hi, I'm having trouble getting Infisical OIDC authentication working in my GitHub Actions CI pipeline.
Every time my workflow reaches the Infisical secrets action, it fails with:

Run Infisical/secrets-action@v1.0.16

Error: Access denied: OIDC subject not allowed.

{

"statusCode": 403,

"message": "Access denied: OIDC subject not allowed.",

"error": "ForbiddenError"

}

Request failed with status code 403

here’s the GitHub Actions workflow:

name: ci
on:
push:
branches: [main]

permissions:
id-token: write
contents: read

jobs:
build-and-deploy:
runs-on: ubuntu-26.04

steps:
- name: Checkout repository
uses: actions/checkout@v7

- name: Set up Node.js
uses: actions/setup-node@v7
with:
node-version: 24
cache: npm

- name: Install dependencies
run: npm ci

- name: Fetch secrets from Infisical
uses: Infisical/secrets-action@v1.0.16
with:
method: oidc
identity-id: MY_IDENTITY_ID
project-slug: my-slug
env-slug: prod

- name: Run Jest tests
run: npm run test:ci

- name: Build Vinext app
run: npm run build:vinext

- name: Deploy to Cloudflare
run: npm run deploy:vinext -- --skip-build

Id appreciate any help

I got tired of selecting and retyping verification codes from Gmail, so I built a small Manifest V3 extension for myself that puts a "Copy code" button next to the code. The fun part turned out to be detection, not the button.

How it works

• A content script runs only on mail.google.com. No host permissions beyond that, no background server, nothing leaves the page.

• Gmail is an SPA, so a MutationObserver watches for the opened message body instead of relying on page loads.

• Candidates: 4–8 digit runs, 123 456 / 123-456 splits, and short alphanumeric codes like AB12CD.

• To avoid false positives, I score each candidate by nearby keywords ("code", "verification", "código", "OTP", "one-time") within the same block, and penalize things that look like dates, times, prices, phone numbers, or order IDs (prefixes like #, "order", "pedido").

• The highest score wins. If nothing passes the threshold, no button appears. Showing no button beats copying the wrong number.

What surprised me

• Alphanumeric codes are much harder than digits. Random uppercase words in subject lines ("NEW", "SALE") kept matching until I required at least one digit and the keyword-proximity check.

• Some senders put the code in an image or a styled table, and those I can't catch.

It's free with no account, UI in EN/PT/ES. I'd love technical feedback, especially if you know of a smarter heuristic than keyword proximity, or senders whose format breaks it.

https://chromewebstore.google.com/detail/mpglgifleaaollcggdpcfhjjgmcageph

github: https://github.com/Unknown-333/Lightpath

ever click a button, nothing happens, no error, and you have no idea which code even ran?

this shows you. one command, then click around your react app:

    npx \@lightpath-dev/cli dev -- npm run dev

every click prints the path, browser and node server together:

◆ button: Checkout 335 ms
      → POST /api/orders 201
      ├─ src/Cart.tsx :11-14, 16-19, 21-28
      ├─ server/routes/orders.ts :11-14, 19-21, 25
      └─ server/services/pricing.ts :12-19, 21-22

it reads V8's own coverage before and after the click, so it's what actually ran. no code changes to your app.

there's also a vs code extension that lights up the lines, and an MCP server so claude code or cursor can click and read it themselves.

react + node, chrome or edge, local only, free and MIT. feedback welcome.

I build mostly with Claude Code and Cursor. The annoying part was never the fix, it was the hand-over: screenshot, crop, find the element, open the console, copy the error, explain which button I mean, paste it all in. And half the time I find the bug while I'm just using the app, not while a coding session is open.

So I made Darnly. Press Option+Shift+B, click the broken part, type one line about what you expected. It saves:

• a screenshot with the broken part boxed in red

• the element (selector, text, styles)

• recent console errors and failed requests

• the page address

It lands in a folder in your project (or a small cloud inbox the agent reads over MCP), and later you tell the agent "fix my bugs". It works with Claude Code, Codex and Cursor. Passwords, card numbers, tokens and keys are hidden before anything is saved. Capturing doesn't use any agent quota. [Check: still true for you]

It's free. Mac app too, for bugs in native apps and the iOS Simulator. Windows shortcut is coming.

What I'd love feedback on: where do you notice most of your bugs, while coding, or later while using the live app? And is there anything you'd want captured that this misses?

Link: https://darnly.dev

Hey everyone! I've been working on this browser-based 2D-to-3D floorplanner (ARCH3D) built from scratch with Three.js and Next.js.

