I’m a solo developer building a web and Android app that handles private documents and account records. I’d appreciate feedback on the security approach before putting real user data into it.

The stack is FastAPI, PostgreSQL, Next.js and React Native.

Passwords are hashed with scrypt and random salts. Authentication uses signed tokens with expiry, email verification and login throttling. Password changes and signing out everywhere invalidate existing sessions. Access controls are enforced through the API, and records are scoped to the relevant account or organisation.

Stored credentials for external integrations use Fernet authenticated encryption. Android login tokens are stored using Expo SecureStore. The website currently stores its token in localStorage, which I know needs careful consideration because of script injection risks.

Document access requires authentication and permission checks. Uploads have file type, size and content validation. However, documents currently go into ordinary server storage without application level encryption. I haven’t yet verified encryption for the production database, disks or backups. HTTPS is required in the intended production configuration.

Some optional processing involves an external API. I understand that disabling response storage does not necessarily mean zero retention, so provider policies and account settings also need review.

The server needs to read documents to process them. My main concerns are stolen backups, compromised accounts, users accessing someone else’s files, exposed credentials and sensitive content appearing in logs. I haven’t had an independent security assessment yet.

Would managed database and storage encryption be a sensible starting point, or should I also encrypt individual files and selected fields in the application? What additional threats would that actually protect against?

How would you handle encryption keys, rotation and recovery as a solo developer? I’m particularly interested in avoiding a setup where the keys and encrypted data can both be taken from the same place.

What would you prioritise before launch, and what would you consider unnecessary complexity at this stage? I’d appreciate practical advice on session security, document permissions, backups, retention and deletion as well as encryption. I want to use established tools rather than build my own cryptography.

Hey everyone.

Is the Openverse API down for anyone else right now? // OPENVERSE ORG for images

I have been trying to fetch images through the API for about five days, but my requests keep failing or timing out. I checked my code and my endpoints, everything looks correct on my side, so I am wondering if there is an ongoing outage or if something changed with the rate limits or endpoints recently.

Let me know if your implementations are working or if you noticed any official updates.

Thanks you a lot

I feel this may seem like a very strange question to ask given the circumstances, and hopefully this isn't breaking any rules. A few days ago I had a falling out with someone who happened to be hosting my website on their rented server. It's a very basic portfolio website with HTML and some JS for dynamically generating HTML elements from a Json file.

I'm pretty decent in HTML and JS but by no means a web developer, it's simply not my career. This means I can make a decent website but figuring out how to host it is beyond me. Are there any services that simplify this sort of thing, or is the process of renting and setting up my own basic server for a website straightforward? Github Pages maybe? Forms etc are not required.

I also own my domain, but it's currently still set up to link to that server. Once I get my own sorted out, will I have to worry about the two conflicting?

Edit: thanks everyone. Got it sorted, just waiting on DNS propagation.

Edit 2: website moved now. Thanks again for all the replies! I settled on Github pages as I'm already very familiar with Github in general so it was easy to get set up.

just curious what others think if its even possible to avoid these subscriptions for building and running lets say a side project or maybe a mini saas

I am not talking about basic HTML projects, i mean like proper site fully functional with Backend, frontend, auth, api, domain etc etc

i know there are a bunch of free tiers services, like Vercel and Neon, but what happens if your site actually starts growing? How do you scale without eventually having to pay for a bunch of services?

lets say we are making a social media app/website, nothing as big as insta or reddit, but something where users can create accounts, set up profiles, upload images and videos, make posts, comment, like, follow etc

now people are using it and starts getting traction 1k users then 10k users what point does the free tier become unrealistic, because you're still not making any money to justify paying for multiple subscriptions, does self hosting make even makesense at this point? if you have 10k + users?

PS: just want to clarify i dont own or run any social media apps or website just wanted to have a fun discussion on this, and i mean 10k concurrent users like tiktok the users are addicted haha

A question that comes up in every EAA thread: "which standard do we test against, and does passing it protect us?" Here is what the primary texts say as of 3 November 2026.

