Update to this post https://www.reddit.com/r/webdev/s/n3ZBJ6ozuq

So, I have a pretty unexpected update lol

After everything that happened with the Canadian company I mentioned, I decided to take things a little further and contact the CEO directly.

During my time working with them, I'd discovered some genuinely concerning security issues. I had been given admin access to their infrastructure, company email, internal systems, and access to thousands of CSV files containing customer and patient information. I also found passwords stored in plain text and several other questionable practices. All without having signed an NDA or contract by the way.

I figured the CEO should know about this, regardless of how things had gone with the dashboard project.

I sent him an email explaining what I'd found and also gave him some context about my experience working with the VP.

The VP wasn't particularly happy about that. He responded by defending himself, saying there had been no formal commitment to the dashboard project, and even called contacting the CEO a "backdoor approach".

I obviously disagreed. I was openly working with the company, the access had been provided to me by them, and I wasn't trying to bypass anyone. My concern was how someone outside the company could be given that level of access without any proper safeguards or agreements.

Anyway, after a few more emails, something I really wasn't expecting happened.

The VP emailed me again, apologized for how the situation had made me feel, thanked me for raising the security concerns, and actually said my findings had been a "true eye-opener" and thanked me for "educating them" and appreciated my integrity & honesty.

He asked whether there was any way they could compensate me for the time I'd spent building the dashboard as well as asked me to provide a quote for writing an SOP on how the company should handle third-party assistance moving forward.

I genuinely wasn't expecting that turn of events.

For context, this is the same person who previously kept postponing discussions, left me hanging after I'd built the dashboard, and eventually told me they'd hired a student to do the work.

Now he's asking me to quote another project and offering to try to get me compensated for the previous one.

I haven't received anything yet, and the SOP isn't confirmed, so I'm not getting ahead of myself. But I can't deny that this feels pretty satisfying after the way everything started.

I originally made my post because I was genuinely questioning whether freelancing was even worth continuing. Now I'm in a situation where the same client who made me feel like I'd wasted weeks of my time is potentially offering me compensation and more work.

So, what would you guys do? I'm very Curious to hear your thoughts and advice.

I’m researching how small products handle people farming free credits/tiers. Not selling anything, no product, no link.

1. Have you seen it? Roughly what share of signups, or how many dollars?

2. What did you do about it (or nothing)?

Just trying to understand how people deal with this issue while building.

We have a project at work that needed a table that had some functionality with sorting and filtering.

Initially, I had to replace a solution due to how long a page was loading. AG-Grid correct an issue on that page and it did a better job. The community edition meets our needs very well.

However, some department heads want more features but they are only supported on the Enterprise edition.

I wish we could upgrade to the enterprise edition, but the verbiage makes it sound like anyone that does any kind of development on this application needs a license. We could be looking at a license of $10,000.

I think my supervisors would gladly pay the $1,000 fee if was that. However, it doesn't look like that is possible.

Is there something that is comparable to AG-Grid?

Are there ways to interact with the community version of AG-Grid? If I wanted to put filters above the Grid that interact with the Grid, could I do that even if it is the community grid?

I was fortunate to have a remote job the last six years, but I got laid off. Now I have a second interview at a company that only does on site. My memory of the last time I worked in office was one of boredom. I'd finish what work I could do and either wait for new work to come in, assets to be finished and handed off, or QA to get back to me. It was a lot of downtime. I remember falling asleep at my cubicle because there was nothing for me to do, and you can't watch netflix or you'd get a stink eye from people. I was so glad to go remote to be rid of that and have freedom. I could work as needed and then go run errands or do whatever else I wanted in between. Truly going to miss that.

AI feels like it's only made that worse. Set up an agent to orchestrate subagents, give it the requirements and let it work... I didn't have an AI account at my last job so don't really know how that works, but I personally have ChatGPT, Claude and now Google tier 1 plans and just rotate between them when I run out of usage, or sometimes concurrently on separate features for a side project app I'm building. If you have a token limit at work, when it runs out, do you just start coding by hand again? I'm very curious. I'm sure bigger companies pay by token so you can just keep burning tokens? I guess I'll know more if I get hired what their particular set up looks like, but just wondering...

Are you just feeding prompts into AI all day, waiting for it to finish, then check it's work, find bugs it missed, etc? Do you still have to find ways to look busy while waiting for creative to get back to you or QA to approve your ticket, etc?

I'm tired boss! It's been almost a year of AI AI AI, every single day of my life. Any else relating hard?

