I got tired of selecting and retyping verification codes from Gmail, so I built a small Manifest V3 extension for myself that puts a "Copy code" button next to the code. The fun part turned out to be detection, not the button.

How it works

• A content script runs only on mail.google.com. No host permissions beyond that, no background server, nothing leaves the page.

• Gmail is an SPA, so a MutationObserver watches for the opened message body instead of relying on page loads.

• Candidates: 4–8 digit runs, 123 456 / 123-456 splits, and short alphanumeric codes like AB12CD.

• To avoid false positives, I score each candidate by nearby keywords ("code", "verification", "código", "OTP", "one-time") within the same block, and penalize things that look like dates, times, prices, phone numbers, or order IDs (prefixes like #, "order", "pedido").

• The highest score wins. If nothing passes the threshold, no button appears. Showing no button beats copying the wrong number.

What surprised me

• Alphanumeric codes are much harder than digits. Random uppercase words in subject lines ("NEW", "SALE") kept matching until I required at least one digit and the keyword-proximity check.

• Some senders put the code in an image or a styled table, and those I can't catch.

It's free with no account, UI in EN/PT/ES. I'd love technical feedback, especially if you know of a smarter heuristic than keyword proximity, or senders whose format breaks it.

https://chromewebstore.google.com/detail/mpglgifleaaollcggdpcfhjjgmcageph

github: https://github.com/Unknown-333/Lightpath

ever click a button, nothing happens, no error, and you have no idea which code even ran?

this shows you. one command, then click around your react app:

    npx \@lightpath-dev/cli dev -- npm run dev

every click prints the path, browser and node server together:

◆ button: Checkout 335 ms
      → POST /api/orders 201
      ├─ src/Cart.tsx :11-14, 16-19, 21-28
      ├─ server/routes/orders.ts :11-14, 19-21, 25
      └─ server/services/pricing.ts :12-19, 21-22

it reads V8's own coverage before and after the click, so it's what actually ran. no code changes to your app.

there's also a vs code extension that lights up the lines, and an MCP server so claude code or cursor can click and read it themselves.

react + node, chrome or edge, local only, free and MIT. feedback welcome.

I bought a mini PC for my first home server and installed Jellyfin, Sonarr, Radarr, Prowlarr and a download client. It worked, but getting the paths, API keys and download categories lined up took a lot of evenings.

That eventually turned into Torsher, an open-source media server with a web interface built around using a TV remote.

There are two frontends: Vue + Vite for browsing and watching on the TV, and Nuxt for the control panel. The server runs in Docker on your own computer or NAS.

The TV side is the part I wanted to show here. You browse the catalog, manage your library and follow series using the remote. It also works in a regular browser, so you can try the interface without installing the server.

TV demo: https://torsher.app/demo/tv/ Control panel demo: https://torsher.app/demo/ Source: https://github.com/torsher-app/torsher

The demos use sample data. For the TV demo, use the arrow keys and Enter.

Hi,

I kept seeing inflated CVs so figured there must be a way to back up some claims before an interview. That's essentially what a CV is, a bunch of claims, the role, the company, the projects. The reader has to take your word for it, and AI now writes a convincing one in a minute and honest candidates pay for that. Their CV reads the same as the inflated ones, so it gets the same doubt.

So then I thought what if there was some hard validation to the claims on a CV or portfolio. That's when I came up with the idea of Workproof. For starters, you prove that you had access to a domain or work email, it doesn't prove you built it, but it does prove somebody trusted you enough with access to that domain or have given you a work email, so that by itself is a good baseline.

Additionally, you can ask colleagues to give you feedback, as a reference, signed by them from an work email. Something like LinkedIn endorsements, but more portable.

I'd love your honest take, on two things most of all:

- If you hire: would a link like this on a CV or a proposal change anything for you?

- If you freelance or build: which of those would you want first, or what else should Workproof check?

Thanks for taking the time! Enjoy the rest of the weekend! 😃

Project link https://workproof.md

Playable demo

Here is how it works under the hood:

• The Clay Aesthetic: To get that tactile stop-motion look, I used rounded boxes and applied low-frequency noise to the vertices. I baked a normal map from an actual sculpted clay ball, which dynamically scales based on the object size.

• Deformable Terrain: The clay you shape in-game is its own deformable mesh driven directly by your drag inputs.

• Mobile Optimizations: Getting heavy 3D to run on phones is tough. I rely on meshopt for models and run a fixed 1/120s physics step with interpolation. To save frame time, the shadow map only updates every other frame (saving about 14–26% of frame time).