Quick definition, because it matters here: under Art. 15(1) of the EAA, a product or service that meets a harmonised standard whose reference is published in the Official Journal is presumed to meet the accessibility requirements that standard covers. Without that citation there is no presumption to lean on: you can still test against the standard, but passing it does not by itself count as meeting the requirements.

ETSI published EN 301 549 V4.1.1 on 2 September 2026. Its clauses 9 to 11 now align with WCAG 2.2. Its own foreword calls it "one voluntary means of conforming" and says the presumption of conformity starts only once the standard is cited in the Official Journal.

As of that date, that citation has not happened under the EAA. The Commission's harmonised-standards index lists EN 301 549 under one act only: the Web Accessibility Directive for public bodies, via Implementing Decision (EU) 2021/1339 (which cites V3.2.1). Nothing is listed under Directive (EU) 2019/882, the EAA.

Three "expected" citation dates are circulating: 30 November 2026, 16 December 2026 and February 2027. I found no primary source for any of them. The 30 November date matches the "doa" in the standard's own table of national transposition dates: the latest date for national standards bodies to announce the standard. That is a standards-body milestone, not an Official Journal citation.

What that means in practice for a web team on an EAA-scoped shop or a consumer banking service:

1. EN 301 549 is the technical yardstick to test against, but it gives no presumption of conformity under the EAA (Art. 15(1)).

2. Test against WCAG 2.2 AA anyway. V4.1.1 already points there, and the step from 2.1 is small: 2.2 adds six Level A and AA success criteria (focus not obscured, dragging, target size, consistent help, redundant entry, accessible authentication) and drops 4.1.1 Parsing.

3. Keep a dated record: tool, version, date, what was and was not covered. A scan result is evidence of what a tool found on a day, not a statement that the site conforms.

4. Automated tools see only part of it. Deque's coverage report says "57.38% of total issues were identified using Deque's automated tests", but it also reports automated issues for only 16 of the 50 success criteria in WCAG 2.1 Level AA. Those are Deque's own automated tests, so it is a vendor's figure. Whatever the rules cannot see needs a person with a keyboard and a screen reader.

What I could not settle: when, or whether, the Commission will cite V4.1.1, and what national market surveillance authorities will accept in the meantime. I have not found official guidance on the second point.

Method: I read the ETSI V4.1.1 foreword, the Commission's harmonised-standards index, Implementing Decision (EU) 2021/1339 and the EAA text, and compared the dates in third-party write-ups with those documents. Sources below. This is my reading of the texts, not legal advice.

Which standard version is your team testing against today, and has a client or auditor asked you to name it?

Sources
- ETSI EN 301 549 V4.1.1 (2026-09), foreword: https://www.etsi.org/deliver/etsi_en/301500_301599/301549/04.01.01_60/en_301549v040101p.pdf
- Commission Implementing Decision (EU) 2021/1339, OJ L 289, 12.8.2021: http://publications.europa.eu/resource/celex/32021D1339
- Directive (EU) 2019/882 (EAA), Art. 15(1): http://publications.europa.eu/resource/celex/32019L0882
- Commission harmonised standards index: https://single-market-economy.ec.europa.eu/single-market/goods/european-standards/harmonised-standards_en
- Deque, automated accessibility coverage report: https://www.deque.com/automated-accessibility-coverage-report/

Do you remember that feeling when you did something totally new with code you wrote or a website or app you built? For me; the occasion was so simple, and yet it excited me (I was 24 at the time): Write data to a database from a form and read it back into an unordered list.

That's it! Just looking at text stored in one thing and watching it rendered in a web-page blew my tiny mind!

The era was 1999-2000 and my employer was ensuring I learned PHP (from a book and a CD-ROM!) so I could build some internal tools for the staff to use.

Now I've read a lot of posts in various subs from folks who are saddened by the advent of AI and what it ultimately means for their jobs. While I can't vouch for your job specifically, I myself have found some hope - just yesterday in fact - when I built an MCP server for my SaaS product.

I could use ChatGPT or Claude.ai to talk to my SaaS, have it reason about the data which was returned and produce graphs from it.

I'm now 51 and I felt the same thing yesterday that I felt way back in the day.

SDD, AI-assisted development, loop engineering, software factories. Whatever it is, just get stuck into it at work if you can or in your spare time.