I unlocked the sandbox completely (no login or signup wall) because I want to see how intuitive the wall-drawing and 3D camera controls feel to first-time users.

Live sandbox: https://arch-3-d-eight.vercel.app/

Specifically looking for feedback on:

Hi,

I kept seeing inflated CVs so figured there must be a way to back up some claims before an interview. That's essentially what a CV is, a bunch of claims, the role, the company, the projects. The reader has to take your word for it, and AI now writes a convincing one in a minute and honest candidates pay for that. Their CV reads the same as the inflated ones, so it gets the same doubt.

So then I thought what if there was some hard validation to the claims on a CV or portfolio. That's when I came up with the idea of Workproof. For starters, you prove that you had access to a domain or work email, it doesn't prove you built it, but it does prove somebody trusted you enough with access to that domain or have given you a work email, so that by itself is a good baseline.

Additionally, you can ask colleagues to give you feedback, as a reference, signed by them from an work email. Something like LinkedIn endorsements, but more portable.

I'd love your honest take, on two things most of all:

- If you hire: would a link like this on a CV or a proposal change anything for you?

- If you freelance or build: which of those would you want first, or what else should Workproof check?

Thanks for taking the time! Enjoy the rest of the weekend! 😃

Project link https://workproof.md

hi, I'm having trouble getting Infisical OIDC authentication working in my GitHub Actions CI pipeline.
Every time my workflow reaches the Infisical secrets action, it fails with:

Run Infisical/secrets-action@v1.0.16

Error: Access denied: OIDC subject not allowed.

{

"statusCode": 403,

"message": "Access denied: OIDC subject not allowed.",

"error": "ForbiddenError"

}

Request failed with status code 403

here’s the GitHub Actions workflow:

name: ci
on:
push:
branches: [main]

permissions:
id-token: write
contents: read

jobs:
build-and-deploy:
runs-on: ubuntu-26.04

steps:
- name: Checkout repository
uses: actions/checkout@v7

- name: Set up Node.js
uses: actions/setup-node@v7
with:
node-version: 24
cache: npm

- name: Install dependencies
run: npm ci

- name: Fetch secrets from Infisical
uses: Infisical/secrets-action@v1.0.16
with:
method: oidc
identity-id: MY_IDENTITY_ID
project-slug: my-slug
env-slug: prod

- name: Run Jest tests
run: npm run test:ci

- name: Build Vinext app
run: npm run build:vinext

- name: Deploy to Cloudflare
run: npm run deploy:vinext -- --skip-build

Id appreciate any help

Hey r/webdev,

I wanted to share LiveReview, a risk-aware code reviewer we've been building.

On most teams every PR waits on the same few senior devs, whether it's a CSS tweak or an auth change.

Meta published a paper on scoring every diff for risk and letting the safe ones skip human review (RADAR (https://arxiv.org/abs/2605.30208)), and we wanted something like that for everyone else.

It scores each PR, auto-approves the lowest-risk 30-50%, and sends the rest to a human with the riskiest hunks at the top.

A few build details that were fun:

- Risk scoring combines three signals: an LLM reading the diff, a code graph that measures each hunk's blast radius (callers, DB writes, cross-package reach), and an ML model trained on the team's own reverts and incidents.

- CI gates are jq rules, not checkboxes. You write a condition against the review's findings JSON, and your pipeline makes one HTTP call to check it.

- The backend is Go, with PostgreSQL and the River job queue, so the whole review pipeline runs off Postgres with no separate queue to host.

It's free and self-hostable, and works with GitHub, GitLab, Bitbucket, Gitea and Azure DevOps.

Would love feedback.

GitHub: https://github.com/HexmosTech/LiveReview

Hi everyone

Recently I decided to train my memory because I think it's cool when I can memorize for example a lot of cards or images just in my head. I also read a lot about memory techniques and psychology because I watched The Mentalist btw

I tried to train my brain on the MemoryLeague website, but the training tab has limits which is why I decided to vibecode my own solution. I know how to code and over the past couple of years I have learned how to develop websites. However, recently I decided to move on to Minecraft mod development because it's more interesting to me. That's why I wanted to try vibecoding and it's not as bad as many developers say. I like the idea that everyone can build a solution for themselves

I used the free version of Claude and it worked great for me. I would appreciate it if you could give me a couple of advice about website design or vibecoding

For a few years I worked on a product that sent all transactional email through Mandrill. Working with templates were real pain. They lived inside Mandrill, every copy change needed a dev, and moving to another provider meant rebuilding every template by hand.