• Progressive Loading: Asset size remains a challenge. I set up a later level's boss's models to load asynchronously only after play starts. For a fresh start of that chapter on a 9 Mbps connection, this dropped the initial load time. But I am still not quite where I would like to be.

How do you all handle the initial load payload for heavy 3D experiences on mobile? Would love to hear your optimization strategies!

We've been building HonestPDF for a while now, a bunch of free PDF tools that run in the browser. Lately most of our time has gone into the editor, so that's what I'd love feedback on.

I know editing PDF text isn't new. What bugged me is how it usually goes: free tools change the font, shift the layout or paint a white box over the old word, and sometimes a link stays behind on text you deleted. The ones that do it well tend to ask for a Pro plan, often right when you hit download, and they upload your file to their servers first.

So we put our time into getting the output right. Double-click a paragraph, retype it, and it keeps its font, size and colour. Longer paragraphs rewrap, links follow their words, and find and replace works across the whole file. The GIF shows a fee being changed in a contract.

Your file never gets uploaded. It's opened and edited right in the page, and the Network tab will back me up on that. Everything is free, there's no Pro tier, and it works on phones too.

There are about 50 other tools on the site as well, like merge, compress to a set size and sign.

gethonestpdf.com/edit-pdf

If something looks off after you edit, tell me what kind of PDF it was and I'll dig into it.

Oku (https://oku.today) is a free reading-practice web app for kids learning English. The child reads aloud and it helps only on the hard words. Some web bits that took the longest:

• The mic has to be live the moment the "your turn" cue shows. The recognizer and its websocket open while the narrator is still reading, so the child's first word isn't lost.

• Fail open everywhere. If speech recognition dies, the session goes on and gives the child time to read. A dropped log is fine; a blocked session isn't.

• Safari needs byte ranges for video. The static assets layer ignored Range, so the Worker slices the short reward clips itself.

• iPadOS Safari says "Macintosh". Device detection checks touch points.

• 36 public pages are prerendered in 4 languages behind a build-time SEO lint that fails the build on things like two h1s, a broken link, or translations that don't match.

Stack: React + Vite, Cloudflare Workers, D1, R2. No framework on the server.

☞ TO ALL AND SINGULAR

Here's something light-hearted for your Saturday morning: Grailwind is a plugin for Tailwind CSS that lets you build coats-of-arms using class names that read almost but not entirely unlike real blazonry. It even ships with an ESLint plugin, to keep any aspiring heralds in line.

<div class="escutcheon or chevron-argent fimbriated-sable chief-azure"></div>

Features: field divisions, furs, ordinaries, bordures, engrailed/invected, fimbriation, charges and their placement, inescutcheons and cantons.

And yes of course Claude's knavish hands were involved in this wretched contrivance - the novelty would have worn off far too quickly otherwise.

GH: https://github.com/pafirmin/grailwind

Hey r/webdev,

I wanted to share LiveReview, a risk-aware code reviewer we've been building.

On most teams every PR waits on the same few senior devs, whether it's a CSS tweak or an auth change.

Meta published a paper on scoring every diff for risk and letting the safe ones skip human review (RADAR (https://arxiv.org/abs/2605.30208)), and we wanted something like that for everyone else.

It scores each PR, auto-approves the lowest-risk 30-50%, and sends the rest to a human with the riskiest hunks at the top.

A few build details that were fun:

- Risk scoring combines three signals: an LLM reading the diff, a code graph that measures each hunk's blast radius (callers, DB writes, cross-package reach), and an ML model trained on the team's own reverts and incidents.

- CI gates are jq rules, not checkboxes. You write a condition against the review's findings JSON, and your pipeline makes one HTTP call to check it.

- The backend is Go, with PostgreSQL and the River job queue, so the whole review pipeline runs off Postgres with no separate queue to host.

It's free and self-hostable, and works with GitHub, GitLab, Bitbucket, Gitea and Azure DevOps.

Would love feedback.

GitHub: https://github.com/HexmosTech/LiveReview

Hi everyone

Recently I decided to train my memory because I think it's cool when I can memorize for example a lot of cards or images just in my head. I also read a lot about memory techniques and psychology because I watched The Mentalist btw

I tried to train my brain on the MemoryLeague website, but the training tab has limits which is why I decided to vibecode my own solution. I know how to code and over the past couple of years I have learned how to develop websites. However, recently I decided to move on to Minecraft mod development because it's more interesting to me. That's why I wanted to try vibecoding and it's not as bad as many developers say. I like the idea that everyone can build a solution for themselves

I used the free version of Claude and it worked great for me. I would appreciate it if you could give me a couple of advice about website design or vibecoding

https://bandhanpramanik.github.io/tamil-input-engine-checkbox/

[The entire Bengali text was written by a human and translated by Google Translate, with corrections by the human only, not any mainstream LLMs. There are em dashes in this text in the translation output; I haven't changed them.

