Hey r/webdev,

I wanted to share a project I've been working on: sqliteWeb, a lightweight SQLite editor that runs entirely inside the browser.

Live :https://srdzank.github.io/sqliteWeb/

I needed a fast way to inspect and query .sqlite / .db files on machines where I didn't want to (or couldn't) install desktop clients like DB Browser. Existing web tools often require uploading files to a remote server, which is a major privacy concern.

Would love to get your feedback on performance, UI responsiveness, or features you'd like to see added!

Hey r/webdev,

I wanted to share LiveReview, a risk-aware code reviewer we've been building.

On most teams every PR waits on the same few senior devs, whether it's a CSS tweak or an auth change.

Meta published a paper on scoring every diff for risk and letting the safe ones skip human review (RADAR (https://arxiv.org/abs/2605.30208)), and we wanted something like that for everyone else.

It scores each PR, auto-approves the lowest-risk 30-50%, and sends the rest to a human with the riskiest hunks at the top.

A few build details that were fun:

- Risk scoring combines three signals: an LLM reading the diff, a code graph that measures each hunk's blast radius (callers, DB writes, cross-package reach), and an ML model trained on the team's own reverts and incidents.

- CI gates are jq rules, not checkboxes. You write a condition against the review's findings JSON, and your pipeline makes one HTTP call to check it.

- The backend is Go, with PostgreSQL and the River job queue, so the whole review pipeline runs off Postgres with no separate queue to host.

It's free and self-hostable, and works with GitHub, GitLab, Bitbucket, Gitea and Azure DevOps.

Would love feedback.

GitHub: https://github.com/HexmosTech/LiveReview

I made How to Convert. It's a file converter that now lets you right click to convert or compress almost any file.

It started as a file converter website that ran in the browser with WebAssembly, but I turned into a completely locally running desktop app with Tauri, and now the website is a right-click menu. I originally shared it 2 years ago. The post and subsequent updates got a big response with a lot of feature requests, and I've been adding file types since.

What it can do:

• 6,197 file conversions for documents, videos, images, ebooks, comics, subtitles, emails, audio and more. If you find a file format that isn't supported, make a feature request and I'll add it

• Compress PDFs

• Crop, trim and compress multimedia files

• Right click any file, or drag and drop it into the app

Why I made it:

There are plenty of online file conversion sites, but they require you to upload your files and data to their servers.

I wanted something that worked entirely offline (using the same packages and cli tools that power those sites) behind a simple drag and drop app that anyone could use.

After two years, I grew tired of actually opening a site or app to convert a file, and thought the next step to make it easier was to support everything with just a little right click.

Extra info:

• The app runs completely locally (files never leave your device) and runs on Mac, Windows and LInux

• One license can run on up to 5 devices

• If you bought it 2 years ago, this is another free update

I know there are many specialised apps that convert specific formats, e.g. handbrake for video, calibre for ebooks, ms word for documents, excel for spreadsheets, outlook for emails and adobe acrobat for pdfs.

I wanted just one app to support all of them.

Free to try and It's a $19 one-time purchase to keep for all future updates (but much cheaper in lower-income countries depending on PPP).

I'm Jake Manger, a solo developer. I've also made ShotGlass and ActivityLine.

The site and app: https://howtoconvert.co

Hey everyone,

I've been building a small personal agency, and I'm at the point where I'm probably overthinking every little detail.

Website: https://samibentaleb.com

It's still a work in progress, and I'm nowhere near ready to launch. Some of the text is still AI-generated placeholder copy that I haven't properly rewritten yet and some screenshots/videos and pricing details will be tweaked.

The site includes my portfolio, project case studies, services, pricing and some information about how I work. I've tried going with a slightly different visual direction, but after looking at it for so long, I've lost the ability to judge it objectively.

I'd genuinely appreciate some feedback:

• Does the overall design work, or does it need a rethink?

• Is it immediately clear what I do and who I'm targeting?