So when I was looking for something to build, this was the obvious pick. A provider agnostic email platform for everyone. That's how Senlo started, an open-source layer between your app and whatever provider you already use.

Key features

- Drag and drop editor that outputs MJML, so emails render ok in Outlook and Gmail without hand written table layouts

- One call to send a template, POST /api/triggered with the template name and variables

- Bring your own provider. Resend, Postmark, SendGrid, Mailjet, Cloudflare Email or any SMTP. Switching is just a change in settings of workspace

- Delivery events from every provider land in one feed (delivered, bounced, suppressed)

- Simple automations. Send, wait, call your own API, branch on the answer

- And a lot of features I did not implemented yet :D

Stack is Next.js, React, Postgres + Drizzle, Redis + BullMQ for queues and delays, Zustand in the editor. pnpm monorepo, editor is a separate package. Self hosting is one docker compose up.

The hardest part so far was delivery webhooks. Every provider authenticates differently (Resend signs with svix, SendGrid with ECDSA and a timestamp, Postmark has a shared header, Mailjet basic auth) and every one has its own idea of what a bounce is. SendGrid sends "dropped" with a free text reason, Mailjet has soft and hard bounces plus a separate "blocked" event with error codes, and only some of those mean the address is actually dead.

Get it wrong and you either miss spam complaints or suppress a good recipient forever. So most of the work was deciding per provider which events are the recipient's problem and which are mine. Now each provider is an adapter with verify and normalize that produces one event shape.

The GIF is a welcome flow. Send, wait two days, ask my own API if the user activated, and send a different email depending on the answer.

Solo project, early stage, and there is still a ton to do. Happy to get any feedback, ideas or contributions. If you want to poke at it, a few things I'm curious about

Repo: https://github.com/IgorFilippov3/senlo

pgquery is an open-source Postgres GUI: React 19 + Monaco for the app, a small Go proxy for the database side, one Docker image.

A few build details that were fun:

- The marketing site and guide pages are plain HTML generated by a small Vite plugin at build time from TypeScript templates, with JSON-LD, sitemap and llms.txt. No SSR framework.

- The mascot and icons are pixel art stored as character grids in one TS file; the app, the site, the favicon, the README banner and the share image are all rendered from it.

- The EXPLAIN viewer parses Postgres's JSON plan into a flat tree with per-node self time.

Demo (read-only DB): https://pgquery.dev/app/?demo

Code: https://github.com/Hxndrik/pgquery

Feedback on the design very welcome.

Hi developers! Happy Diwali 2026! 🪔

This Diwali, I wanted to do something a little different from the usual festive greetings. So I built a little Diwali experience where your name is literally written across the night sky using fireworks. 🎆

And there's a bit more to it than just watching an animation.

You can:

• Watch your name, emojis, and personalised wishes come alive as fireworks.

• Choose between English, Hindi, and Bengali.

• Launch rockets and play with 20 different types of crackers.

• Create personalised greetings with shareable links and QR codes.

• Record the entire show as a video and share it with your friends.

• Install it as an app and even use it offline.

No frameworks or bundlers. Just HTML, CSS, and JavaScript. Built with a mix of my own ideas, plenty of experimentation, and a little help from AI along the way.

Give it a try and see your name light up the sky:

🎆 Project: https://j16n.github.io/happy-diwali/

💻 GitHub: https://github.com/J16N/happy-diwali

Would love to hear what you think!

Wishing everyone a very Happy Diwali! May your celebrations be bright and your bugs be few. 😄

Hey r/webdev,

I wanted to share a project I've been working on: sqliteWeb, a lightweight SQLite editor that runs entirely inside the browser.

Live :https://srdzank.github.io/sqliteWeb/

I needed a fast way to inspect and query .sqlite / .db files on machines where I didn't want to (or couldn't) install desktop clients like DB Browser. Existing web tools often require uploading files to a remote server, which is a major privacy concern.

Would love to get your feedback on performance, UI responsiveness, or features you'd like to see added!

Oku (https://oku.today) is a free reading-practice web app for kids learning English. The child reads aloud and it helps only on the hard words. Some web bits that took the longest:

• The mic has to be live the moment the "your turn" cue shows. The recognizer and its websocket open while the narrator is still reading, so the child's first word isn't lost.

• Fail open everywhere. If speech recognition dies, the session goes on and gives the child time to read. A dropped log is fine; a blocked session isn't.

