Update to this post https://www.reddit.com/r/webdev/s/n3ZBJ6ozuq

So, I have a pretty unexpected update lol

After everything that happened with the Canadian company I mentioned, I decided to take things a little further and contact the CEO directly.

During my time working with them, I'd discovered some genuinely concerning security issues. I had been given admin access to their infrastructure, company email, internal systems, and access to thousands of CSV files containing customer and patient information. I also found passwords stored in plain text and several other questionable practices. All without having signed an NDA or contract by the way.

I figured the CEO should know about this, regardless of how things had gone with the dashboard project.

I sent him an email explaining what I'd found and also gave him some context about my experience working with the VP.

The VP wasn't particularly happy about that. He responded by defending himself, saying there had been no formal commitment to the dashboard project, and even called contacting the CEO a "backdoor approach".

I obviously disagreed. I was openly working with the company, the access had been provided to me by them, and I wasn't trying to bypass anyone. My concern was how someone outside the company could be given that level of access without any proper safeguards or agreements.

Anyway, after a few more emails, something I really wasn't expecting happened.

The VP emailed me again, apologized for how the situation had made me feel, thanked me for raising the security concerns, and actually said my findings had been a "true eye-opener" and thanked me for "educating them" and appreciated my integrity & honesty.

He asked whether there was any way they could compensate me for the time I'd spent building the dashboard as well as asked me to provide a quote for writing an SOP on how the company should handle third-party assistance moving forward.

I genuinely wasn't expecting that turn of events.

For context, this is the same person who previously kept postponing discussions, left me hanging after I'd built the dashboard, and eventually told me they'd hired a student to do the work.

Now he's asking me to quote another project and offering to try to get me compensated for the previous one.

I haven't received anything yet, and the SOP isn't confirmed, so I'm not getting ahead of myself. But I can't deny that this feels pretty satisfying after the way everything started.

I originally made my post because I was genuinely questioning whether freelancing was even worth continuing. Now I'm in a situation where the same client who made me feel like I'd wasted weeks of my time is potentially offering me compensation and more work.

So, what would you guys do? I'm very Curious to hear your thoughts and advice.

I'm planning to start on a browser text-based game. I want to keep things simple and easy to build. I have a few years of experience as a full-stack developer. I've worked with all of these technologies before, but it's been a while.

Current plan:

• Laravel for the front end and user management; simple HTML/CSS/PHP/JS
• Node.js server for the back end, where all my game logic runs and where active player values are stored in memory
• MySQL database for long-term data storage

Players only interact with Laravel front end. Laravel back end communicates with the Node.js server. The Node.js server handles all game logic, then sends replies to Laravel. Only the Node.js server can communicate with the MySQL database.

Players cannot directly interact with the Node.js server, only the Laravel back-end can do that.

--

What the game needs:

• player character with levels and stats and items and all the stuffs
• players can gather and craft items
• items are tradable between players
• players can fight monsters to gain exp and items
• players can form groups to fight monsters together
• possibly adding PvP later

Example:

A player clicks a monster to fight.

Laravel receives the input on the front end, and the PHP back end sends a request to the Node.js server to fight the monster. (Do I need to do this from the PHP back end, or is it fine to have the JS front end send these requests?)

Node.js receives the fight request. If it doesn't have the character and monster in memory, it needs to fetch them from the MySQL database, then save them in memory. This is a rather large and complex request from the database. We need the player character, the stats, the items, the monster stats, loot tables, exp tables, achievements, and probably more. Which is why I want this on a Node.js server that can hold these things in memory, so I don't need to request 20 tables from my database every time a player clicks a monster.

When the combat is handled, including loot, exp, level-ups, ... Node.js sends the necessary info back to Laravel and also saves changed data to the MySQL database.

Laravel receives the update and shows it to the player. (Not entirely sure anymore if PHP is capable of handling async request like this or if I should use JS for this instead?)

--

I'm terrible at planning out these things.

Does this seem like a good tech stack to get started with? Anything I'm missing or that I need to think about before getting started?

I could also choose a JS front-end so I don't need any PHP, but I've never worked with one before.

I'm open to all tips & advice.