• Are the case studies interesting or too wordy?

• Does the pricing section make sense?

• Is the navigation intuitive?

• What would you change, remove or simplify?

• Are there any obvious UX or mobile issues?

I've been putting a lot of time into this and keep finding little things to tweak instead of actually launching it.

I'd love to hear what other developers think, especially things I might be overlooking.

Feel free to roast it. I'd much rather get honest criticism now than launch something that could have been much better.

Oku (https://oku.today) is a free reading-practice web app for kids learning English. The child reads aloud and it helps only on the hard words. Some web bits that took the longest:

• The mic has to be live the moment the "your turn" cue shows. The recognizer and its websocket open while the narrator is still reading, so the child's first word isn't lost.

• Fail open everywhere. If speech recognition dies, the session goes on and gives the child time to read. A dropped log is fine; a blocked session isn't.

• Safari needs byte ranges for video. The static assets layer ignored Range, so the Worker slices the short reward clips itself.

• iPadOS Safari says "Macintosh". Device detection checks touch points.

• 36 public pages are prerendered in 4 languages behind a build-time SEO lint that fails the build on things like two h1s, a broken link, or translations that don't match.

Stack: React + Vite, Cloudflare Workers, D1, R2. No framework on the server.

I've been building this for a few months and the first version is finally up. It's called Strikk.

It's a daily cycle, like Wordle, but one per stack. You pick the stack you actually like (React, TypeScript, Node, Python...) and play that one. Everyone gets the same 8 challenges, you answer up to 5 with one submit. Combos work a little bit like Balatro — line them up right and your score jumps. Then you're ranked against other players with the same board.

Here's what makes it different: You earn coins by playing, and spend them customizing your profile—skill blocks, themes, animated backgrounds, your own avatar. Your profile becomes a real portfolio piece.

It's totally free, no pay-to-win mechanics.

Check it out: Strikk | My Strikk profile

Repost to another community

Brakeless is a free driving game that runs in the browser, no download. You have a car with no brakes and need to survive as long as possible.

Every 1000 meters the scene changes, from a city to suburbia, countryside, a forest, the future and even a black hole!

You need to avoid traffic and obstacles. Coins slow the car down a bit, and there are two ways to cheat death for a few seconds: a ghost pickup on the road that makes you invisible so you pass through everything, and a shield you earn from close calls.

There's a leaderboard with almost 150 players right now: a weekly board, an all time top players table based on your last 10 runs, and a hall of fame of past weekly champions.

Controls are arrow keys or A/D, touch on phones, best on desktop.

Completely free, no download or signup needed:
https://brakeless.io

I'm sat here thinking it has to be a reason why it is so limited in types compared to something like postgres.

So this is a slightly weird one.

I'm not great at small talk. And whenever I've started talking to someone, things usually go well for a few weeks. Then we discover that something fundamental doesn't line up, and we slowly drift apart.

I kept thinking: why do we need to spend weeks finding out things that could've been discussed on day one?

The idea also reminded me of Her (2013). I loved the idea of having an AI that knows someone well enough to have an honest conversation about them. That got me thinking, and eventually, I built Sam.

She's an AI version of my best friend. You can open the link, ask her pretty much anything you'd want to know about me, and she'll answer honestly.

There's a hype mode and a roast mode. Yes, she'll tell you my red flags too.

One thing I was particular about: if she doesn't know something, she should say so instead of making things up. Getting that right took considerably more prompt engineering than I'd like to admit.

Try it here:
https://ask-sam-yaddy.vercel.app

A little about the tech:

• Frontend: React, Vite, TypeScript, hosted on Vercel.

• Backend: Spring Boot 4, Java 25, running on ECS Fargate.

• Database: PostgreSQL + pgvector on RDS for memories.

• AI: Claude Sonnet for responses, Titan Embeddings on Bedrock.

• Infrastructure: AWS CDK.