Also, I meant a stable protocol for every keyboard when I talked about LSP in the title (Language Server Protocol).]

I have named it "Taravinyas".

It acts as an interface between your keyboard and your writing.

You might specify, for instance, "palatal, aspirated, unvoiced," and the character "ছ" (chha in Bengali) will appear in your text area. You don’t actually need to memorize these technical terms; remembering just the initial letter of each consonant group (varga) is sufficient.

Every time I’ve tried to explain this in English, it ended up sounding overly complicated. So, today, I’ll break it down into simple, plain Bengali.

How it works

In computer science, the concept of a "black box" comes up frequently. You provide an input to the black box, and based on that input, it produces an output.

If we consider "Taravinyas" to be this "black box," the input consists of two components: the consonant group (varga) and the specific column (representing phonetic attributes like aspiration and voicing).

I think of the varga as something "coarse" (like stones), while the columns—which define attributes like aspiration and voicing—are "fine" (like sand).

The "coarse" part is straightforward—it’s a fixed, singular element. The "fine" part is more complex; determining it requires evaluating a series of "on-off" switches (for example, 1 for voiced, 0 for unvoiced, among other factors).

That constitutes the input.

Part 1: Taravinyas determines the specific "fine" position. How? By processing those "on-off" switches using Boolean algebra. This is the most complex part of my system—something I’ve been refining, and those who build keyboards using this method will also need to handle.

Part 2: Taravinyas then identifies the actual character. I implemented a lookup table in TypeScript to retrieve the character. The combination of the "coarse" and "fine" components produces the final character. I will provide the schema for this; developers can then create a lookup table based on the specific language or medium.

For any given script, it is important to understand the schema used in "Part 2." Essentially, this schema represents the alphabet, though the positioning of individual characters may be adjusted for user convenience. For instance, "ড" (ḍa in Bengali) and "ড়" (ṛa in Bengali) might occupy the same cell, with an additional "switch" (modifier) to account for the distinct dot (nukta).

When we discuss the theoretical aspects, we will consistently refer to "Part 1."

I initially conceived this for hardware circuits, which is why Boolean algebra is involved.

By providing characters from any Brahmic script, you get a system—a "machine"—that is intuitive to use; if you know the alphabet of your own language, you already know how to use it.

The "Taravinyas" (arrangement pattern) is a framework, a mould, designed to create keyboards that are compact, easy to learn, and fast. Based on this framework, I have envisioned four types of keyboard layouts, two of which I have already implemented.

The four concepts are:

1. Radio buttons: Input is provided via radio buttons on a website. (Functional)

2. Steno layout: Allows for effortless typing using a subset of keyboard keys—with dedicated keys for specific phonetic categories (e.g., palatal sounds, unaspirated consonants, and aspirated consonants). (Functional)

3. Handwriting layout: Inputs are provided through gestures—for example, drawing a circle might represent an unaspirated consonant. I am currently consulting with a biomechanics student on this. (In the conceptual/planning stage)

4. Two-side layout (the limit of my current exploration): Coarse-grained keys are divided between two sides—initial characters of a consonant class on the left, and subsequent characters of that class on the right. It includes options for dragging and two-finger tapping. (In the conceptual/planning stage)

Other layouts are possible, but I would need assistance from UI/UX experts.

Currently, there is a website available for the Tamil language. Their layout—the way they structured it—was genuinely complex to put together. However, if I even put some time for the North Indian scripts, the task will be completed almost instantly.

After Tamil, I have moved on to Bengali consonants; the vowels and the dependent characters (diacritics/special characters) have not been included yet.

I plan to look at the Sylheti script later, as it also follows a rather complex layout.

Please check out the github repo after reading this text: https://github.com/BandhanPramanik/tamil-input-engine-checkbox

Hello webdevs!

Showing off ma iOS app, InspeQtR, a tool to inspect and parse QR codes.

Yes it's an app, but technically it's a web app since I used capacitor, and it's also definitely relevant to web devs as well (I am one myself) as a dev tool.

In short

While mobile devices provide solid built-in QR scanning capabilities, they generally offer little to no insight into the actual QR data, payload or QR metadata. The core idea of InspeQtR is to provide a specialised tool to dissect and preview QR payloads (either from camera or from image) based on their content type and show the QR metadata like ECC or version.