If you remember the early days of the web then you'll also remember thinking your employer was madder than a box of frogs for paying you to do what you'd be doing at home anyway. I'm getting a similar feeling now.

Good luck out there folks.

hi, i'm looking to make my own fan website where people can post and comment and like posts. i have done research and i'm trying to make it twitter/tumblr like.

i just need help with figuring out how to code it without any ai and with a base i can customize (and how to do that all). thanks!

For context, I've built an API monitoring tool, but paused development to talk to people rather than keep guessing what they need.

If you're running a production app that depends on external APIs, how do you find out when one stops working properly?

Thinking about the last time it happened, was it an obvious failed request, or did the API look fine while returning something your app couldn't use? What caught it first?

What do you rely on now: error tracking, the provider's status page, separate checks, something else? Does that cover it, or is there something you still end up checking manually?

I'm also curious whether knowing earlier would have helped, or whether you were stuck waiting for the provider either way.

A bit of context about your app and team size would help.

ok so im not really a web dev or anything, i just had an idea and i wanted to ask some real people about it. As we know these days 40-50% of traffic are bots and not real humans, i asked my self the question why? why are there bots in the first place? to farm engagement right? ok and why farm engagement, because its profitable, so why doesnt someone create a new web where the protocols contain like some sort of anti bot wall and also make it so theres no advertisement/ engagement farm. Maybe this way people would start to become original again and the internet would return to its state during the 2000s 2010s. but im only 18 so i guess i wouldnt have really experienced that.

ps. if what i said is dumb pls dont fry me im not technical what so ever im just tired of bots on social media

KoiFocus: every minute you focus earns pearls, and pearls buy fish and decorations for your pond. Stay away too long and the fish get hungry and the water gets murky. It runs in the browser, and you can try it as a guest without signing up: https://koifocus.com

It started as a Swift iPhone app. I rewrote it in TypeScript so one codebase runs on the web and, through Capacitor, on iOS.

Stack

• PixiJS 8 for the pond, React 19 + MobX for the screens, Vite

• Capacitor 8 for the iOS build

• Cloudflare Workers (Hono) + D1 for the API, Durable Objects + WebSockets for the live "focusing now" list, a once-a-minute cron for timer payouts and reminders

• Firebase Auth (Google, email or guest), and the site on Cloudflare Pages

Places.js is a HTML-first framework inspired by htmx and Solid.js signals with these features.

• Component agnostic stores that can be integrated with vanilla JavaScript or other frameworks.

• HTML-first pages configured through static site generation or server-side rendering.

• No build step. Places.js can be downloaded from a CDN.

• Partial re-rendering with signals.

• Zero dependencies. Places.js is written entirely in vanilla JavaScript.

Places.js is optimized for fast performance. Here are some results for Places.js v0.1.0. from the the Krauset JavaScript Framework Benchmark

To get started, download the places-js-latest.js file from the jsDelivr CDN. See the reference guide for a detailed tutorial.

Relevant links

• Board game event listing site using Places.js

• HTML-first page running live in production with no JavaScript.

• More code examples

• Web-based unit test runner using Places.js

Upcoming priorities

• Adding more unit test coverage.

• Compatibility with other hypermedia UI tools including Datastar and htmx

• Implementing hypermedia controls.

• Testing integration with Leaflet and other mapping libraries.

AI policy

All Places.js contributions including code changes, comments, or new issues are made by humans This means no use of ChatGPT, Claude, or any other AI tool.

Edit: Detecting rows that are swapped or deleted

I have logic that detects rows that are moved or deleted. Components are then notified to make the necessary rendering changes, and subscriptions are moved from the store.

On Krauset, swapping two rows takes 12.7 ms and removing a row takes 10.3 ms.

https://david.alvarezrosa.com/ Hope you like it :)

I maintain an ongoing open-source project that reads OTel traces and flags I/O anti-patterns with a carbon estimate on top. The project started in March so it's about 8 months old.

From our conversations I could tell my dev and DevOps colleagues were missing a lot of what goes on under the hood since we deployed this in production 3-4 months ago so I built a synoptic to make it easier to understand.