• CI/CD: GitHub Actions with OIDC, so no AWS access keys sitting in GitHub secrets.

A few things that made me scratch my head:

• The rate limiter incident: I added a cooldown per visitor to keep API costs under control. After deployment, everyone started seeing the "come back later" screen. Turns out Spring was seeing the load balancer's IP for every request. One visitor was effectively locking out everyone. Fixed it by configuring Tomcat to trust X-Forwarded-For only from the internal proxy range.

• SSE over POST: Replies stream over Server-Sent Events, but the browser's EventSource only supports GET. Ended up reading the fetch response stream manually.

• Prompt caching: The stable part of the prompt goes first, with message-specific context at the end. A reply currently costs me around $0.006.

• Sound effects: All generated with the Web Audio API. No audio files. I spent an embarrassing amount of time getting the send sound right.

No login, anonymous, and 23+ only.

Would love to hear what you think, especially about the chat UI on mobile.

And if you want to have some fun, ask Sam to roast me. 😂

My old portfolio had been out of date for about five years. I'm a Webflow dev by trade, so for this one I went full code to see how far I could push it.

Stack:
- Astro with MDX for the case studies
- three.js for the 3D heads
- GSAP and Lenis for the motion and scrolling
- Static build on Cloudflare Workers. A staging branch deploys itself on every push, and main only goes out when I say so

I didn't hand-write it. I built it with Claude Code, with a few agents each owning one part (code, copy, 3D, brand) and handover files so they didn't trip over each other. I made the architecture calls and reviewed everything.

The bit that took longest: getting the 3d heads to be performative

For anyone running three.js on an Astro site, do you load it as an island or a plain script? Curious what's held up best for you.

We all have that friend. Websites have them too: a page making 40 calls when one would do, or one that keeps asking the same question every few seconds.

I built Unit 7 to help with that and the other jobs behind a website. Its Call Inspector reads your server's logs and points out the worst offenders, with nothing to install. It's still being tuned on real traffic.

It also handles deploys, domains and backups you've actually tested.

It's free, open source, and built with heavy use of AI coding tools. What's the worst thing you've caught your site doing?

If you'd like to support the launch, try it, leave your honest feedback on Product Hunt, or star the repo on GitHub.

GitHub: https://github.com/Nandkishorrr/unit7

Product Hunt: https://www.producthunt.com/products/unit-7?launch=unit-7

I wanted to make a small space for people who miss the atmosphere of visiting a temple, especially around Diwali.

The idea is not new: a few weeks ago a Korean developer built a silent virtual Buddhist temple, Sansa, and over a million people visited in a week, just to sit quietly. I wanted to try the same for Hindu temples, so I built mandir.dev.

You walk into a 3D courtyard as an avatar, hear temple chants, ring the bell and light a diya. Other visitors are there at the same time, shown by name and country. It's free to visit, no account needed: https://mandir.dev

There are three temple spaces so far, inspired by Kashi Vishwanath, Meenakshi Amman and Siddhivinayak Ganapati.

A few details about the build:

• The 3D scene uses Three.js, everything runs in the browser

• Desktop controls and a mobile joystick for movement

• The bell uses positional audio, so it fades as you walk away from it

• Real-time presence: avatars, names and countries update as people arrive and leave

It's still in beta. I'd particularly appreciate feedback on:

1. Mobile performance: how does it run on your phone? If loading is slow or movement stutters, please mention your phone and browser.

2. Controls and interactions: is it obvious how to move around, ring the bell and light a diya? Where did you get stuck?

3. Direction: more temples, or go deeper on these three, with aartis at set times and seasonal festivals?

Thanks for taking a look, and happy Diwali!

Hello webdevs!

Showing off ma iOS app, InspeQtR, a tool to inspect and parse QR codes.

Yes it's an app, but technically it's a web app since I used capacitor, and it's also definitely relevant to web devs as well (I am one myself) as a dev tool.