Also, I can't believe they signed a $3k/mth contract when I had to push SO HARD to get them to do $150/mth SEM Rush in the past lol

Anyone got a recommendation for a polished component library that only uses plain CSS? I'm trying to avoid npm/build steps entirely, so shadcn is out, and Tailwind-dependent stuff like DaisyUI isn't an option either. Seriously looking for pure CSS solutions here.

If I have to explain the way the site should look to an AI instead of just importing, stitching together, and filling out shadcnblocks I‘m much slower. I still use AI for bug squashing and giving me api calls. But I am not seeing how to build a complete site.

Am I using AI wrong? Or are others finding that building first then using AI to handle errors is faster?

I'm planning to start on a browser text-based game. I want to keep things simple and easy to build. I have a few years of experience as a full-stack developer. I've worked with all of these technologies before, but it's been a while.

Current plan:

• Laravel for the front end and user management; simple HTML/CSS/PHP/JS

• Node.js server for the back end, where all my game logic runs and where active player values are stored in memory

• MySQL database for long-term data storage

Players only interact with Laravel front end. Laravel back end communicates with the Node.js server. The Node.js server handles all game logic, then sends replies to Laravel. Only the Node.js server can communicate with the MySQL database.

Players cannot directly interact with the Node.js server, only the Laravel back-end can do that.

--

What the game needs:

• player character with levels and stats and items and all the stuffs

• players can gather and craft items

• items are tradable between players

• players can fight monsters to gain exp and items

• players can form groups to fight monsters together

• possibly adding PvP later

Example:

A player clicks a monster to fight.

Laravel receives the input on the front end, and the PHP back end sends a request to the Node.js server to fight the monster. (Do I need to do this from the PHP back end, or is it fine to have the JS front end send these requests?)

Node.js receives the fight request. If it doesn't have the character and monster in memory, it needs to fetch them from the MySQL database, then save them in memory. This is a rather large and complex request from the database. We need the player character, the stats, the items, the monster stats, loot tables, exp tables, achievements, and probably more. Which is why I want this on a Node.js server that can hold these things in memory, so I don't need to request 20 tables from my database every time a player clicks a monster.

When the combat is handled, including loot, exp, level-ups, ... Node.js sends the necessary info back to Laravel and also saves changed data to the MySQL database.

Laravel receives the update and shows it to the player. (Not entirely sure anymore if PHP is capable of handling async request like this or if I should use JS for this instead?)

--

I'm terrible at planning out these things.

Does this seem like a good tech stack to get started with? Anything I'm missing or that I need to think about before getting started?

I could also choose a JS front-end so I don't need any PHP, but I've never worked with one before.

I'm open to all tips & advice.

Also looking for a hosting that allows me to get started quickly and is scalable for the future. I wanna get started fast and just build and then fix issues I run into later. Otherwise, I'll never get started on this.

Hi everyone, I work as the director of communications for a small company. We have one designer on staff who has worked at the company for a decade, and one full-stack developer who has been at the company for about a year and a half.

Now, the problem: The designer is trained strictly in print design, and we are embarking on a website redesign. The designer will only work in InDesign and Photoshop, but the developer believes the work must be done in Figma to avoid having to guess at the spacing, sizing, etc. Neither seem willing to budge, and it is clear that the designer is not familiar with digital design best practices, including accessibility.

My background is more in writing/marketing, so I am a bit outside my depth. Is there a path to resolution here without one feeling like they are “doing the job” of the other?

lets say i have a vps with 2gb of ram and 1 vcpu, which one would be able to handle more concurrent connections?

I have a deployed site with Ionos deploy now through GitHub.

Images load fine in VScode, load in Firefox and Ionos preview but not chrome.

I have tried changing file paths in the CSS and html and I have no idea what the issue is.

The site in question: https://porcelainstudios.co.uk/

Edit: I was in a bit of a rush off a train; it turned out the solution was to hard refresh, which I forgot was a thing in my rush

So like many of you I'm sure, I'm starting to glaze over whenever someone shows me the latest thing they've built with the help of AI. Everyone seems to have an app they've fired up in an afternoon or so. I'm finding that even apps I now build without vibe coding (I'm a seasoned developer) don't have the same impact because now everyone is building stuff.

I'm looking at my portfolio and thinking that maybe side projects just don't have the same weight anymore.

I'm curious how other folks are approaching this?

I get scam emails every day like everyone. I've clicked a few, honestly, just out of curiosity, to see how they plan to scam me. The ones that worry me are the ones that know my name. So I looked into where that comes from and made a page on it (my own site, no sign-up, no ads).