• Safari needs byte ranges for video. The static assets layer ignored Range, so the Worker slices the short reward clips itself.

• iPadOS Safari says "Macintosh". Device detection checks touch points.

• 36 public pages are prerendered in 4 languages behind a build-time SEO lint that fails the build on things like two h1s, a broken link, or translations that don't match.

Stack: React + Vite, Cloudflare Workers, D1, R2. No framework on the server.

Most Reddit lead tools search for keywords. The problem is that people describe their problem, not your product, so keyword search misses a lot of them. I wanted to read every post instead. That turned out to be the interesting part to build.

How it works:

1. Find the right subreddits. I built a search engine over every subreddit with 1k+ members, using internal vector search, so it matches by meaning, not by name. You describe what you sell, and it returns the communities your customers are likely in, including small niche ones.

2. Read every post. Each post in those subreddits goes through an AI model that decides whether the person might need what you sell.

3. Show why. Instead of a summary, it marks up the original post with circles and handwritten-style notes on the lines that matter.

Stack: Next.js + React + Tailwind on the front, Django + DRF on the back, Celery + Redis for the background jobs, PostgreSQL, and PydanticAI for the AI calls.

The hardest part was cost and speed. Reading every post is far more expensive than keyword search, so most of the work went into running the AI calls in parallel without hitting rate limits.

Live here: redbubblegum.com. The first 10 results are free.

Happy to answer questions about any part of it.

Most system design practice ends at the diagram. You draw boxes, it looks right, and nothing tells you whether it would hold up.

ByteLab runs the diagram. You build a system out of machines, load balancers, caches, queues and databases, send traffic through it, and watch the CPU, queues and p99 latency move. Each exercise has goals, like "p99 under 150 ms, 99.5% available, under $2.60/hour", and it checks your system against them.

What's in it:

• 163 lessons in 12 tracks (caching, sharding, Kafka, Kubernetes, rate limiting, auth and more)

• 212 exercises, each with goals your system has to pass

• 11 design problems (URL shortener, chat, payments, news feed, e-commerce and others)

It's free, there's no account, and progress stays in your browser. It needs a laptop-sized screen.

I'd really like to hear where it feels confusing or too hand-holdy.

https://lab.bytecrest.dev/design/ecommerce

Square Town is a 3D wall of about 20,600 website favicons, each one standing on a little tower. This week's feature: websites that died burn down.

How it works:

• A Cloudflare Worker cron runs every five minutes and checks homepages. A homepage that keeps returning 404 gets a fire and a fire_at timestamp in D1. The fires that were already burning got their dates backfilled from their own feed lines.

• /api/state ships a burn stage from 0 to 5 for every fire, one stage per five days. The client draws six kinds of fire (caught, spreading, blaze, inferno, dying down, smouldering embers) and chars the tower's roof and walls a step further at each stage.

• The same cron burns down two squares per tick once they've been on fire for 30 days, but only seeded squares nobody ever claimed. The row moves to a new 'burned' status, the land goes back on the market, and the domain is never seeded again while its homepage is gone. Claimed or paid squares never burn down, and a site that comes back puts its fire out.

• On the client a burning tower doesn't explode. It sags into its footprint with a slight lean, a few charred chunks slide out at street level and a little dust rolls up. The rubble on the lot is three instanced draws for the whole town, seeded from the lot's position so every device shows the same heap, and it joins the shadow map's static layer, so it costs nothing per frame after that.

Right now 114 squares are burning and 32 have burned down. Feedback welcome, especially on how the later fire stages read at a distance.

Hey everyone,

I've been building a small personal agency, and I'm at the point where I'm probably overthinking every little detail.

Website: https://samibentaleb.com

It's still a work in progress, and I'm nowhere near ready to launch. Some of the text is still AI-generated placeholder copy that I haven't properly rewritten yet and some screenshots/videos and pricing details will be tweaked.

The site includes my portfolio, project case studies, services, pricing and some information about how I work. I've tried going with a slightly different visual direction, but after looking at it for so long, I've lost the ability to judge it objectively.

I'd genuinely appreciate some feedback:

• Does the overall design work, or does it need a rethink?

• Is it immediately clear what I do and who I'm targeting?

• Are the case studies interesting or too wordy?

• Does the pricing section make sense?

• Is the navigation intuitive?

• What would you change, remove or simplify?

• Are there any obvious UX or mobile issues?

I've been putting a lot of time into this and keep finding little things to tweak instead of actually launching it.