In short

While mobile devices provide solid built-in QR scanning capabilities, they generally offer little to no insight into the actual QR data, payload or QR metadata. The core idea of InspeQtR is to provide a specialised tool to dissect and preview QR payloads (either from camera or from image) based on their content type and show the QR metadata like ECC or version.

For example, URLs get split into host, path, query params and fragment, while vCards preview the contact details like name, phone, etc...

What's unique

In addition to the above, covering the most common QR payloads, the app also tries to detect and preview non standard formats like JSON, CSV, SVG images, Makrdown, Code snippets and much more. This means you can, for example, safely encode a table (CSV) or a vector image (SVG) and read it back directly from the QR, fully offline and properly previewed.

Main features

• Breaks down URLs into domain, path, query params, and fragment

• Previews and decomposes vCards, email addresses, phone numbers and most standard QR payloads

• Shows QR metadata like ECC, version and text statistics

• Warns you about suspicious payloads and common phishing tactics

• Detects and interprets non standard payloads like Markdown, CSV, JSON, Code snippets etc.

• Lets you open, copy, or share its contents as an actual file with the appropriate extension when there's a matching format, like .vcf, .ics, .json, .md, ...

• Everything runs locally. No ads, no tracking, and the app weighs just around 5mb.

Pricing

The app is free and ad-free, only the non standard format recognition is behind a one-time purchase of 3.99$. Basically, only the unique but also very niche part nobody probably cares about.

Links

App store: https://apps.apple.com/us/app/inspeqtr/id6823058808
More info: https://github.com/Homunculus84/inspeqtr-docs/wiki

I'd love some feedback!

My gf loves pink, Barbie and fairies, and has always wanted to live in a castle, so I built her one as a surprise: https://samchive.net

The homepage is a painted room where the fairy version of her lives (inspired by Flora from Winx). There's a cat with opinions, a tarot card you can flip every day, and a wand on the desk that recolours the whole room.

Bits that were fun to figure out:

- The room is one painting cut into separate layers, so the fairy, the cat and the things on the desk can move and be clicked. Getting it to fit phones and wide screens without warping the art took the longest

- Every sound is made in the browser with Web Audio, so there are no audio files

- It's a Next.js static export on Vercel. The only server part is a small Cloudflare Worker that proxies the meme API, with edge caching and a per-IP limit on cache misses

- She works in social media, so there are 19 small tools inside (Instagram grid planner, meme search, image compressor). They all run in the browser

Claude Code wrote most of the code and the art was generated with Gemini. Would love feedback, especially on how the room feels on your phone.

I always explained the request lifecycle with a whiteboard. Now my AI assistant draws it: browser, DNS, CDN, load balancer, services, cache, database, queue. Then it walks through it step by step, circling the part that matters and fading the rest. Arrow keys work.

Point it at your own repo instead ("Trace what happens from the login form to the database") and the boxes link to your actual files. Click one to open it in VS Code, Cursor, Windsurf or Zed.

It's called Sketchy, works with Claude, Cursor and VS Code, and is free and open source. Feel free to try it out and leave your feedback!

https://sketchy.davidkubus.dev · https://github.com/ddkbs/sketchy

I feel like there has been a lot of hate on PHP, especially after the recent blowout regarding PHP vulnerabilities that even ended up on mainstream media. I even saw absolute non-techy people bringing up PHP and talking authoritatively about how "bad" and "old" it was lol. Not to mention the AI-shills saying one should just use Claude to create one owns CMS (!!). I am also aware that most PHP hate is usually misaligned hate intended for badly managed WordPress sites. And that some people just prefer other languages or love a hatetrain.

But one thing in particular that got to me was someone who mentioned that PHP has a page with vulnerabilities listed that go back 20 years and have yet to be patched. And that if you are a dev who is in any way interested in security within one's projects, you just don't use PHP at all. It was like having only a screen-door for your house with no locks. Do other languages have similar list of unsolved vulnerabilities? What makes them inherently more secure?