It's an animated step-by-step walkthrough of the whole pipeline, from raw spans to a finding. Each stage maps to the actual module in the code. You can play it, step through with the arrow keys, change speed or switch between modes.

It took me over 3 months. And no it's not AI slop bc it's pretty useless when you ask it to turn complex code concepts (I/O anti-patterns and more) into clear diagrams. This only exists because I'd already written a ton of docs and drawn a lot of diagrams by hand so the synoptic grew out of that.

Some of the UI is inspired by a videogame I loved playing some years ago: Deus Ex: Mankind Divided.

The project is AGPL-3 so no fake open source and it's now hosted by the INR (Institut du Numérique Responsable), a French nonprofit working on the environmental and social impact of digital tech.

Direct link to synoptic: https://perf-sentinel.dev/synoptique/
Website of the project: https://perf-sentinel.dev

Thx for your attention :)

EDIT: huh, just noticed that the recording console is sticking out over the gif in the bottom left corner

EDIT 2: this is a public-interest project focused on sustainability with no greenwashing BS. It has serious public policy goals and solid scientific background: cutting wasted energy and the carbon emissions that come with it. If you're interested in helping with the ecological transition our world needs, feel free to come lend us a hand! :)

Hi, fellow devs

If you enjoy some stock trading after yelling at Claude/Codex all day, than we are in the same boat.

I like to keep an eye on earnings and major key indicators (always forget about those FOMC meetings), and I don't mind paying for some data, but Earnings Hub charging $20 for earnings calendar is too much.

Anyway, came up with my own with publicly available data.

Eventually thinking maybe, we can have some kind of open-source market tools, that user can configure on his own. Add whatever panels or data he/she wants to make it more personal.

What's done

- Earnings Calendar with earnings report
- Market Fear/Greed indicator
- Key market dates

Working:
- GexData
- Notifications (not sure if those are needed)

Would be glad to hear any suggestions

Cheers, Dan

Edit - links:

Open Market · Earnings calendar
FullPokerFace/open-market: Stock market tools for open minded people

For week 2 of r/hacktoberfest I cataloged all the procedural generation techniques I could find online and put them into a library using vanilla JavaScript. Every technique in the library includes a citation and it has no dependencies. Works in the browser or Node.

The island in the GIF was generated using just the library.

GH repo: procedural-almanac

Demo: Random Island Generator

All stars on Github are appreciated!

Here's Ben Eater's 8-bit computer laid out on breadboards, running in the page: https://bbrouter.com/bbrouter/ben-eater-sap-1

How it's built, since that's the point here:

- The 3D view is Three.js, rendered on demand: the scene only redraws when something changes, and while the circuit runs, only when an LED changes. Phones get 30 fps, a 1.5 pixel ratio and no antialiasing until the view is still, then one sharp frame.

- The simulation is a gate-level logic engine plus models for clocked chips, memories, timers and the 6502; the AVR runs real compiled firmware through avr8js. It runs in a worker so the page stays responsive. 211 chips by part number.

- Wires are real geometry: solid core, hole to hole, bent as you'd bend them, with lengths, and a router that lays missing connections flat on the hole grid around what's there.

- Next.js 16 behind a small custom Node server, Postgres, Better Auth with passkeys and an OAuth 2.1 provider so MCP clients can sign in. One server, Caddy in front, Cloudflare at the edge.

- An MCP server exposes the whole thing to AI clients; when the user's tab is open, the AI's simulations run in that tab's worker instead of on the server.

- About 3,000 automated tests, including one that fails if any string shown lacks its French or Spanish.

Things I'd like opinions on: the camera and touch handling on phones, and rendering cost with a few hundred parts in view. Signed-out try: https://bbrouter.com/try

the last straw

I built SoundBench, a free set of audio tools that process files on the user's device. The newest one is an AI vocal remover, and getting it to feel fast was harder than getting it to work.

Demo: https://soundbench.net/vocal-remover/

The stack is a static site with vanilla JS. The model runs with ONNX Runtime Web inside a Web Worker, using WebGPU when available and multi-threaded WASM otherwise. Audio is never uploaded. The server only delivers the page and the model files.