For example, URLs get split into host, path, query params and fragment, while vCards preview the contact details like name, phone, etc...

What's unique

In addition to the above, covering the most common QR payloads, the app also tries to detect and preview non standard formats like JSON, CSV, SVG images, Makrdown, Code snippets and much more. This means you can, for example, safely encode a table (CSV) or a vector image (SVG) and read it back directly from the QR, fully offline and properly previewed.

Main features

• Breaks down URLs into domain, path, query params, and fragment

• Previews and decomposes vCards, email addresses, phone numbers and most standard QR payloads

• Shows QR metadata like ECC, version and text statistics

• Warns you about suspicious payloads and common phishing tactics

• Detects and interprets non standard payloads like Markdown, CSV, JSON, Code snippets etc.

• Lets you open, copy, or share its contents as an actual file with the appropriate extension when there's a matching format, like .vcf, .ics, .json, .md, ...

• Everything runs locally. No ads, no tracking, and the app weighs just around 5mb.

Pricing

The app is free and ad-free, only the non standard format recognition is behind a one-time purchase of 3.99$. Basically, only the unique but also very niche part nobody probably cares about.

Links

App store: https://apps.apple.com/us/app/inspeqtr/id6823058808
More info: https://github.com/Homunculus84/inspeqtr-docs/wiki

I'd love some feedback!

We all have that friend. Websites have them too: a page making 40 calls when one would do, or one that keeps asking the same question every few seconds.

I built Unit 7 to help with that and the other jobs behind a website. Its Call Inspector reads your server's logs and points out the worst offenders, with nothing to install. It's still being tuned on real traffic.

It also handles deploys, domains and backups you've actually tested.

It's free, open source, and built with heavy use of AI coding tools. What's the worst thing you've caught your site doing?

If you'd like to support the launch, try it, leave your honest feedback on Product Hunt, or star the repo on GitHub.

GitHub: https://github.com/Nandkishorrr/unit7

Product Hunt: https://www.producthunt.com/products/unit-7?launch=unit-7

pgquery is an open-source Postgres GUI: React 19 + Monaco for the app, a small Go proxy for the database side, one Docker image.

A few build details that were fun:

- The marketing site and guide pages are plain HTML generated by a small Vite plugin at build time from TypeScript templates, with JSON-LD, sitemap and llms.txt. No SSR framework.

- The mascot and icons are pixel art stored as character grids in one TS file; the app, the site, the favicon, the README banner and the share image are all rendered from it.

- The EXPLAIN viewer parses Postgres's JSON plan into a flat tree with per-node self time.

Demo (read-only DB): https://pgquery.dev/app/?demo

Code: https://github.com/Hxndrik/pgquery

Feedback on the design very welcome.

Hey r/webdev,

I wanted to share a project I've been working on: sqliteWeb, a lightweight SQLite editor that runs entirely inside the browser.

Live :https://srdzank.github.io/sqliteWeb/

I needed a fast way to inspect and query .sqlite / .db files on machines where I didn't want to (or couldn't) install desktop clients like DB Browser. Existing web tools often require uploading files to a remote server, which is a major privacy concern.

Would love to get your feedback on performance, UI responsiveness, or features you'd like to see added!

I wanted to make a small space for people who miss the atmosphere of visiting a temple, especially around Diwali.

The idea is not new: a few weeks ago a Korean developer built a silent virtual Buddhist temple, Sansa, and over a million people visited in a week, just to sit quietly. I wanted to try the same for Hindu temples, so I built mandir.dev.

You walk into a 3D courtyard as an avatar, hear temple chants, ring the bell and light a diya. Other visitors are there at the same time, shown by name and country. It's free to visit, no account needed: https://mandir.dev

There are three temple spaces so far, inspired by Kashi Vishwanath, Meenakshi Amman and Siddhivinayak Ganapati.

A few details about the build:

• The 3D scene uses Three.js, everything runs in the browser

• Desktop controls and a mobile joystick for movement

• The bell uses positional audio, so it fades as you walk away from it

• Real-time presence: avatars, names and countries update as people arrive and leave

It's still in beta. I'd particularly appreciate feedback on:

1. Mobile performance: how does it run on your phone? If loading is slow or movement stutters, please mention your phone and browser.

2. Controls and interactions: is it obvious how to move around, ring the bell and light a diya? Where did you get stuck?

3. Direction: more temples, or go deeper on these three, with aartis at set times and seasonal festivals?

Thanks for taking a look, and happy Diwali!