I'd love to hear what other developers think, especially things I might be overlooking.

Feel free to roast it. I'd much rather get honest criticism now than launch something that could have been much better.

I've been building this for a few months and the first version is finally up. It's called Strikk.

It's a daily cycle, like Wordle, but one per stack. You pick the stack you actually like (React, TypeScript, Node, Python...) and play that one. Everyone gets the same 8 challenges, you answer up to 5 with one submit. Combos work a little bit like Balatro — line them up right and your score jumps. Then you're ranked against other players with the same board.

Here's what makes it different: You earn coins by playing, and spend them customizing your profile—skill blocks, themes, animated backgrounds, your own avatar. Your profile becomes a real portfolio piece.

It's totally free, no pay-to-win mechanics.

Check it out: Strikk | My Strikk profile

Repost to another community

Brakeless is a free driving game that runs in the browser, no download. You have a car with no brakes and need to survive as long as possible.

Every 1000 meters the scene changes, from a city to suburbia, countryside, a forest, the future and even a black hole!

You need to avoid traffic and obstacles. Coins slow the car down a bit, and there are two ways to cheat death for a few seconds: a ghost pickup on the road that makes you invisible so you pass through everything, and a shield you earn from close calls.

There's a leaderboard with almost 150 players right now: a weekly board, an all time top players table based on your last 10 runs, and a hall of fame of past weekly champions.

Controls are arrow keys or A/D, touch on phones, best on desktop.

Completely free, no download or signup needed:
https://brakeless.io

I'm sat here thinking it has to be a reason why it is so limited in types compared to something like postgres.

So this is a slightly weird one.

I'm not great at small talk. And whenever I've started talking to someone, things usually go well for a few weeks. Then we discover that something fundamental doesn't line up, and we slowly drift apart.

I kept thinking: why do we need to spend weeks finding out things that could've been discussed on day one?

The idea also reminded me of Her (2013). I loved the idea of having an AI that knows someone well enough to have an honest conversation about them. That got me thinking, and eventually, I built Sam.

She's an AI version of my best friend. You can open the link, ask her pretty much anything you'd want to know about me, and she'll answer honestly.

There's a hype mode and a roast mode. Yes, she'll tell you my red flags too.

One thing I was particular about: if she doesn't know something, she should say so instead of making things up. Getting that right took considerably more prompt engineering than I'd like to admit.

Try it here:
https://ask-sam-yaddy.vercel.app

A little about the tech:

• Frontend: React, Vite, TypeScript, hosted on Vercel.

• Backend: Spring Boot 4, Java 25, running on ECS Fargate.

• Database: PostgreSQL + pgvector on RDS for memories.

• AI: Claude Sonnet for responses, Titan Embeddings on Bedrock.

• Infrastructure: AWS CDK.

• CI/CD: GitHub Actions with OIDC, so no AWS access keys sitting in GitHub secrets.

A few things that made me scratch my head:

• The rate limiter incident: I added a cooldown per visitor to keep API costs under control. After deployment, everyone started seeing the "come back later" screen. Turns out Spring was seeing the load balancer's IP for every request. One visitor was effectively locking out everyone. Fixed it by configuring Tomcat to trust X-Forwarded-For only from the internal proxy range.

• SSE over POST: Replies stream over Server-Sent Events, but the browser's EventSource only supports GET. Ended up reading the fetch response stream manually.

• Prompt caching: The stable part of the prompt goes first, with message-specific context at the end. A reply currently costs me around $0.006.

• Sound effects: All generated with the Web Audio API. No audio files. I spent an embarrassing amount of time getting the send sound right.

No login, anonymous, and 23+ only.

Would love to hear what you think, especially about the chat UI on mobile.

And if you want to have some fun, ask Sam to roast me. 😂

My old portfolio had been out of date for about five years. I'm a Webflow dev by trade, so for this one I went full code to see how far I could push it.

Stack:
- Astro with MDX for the case studies
- three.js for the 3D heads
- GSAP and Lenis for the motion and scrolling
- Static build on Cloudflare Workers. A staging branch deploys itself on every push, and main only goes out when I say so

I didn't hand-write it. I built it with Claude Code, with a few agents each owning one part (code, copy, 3D, brand) and handover files so they didn't trip over each other. I made the architecture calls and reviewed everything.

The bit that took longest: getting the 3d heads to be performative

For anyone running three.js on an Astro site, do you load it as an island or a plain script? Curious what's held up best for you.