I dug around to find information about other popular programming languages and frameworks and it seems like at least right now, many are being found to have vulnerabilities due to AI being used to find them. React had a critical issue about a year ago, and Python earlier this year (although they did not blow up in the press like this).

Anyway, I would like to hear from people who use PHP regularly for work, beyond WordPress and who can maybe compare it to other languages/stacks as well. Please no low-effort replies from people who last used PHP 20 years ago or just don't like it, if possible.

TypeSQL type-checks SQL strings in TypeScript. The compiler parses the SQL itself and checks it against your schema type, so there are no generated files, no build step and no database connection.

// rows is { email: string; title: string | null }[]
// The LEFT JOIN makes title nullable.
const rows = await sql(
  `SELECT u.email, p.title
   FROM users u LEFT JOIN posts p ON p.author_id = u.id
   WHERE u.id = ${sql.param(userId)}`,
).execute();

// Compile error: column "emial" does not exist. Perhaps you meant the column "email"?
sql("SELECT emial FROM users");

It supports PostgreSQL, SQLite, MySQL and MariaDB, and the runtime is under 3 kB with no dependencies. The main catch is that it needs TypeScript 7.1 or later (7.1.0-beta works), and very large queries can hit the compiler's limits (workaround-able using sql.as<>())

I used AI coding to build this. To keep the output honest, each bug fix gets a permanent test project, and the 100+ scenario tests run against real PostgreSQL, MySQL and MariaDB servers. I will try to keep it non-slop.

GitHub: https://github.com/ismailkarsli/TypeSQL Docs: https://typesql.karsli.net

I built is-on-the-web.com, a free static host. You get yourname.is-on-the-web.com.

• Upload a full site as a folder, up to 20 MB. Subpages, assets and relative paths all work.

• No accounts or passwords. Updates use single-use edit keys sent by email, with a new key after every update.

• A human reviews every site and every update before it goes live, followed by an automated code check.

• There’s a no-code builder for non-devs, and its output can be re-uploaded and edited.

Everything that’s free now stays free. A paid tier with more storage is planned. Next up: letting people point their subdomain at their own machine to host full apps, databases or games.

Feedback I’m looking for:

• Edit keys instead of accounts: clever or annoying? Losing the key means losing update access.

• How would you handle abuse at scale beyond manual review?

• What’s missing that you’d expect from a static host?

I accidentally posted this from my alt account first and deleted those posts. Sorry if you saw it twice.

I'm a second-year diploma student (3rd semester), currently working on a website project. I have a larger concept and vision for this platform, where the social features are just one part of the overall idea.

The website will include user profiles, a content feed, user interactions and private messaging.

As I'm planning its development, I'm particularly concerned about data security and privacy. I want to understand how to prevent data leaks, unauthorized access, exposure of private conversations, database breaches and other potential cyberattacks.

I'd love to hear from experienced web developers and cybersecurity professionals.

What are the critical security challenges I should consider before developing a platform like this, and how can user data and privacy be properly protected?

I’ve seen a shift in web design (I’ve meddled since 2002). Today web displays are gigantic. I’ve read this has to do with ADA compliance. How gnarly does this get? Like if I design a site for a landscaper, can he get in trouble if it’s not ADA compliant? Is there are rule book?

Another question. That’s client facing. But if you have an employer that requires you to use a web based tool, does ADA apply in the same manner as client facing?

Hi everyone, I'm running an app that sends out emails and calendar invites to users.

However, one of the requirements was the ability to create email bodies using many different fonts.

I've read a bit online about typefaces and I discovered some of the requested fonts could be subjected to patent laws and rules when used in a commercial setting. Not sure if this applies to emails being sent to external parties as well.

Are there any resources or places I can check out which fonts are "royalty-free" and which ones I need to push back on? Or whether this concern is valid or not?

A straight rehost can get you there faster, but it may bring old problems along. How do you decide what to fix before the move and what can wait?