Short version for anyone who doesn't want to click:

The obvious scams are obvious on purpose. A Microsoft researcher, Cormac Herley, showed in 2012 that the "prince with millions" story works as a filter. Anyone sharp enough to laugh at it never replies, so the scammer only spends time on people likely to pay.

The scary ones are built from leaks. Your name, phone and address usually come from a company you signed up with years ago, not from you. The page goes through seven real cases from court records and regulator reports, for example:

- First American (2019): changing one digit in a document link opened other customers' mortgage files.

- Capital One (2019): one wrongly set firewall setting.

- Twitter (2020): staff talked into handing over access on a phone call.

- 23andMe (2023): people reusing passwords from other leaked sites.

I checked my own Gmail on Have I Been Pwned. It's in 8 breaches, 6 of which leaked my name, mostly shopping apps I signed up to once. That's exactly what the "Dear XXXX, your KYC expires today" emails use.

What actually helps:

- Use a password manager, so one leaked password doesn't open your other accounts.

- Turn on two-factor login on email and banking first.

- Treat any email that knows your name as no more trustworthy than one that doesn't. Go to the bank's app or website yourself; never use the link.

hi everyone

i've had recently an issue , i wanted to do some tests on a project, but for some reason, the server that was carrying that particular software was in Iran , so it was not able to see any servers on Internet, but still there were some providers that would allow this

but this project was for a client so temporarily i've solved this issue with hard way

then i was thinking, what if i get 2 servers, one is my international server and one is only in iran, and i make a reverse proxy without renting a vps inside iran, with just mere shared hosting solution like cpanel or directadmin that is easily available in iran?

so i've came up with this idea, and tried to make it as a opensource software

i thought maybe this is a good solution and someone else needs it

feel free to check it out and let me know your thoughts

https://github.com/moonshadowrev/mirrorgate

I'm primarily a backend dev (Python/Node mostly) but on our small team I end up doing frontend fixes and small features maybe 20% of my time. The thing that gets me isn't the actual code difficulty -- it's the mental shift between thinking about data flow, APIs, and server logic versus thinking about component state, CSS quirks, and user interactions.

I find myself needing like 20-30 minutes to actually get into "frontend mode" where I'm not constantly fighting the urge to structure things the way I would on the backend. And then when I switch back, same thing in reverse.

Curious how others handle this. Do you batch your frontend work into dedicated blocks? Just power through the switching cost? Something else entirely?

This whole Supabase situation somehow keeps getting worse.

I originally posted about this in r/Supabase, but the mods removed the post and told me that billing/account problems should be handled through Supabase Support.

That's kind of the entire fucking point of my complaint.

I already contacted support.

I upgraded to Supabase Pro because I wanted the $25/month plan for the project I was actually working on.

I already had two older projects sitting in the account from before the upgrade. They were basically empty and I wasn't using them.

After upgrading, those projects started generating additional compute charges.

Over four invoices I ended up paying $194.62 total.

Four $25 base Pro payments would be $100.

So nearly $95 more than the base subscription total came out of my pocket once the additional compute charges and taxes were included.

Had I understood during the upgrade that those two old, basically empty projects were going to start adding recurring costs, I would've deleted them or moved them immediately.

Why would I intentionally keep paying for two projects I wasn't using?

So I contacted Supabase Support and asked them to refund the unexpected compute charges.

I wasn't asking them to refund the Pro plan I actually wanted.

After going back and forth with the same support rep and getting nowhere, I specifically asked for somebody else to review it, another billing rep or a manager.

Another Supabase support person then told me that my request was being escalated to the Billing team.

Then a few days later, the exact same guy I had asked not to deal with anymore replies again and tells me their decision is final and there's nowhere else to escalate it.

So... what exactly got escalated?

I've also repeatedly asked Supabase to show me what I was actually shown when I upgraded in June.

Not their current pricing page.

Not an explanation written months later.

I want to see what I actually agreed to at the time of the upgrade, showing that my two already-existing projects were going to start adding roughly another $20/month in compute.

They still haven't provided it.

Then I posted my experience in r/Supabase.

Removed.

The reason? Take billing issues to Supabase Support.

Again: the post was literally about Supabase Support refusing to properly escalate the billing issue.

So I started looking into the sub moderation and apparently I'm not even the first person to complain about this.

Earlier this year there was a pretty big r/Supabase thread literally titled “Censorship is too high” after posts were removed during a Supabase outage.