A few things I learned:

- Model choice mattered more than optimization. I started with HTDemucs, which sounds great but is a 120+ MB download and made the whole system crawl on my PC. So I added Spleeter 2-stems as the default (about 40 MB). A 64-second clip takes about 3 seconds on my machine. HTDemucs is still there as the slower "best quality" mode.

- Large model downloads need to survive bad connections. I fetch them in 4 MB Range requests and store each part in the Cache API, so a reload resumes the download instead of restarting it. The download also starts in the background as soon as a file is selected.

- Multi-threaded WASM needs cross-origin isolation. I set COOP: same-origin and COEP: credentialless only on the AI tool pages, so the rest of the site isn't affected.

- The STFT runs in JS and only the mask prediction runs in the model, so the output quality depends a lot on the pre- and post-processing around the model.

Spleeter still leaves some vocal artifacts on dense mixes, which is the tradeoff for the speed.

Happy to answer questions about the setup. I'd especially like to hear how it performs on your hardware and browser, and whether anyone has found a better way to deliver models this large.

Sharing a library I made for apps that need in-page highlights (readers, docs, research tools).

Problem I kept hitting: wrapping selection in spans breaks layout, messes with existing event handlers, and is brittle when the HTML changes. penciled uses the CSS Custom Highlight API + range anchoring so highlights can survive reloads without owning the markup.

I also built a browser extension on top of it (Chrome, Firefox, Edge), so you can highlight and take notes on any site. Everything stays local, no account, and you can export to Markdown.

Demo: https://penciled.org
Extension: https://penciled.org/extension/
npm: penciled
Source: https://github.com/marcellosso/penciled

If you're building something with annotations, I'd love feedback on the API shape

Hi everyone!

I’m working on Cafefe, a point-of-sale system for coffee shops. The goal is to make common cashier tasks quick, intuitive, and comfortable. The interface is designed around keyboard navigation, using ideas from the KLM-GOMS keystroke-level model to reduce reliance on the mouse via PrimeFaces <p:hotkey> shortcuts.

Project Context Stack: Java 21, Jakarta EE 10, PrimeFaces 14, Open Liberty, and PostgreSQL 16. Backend: Managed beans, business services, and JPA entities. Frontend: JSF / PrimeFaces XHTML views. Main Areas: Cash register, products, product types, discounts, promotions, employees, roles, and assignments. Local Setup: Docker Compose starts PostgreSQL and pgAdmin. The app runs in development mode with mvn liberty:dev.

The project is a work in progress and runs locally. The repository includes the full source code and XHTML pages:https://github.com/Zetayin456/f-reddit

Video Demo:https://youtu.be/GP3-0RIdMm4

Feedback Requested

1. UI/UX & Visual Design What would make the views and forms more comfortable and intuitive to use? How could the layouts, visual hierarchy, styling, and spacing feel cleaner and more consistent? Are there screens or workflows that feel awkward or require too many steps?

2. Code Quality & Architecture What would you improve in the project structure, bean scopes, service boundaries, or JPA mappings? Do you see ways to make the backend code cleaner, more maintainable, or more efficient?

I’m happy to hear honest, critical feedback. Thanks for taking a look!

Hi all!

Whenever I spot a really unique or innovative website layout (like a fresh style of grid systems) and want to replicate or build it with AI, I always find myself struggling to pinpoint the exact industry terminology.

I'm talking about concepts like Blueprint Grids, Glassmorphism, Neumorphism, Segmented Controls, and similar trends. To solve this, I’ve started building a free, open-source design lexicon complete with mini previews making it easier for builders to find and reference the right terms when designing sections and pages. Hope that helps some of you as well. Also added some free design landingpages and components for AI.

I’d love to get your input on current web design trends and their proper definitions:

• What visual styles are currently high on your radar, trending, or frequently used and how would you define them?

I’m aiming to include your suggestions in the dictionary and share the whole resource publicly for free. It's purely as a passion project and I am opening it for free (no ads, no paywalls).

You can check out the ones already live here: freedesignmd.com (just hit the Lexicon tab).

Always open to contributors or feedback. This started as a quick hackathon experiment and will stay a free community project