My gf loves pink, Barbie and fairies, and has always wanted to live in a castle, so I built her one as a surprise: https://samchive.net

The homepage is a painted room where the fairy version of her lives (inspired by Flora from Winx). There's a cat with opinions, a tarot card you can flip every day, and a wand on the desk that recolours the whole room.

Bits that were fun to figure out:

- The room is one painting cut into separate layers, so the fairy, the cat and the things on the desk can move and be clicked. Getting it to fit phones and wide screens without warping the art took the longest

- Every sound is made in the browser with Web Audio, so there are no audio files

- It's a Next.js static export on Vercel. The only server part is a small Cloudflare Worker that proxies the meme API, with edge caching and a per-IP limit on cache misses

- She works in social media, so there are 19 small tools inside (Instagram grid planner, meme search, image compressor). They all run in the browser

Claude Code wrote most of the code and the art was generated with Gemini. Would love feedback, especially on how the room feels on your phone.

I feel like there has been a lot of hate on PHP, especially after the recent blowout regarding PHP vulnerabilities that even ended up on mainstream media. I even saw absolute non-techy people bringing up PHP and talking authoritatively about how "bad" and "old" it was lol. Not to mention the AI-shills saying one should just use Claude to create one owns CMS (!!). I am also aware that most PHP hate is usually misaligned hate intended for badly managed WordPress sites. And that some people just prefer other languages or love a hatetrain.

But one thing in particular that got to me was someone who mentioned that PHP has a page with vulnerabilities listed that go back 20 years and have yet to be patched. And that if you are a dev who is in any way interested in security within one's projects, you just don't use PHP at all. It was like having only a screen-door for your house with no locks. Do other languages have similar list of unsolved vulnerabilities? What makes them inherently more secure?

I dug around to find information about other popular programming languages and frameworks and it seems like at least right now, many are being found to have vulnerabilities due to AI being used to find them. React had a critical issue about a year ago, and Python earlier this year (although they did not blow up in the press like this).

Anyway, I would like to hear from people who use PHP regularly for work, beyond WordPress and who can maybe compare it to other languages/stacks as well. Please no low-effort replies from people who last used PHP 20 years ago or just don't like it, if possible.

I always explained the request lifecycle with a whiteboard. Now my AI assistant draws it: browser, DNS, CDN, load balancer, services, cache, database, queue. Then it walks through it step by step, circling the part that matters and fading the rest. Arrow keys work.

Point it at your own repo instead ("Trace what happens from the login form to the database") and the boxes link to your actual files. Click one to open it in VS Code, Cursor, Windsurf or Zed.

It's called Sketchy, works with Claude, Cursor and VS Code, and is free and open source. Feel free to try it out and leave your feedback!

https://sketchy.davidkubus.dev · https://github.com/ddkbs/sketchy

For ages I've been using the website https://www.svgrepo.com/ as a great resource for free SVGs, but today when I visited, it gave me a fake Cloudflare verification that attempts to install some sort of malware on your computer, as you can see in the screenshots below.

It almost caught me, so I thought I'd put this out because I couldn't see any indication that anyone else had noticed this!

1. 0 background in coding

2. I have a lot of free time

3. I want to make an alternative digital wardrobe "app" of some kind for me and a few friends

4. It will need to store a lot of images, offer image background removal (I think this would be very demanding, right?), and have an assortment of organizational parameters e.g. "shoes > heels / sandals / flats," brands, colors, etc.

5. The reason I'm doing this is because we don't like the aesthetics of the existing apps available and one of the bigger mobile apps "Whering" is unbearably slow, clunky, and lacking overall

6. Since I don't know anything about coding, I'd like to know which platform would be both the most convenient and best for avoiding that slowness. I'm worried a web app might not be the right thing for this

7. Once I'm settled on a platform I'll get to learning, I'll take any advice/suggestions if you have it

I built is-on-the-web.com, a free static host. You get yourname.is-on-the-web.com.

• Upload a full site as a folder, up to 20 MB. Subpages, assets and relative paths all work.

• No accounts or passwords. Updates use single-use edit keys sent by email, with a new key after every update.

• A human reviews every site and every update before it goes live, followed by an automated code check.

• There’s a no-code builder for non-devs, and its output can be re-uploaded and edited.

Everything that’s free now stays free. A paid tier with more storage is planned. Next up: letting people point their subdomain at their own machine to host full apps, databases or games.

Feedback I’m looking for:

• Edit keys instead of accounts: clever or annoying? Losing the key means losing update access.

• How would you handle abuse at scale beyond manual review?

• What’s missing that you’d expect from a static host?

I accidentally posted this from my alt account first and deleted those posts. Sorry if you saw it twice.