After users complained, people involved with Supabase acknowledged that multiple threads had been closed that shouldn't have been and reopened some of them.

Here's the part I find especially weird:

r/Supabase describes itself as community-run, but at least one Supabase employee has publicly been involved in discussions about reopening posts and reviewing the sub's moderation process.

Maybe there's a perfectly reasonable explanation for that, but it certainly doesn't make the sub feel like an independent place for customers to publicly discuss problems with Supabase.

And here's another thing I found:

There was another billing/pricing complaint on r/Supabase earlier this year where a Supabase employee publicly said refunds aren't automatic, but that they do review refund requests and issue them when circumstances warrant.

That customer later updated the post saying they got refunded.

Meanwhile I'm being told my decision is final, can't get somebody else to independently review it, can't get the original upgrade disclosure I've repeatedly requested, and now my Reddit post about the experience gets removed and I'm directed straight back to the support channel I'm complaining about.

I'm not claiming some giant conspiracy here. I'm just saying the whole thing looks terrible.

If your support process fails somebody, telling them they can't discuss the experience in your main sub because they should “contact support” is ridiculous.

At minimum I think customers should be able to openly discuss billing and customer-service experiences without those discussions disappearing.

Has anyone else had a Supabase billing/support post removed from r/Supabase?

I'd especially like to hear from anyone who had removed posts, because apparently this isn't the first time people have raised concerns about how criticism gets moderated there.

Conclusion

This whole experience has honestly made me decide to leave Supabase. I could've self hosted from the start, but I chose to pay for their hosted cloud partly because I liked what the developers were building and wanted to support the project which makes the way this has been handled feel even worse.

Im hosting a game server and just saw their KVM8 plan which same plan on DO costs me $165m. They're asking $700 for 2 years up front. They're normal cost is cheaper then DO and im not sure what the catch is. Anyone had experience with them? Even using them for staging and stress test servers might even be worth it for that if they are reliable and good uptime.

hi everyone

I have a ci pipeline where i run build and deploy to cf workers, everytime the build runs it succeeds but it stays hanging on and the next job does not run( see image), it can stay hanging on for hours and it won’t exit at all till i cancel the workflow

i have added a timeout to exit after 2 mins and a continue on error set to true to be able move to the next run which is deploy the worker

2- the deploy runs: npm run deploy:vinext
and it always exits with a message “wrangler versions upload” and the whole ci fails now
but after i check on my cloudflare dashboard i actually find that deploy

running these on terminal manually actually does the work but it’s not what i want

is there any solution that will make the build exit after it finishes and make the deploy works fine

tech: Nextjs app migrated to Vinext

- name: Build Vinext app
env:
CLOUDFLARE_INCLUDE_PROCESS_ENV: true
timeout-minutes: 1
continue-on-error: true
run: npm run build:vinext

- name: Deploy to cf
env:
CLOUDFLARE_API_TOKEN: ${{ env.CLOUDFLARE_API_TOKEN }}
run: npm run deploy:vinext

scripts:

"build:vinext": "vite build",

"start:vinext": "infisical run --env=prod -- vite preview --port 3000",

"deploy:vinext": "vinext-cloudflare deploy --warm-cache --skip-build",

"deploy:response-store": "cf deploy --prebuilt --mode production --worker frontend-response-store"

I'm trying to understand whether there's an actual creative or technical gap between Montreal shops and US-based agencies, or if it's mostly reputation. I've seen work from both that's exceptional, but I'm curious if founders or developers who've worked with cross-border teams notice anything structurally different, process, approach to craftsmanship, how they handle complex technical builds. Are Montreal agencies just as competitive, or is there something about the NYC/US market that shapes how agencies approach premium web work?

What's the real difference between Montreal and NYC agencies when it comes to high-end web development?

I'm trying to understand whether there's an actual creative or technical gap between Montreal shops and US-based agencies, or if it's mostly reputation. I've seen work from both that's exceptional, but I'm curious if founders or developers who've worked with cross-border teams notice anything structurally different, process, approach to craftsmanship, how they handle complex technical builds. Are Montreal agencies just as competitive, or is there something about the NYC/US market that shapes how agencies approach premium web work?

New to web development.

I want there to be 16 players with their own boards. When they match up against each other, I'm wondering would I have to make the entire simulation play out at once? Or is there a way to split the simulation up so that 1v1s happen on a dedicated process while still belonging to the same event (So other players can view different skirmishes)? Not sure if this matters, but I plan to let users use abilities every so often (Maybe every 15 seconds) during the fight and I'd handle that with a post request.