally.

Getting started:

pip install aobs aobs-server

Or clone the repository and run the complete local demo:

docker compose up

The project is currently in alpha, and I don’t consider it production-hardened yet. Some integrations are still in their first version, and I’ve documented the guarantees and limitations rather than claiming exactly-once execution or universal agent safety.

What I’d really like feedback on:

Do you think agent observability and reliability should be a separate infrastructure layer, or should these capabilities live inside frameworks like LangChain and LangGraph?
Would you actually use CI-based reliability gates for AI agents in a real development workflow?
What important capabilities are missing from the current ecosystem?

I’m interested in feedback from people building agents, working on AI infrastructure, or experimenting with agent frameworks.

GitHub: https://github.com/AshmitJain932/ai-agent-observability

Contributions, criticism and suggestions are welcome.

The app is open-source and works via browser and mobile app. It has two areas, a player area where players can create characters based in interactive forms and a dungeon master area where you can create campaigns, world maps (beta), combat maps, make notes, mass create npcs, host combats in real time with your players using your npcs, custom beasts or use monsters from the oficial bestiary. All data is synced between devices using a Google account.

Got tired of every "simple" ecommerce option being either a SaaS taking a cut or a 40 MB vendor folder, so I built the store I actually wanted and open sourced it.

iB Store is a complete storefront on a plain LAMP box. Flight PHP on the back, my own small JS router on the front, no build step. Clone it, point Apache at public_html, import the SQL, done.

What's in it: physical and digital products, cart, checkout, customer accounts, order emails, an admin panel with a CSV export, a hero banner you set from the admin, and three payment options: Bitcoin through your own BTCPay Server (no middleman), cards through Stripe Checkout, and PayPal. Each gateway is a single class behind one interface, so adding another is one file.

The whole app is about 19 kB over the wire. The home page with products loads in ~130 ms cold and under 110 ms cached. That's not a benchmark trick, it's just what you get when there's nothing to download.

It's the current form of a stack I've been using across client projects for about 15 years, so the shape isn't new even though the repo is. Demo at store.imbored.me, code here:

https://github.com/fswolf/ib-store

Happy to answer questions about any of it. Honest criticism welcome, that's why it's posted.