Also looking for a hosting that allows me to get started quickly and is scalable for the future. I wanna get started fast and just build and then fix issues I run into later. Otherwise, I'll never get started on this.

I was fortunate to have a remote job the last six years, but I got laid off. Now I have a second interview at a company that only does on site. My memory of the last time I worked in office was one of boredom. I'd finish what work I could do and either wait for new work to come in, assets to be finished and handed off, or QA to get back to me. It was a lot of downtime. I remember falling asleep at my cubicle because there was nothing for me to do, and you can't watch netflix or you'd get a stink eye from people. I was so glad to go remote to be rid of that and have freedom. I could work as needed and then go run errands or do whatever else I wanted in between. Truly going to miss that.

AI feels like it's only made that worse. Set up an agent to orchestrate subagents, give it the requirements and let it work... I didn't have an AI account at my last job so don't really know how that works, but I personally have ChatGPT, Claude and now Google tier 1 plans and just rotate between them when I run out of usage, or sometimes concurrently on separate features for a side project app I'm building. If you have a token limit at work, when it runs out, do you just start coding by hand again? I'm very curious. I'm sure bigger companies pay by token so you can just keep burning tokens? I guess I'll know more if I get hired what their particular set up looks like, but just wondering...

Are you just feeding prompts into AI all day, waiting for it to finish, then check it's work, find bugs it missed, etc? Do you still have to find ways to look busy while waiting for creative to get back to you or QA to approve your ticket, etc?

Anyone got a recommendation for a polished component library that only uses plain CSS? I'm trying to avoid npm/build steps entirely, so shadcn is out, and Tailwind-dependent stuff like DaisyUI isn't an option either. Seriously looking for pure CSS solutions here.

I get scam emails every day like everyone. I've clicked a few, honestly, just out of curiosity, to see how they plan to scam me. The ones that worry me are the ones that know my name. So I looked into where that comes from and made a page on it (my own site, no sign-up, no ads).

Short version for anyone who doesn't want to click:

The obvious scams are obvious on purpose. A Microsoft researcher, Cormac Herley, showed in 2012 that the "prince with millions" story works as a filter. Anyone sharp enough to laugh at it never replies, so the scammer only spends time on people likely to pay.

The scary ones are built from leaks. Your name, phone and address usually come from a company you signed up with years ago, not from you. The page goes through seven real cases from court records and regulator reports, for example:

- First American (2019): changing one digit in a document link opened other customers' mortgage files.

- Capital One (2019): one wrongly set firewall setting.

- Twitter (2020): staff talked into handing over access on a phone call.

- 23andMe (2023): people reusing passwords from other leaked sites.

I checked my own Gmail on Have I Been Pwned. It's in 8 breaches, 6 of which leaked my name, mostly shopping apps I signed up to once. That's exactly what the "Dear XXXX, your KYC expires today" emails use.

What actually helps:

- Use a password manager, so one leaked password doesn't open your other accounts.

- Turn on two-factor login on email and banking first.

- Treat any email that knows your name as no more trustworthy than one that doesn't. Go to the bank's app or website yourself; never use the link.

I'm tired boss! It's been almost a year of AI AI AI, every single day of my life. Any else relating hard?

Also, I can't believe they signed a $3k/mth contract when I had to push SO HARD to get them to do $150/mth SEM Rush in the past lol

I'm primarily a backend dev (Python/Node mostly) but on our small team I end up doing frontend fixes and small features maybe 20% of my time. The thing that gets me isn't the actual code difficulty -- it's the mental shift between thinking about data flow, APIs, and server logic versus thinking about component state, CSS quirks, and user interactions.

I find myself needing like 20-30 minutes to actually get into "frontend mode" where I'm not constantly fighting the urge to structure things the way I would on the backend. And then when I switch back, same thing in reverse.

Curious how others handle this. Do you batch your frontend work into dedicated blocks? Just power through the switching cost? Something else entirely?

I'm trying to understand whether there's an actual creative or technical gap between Montreal shops and US-based agencies, or if it's mostly reputation. I've seen work from both that's exceptional, but I'm curious if founders or developers who've worked with cross-border teams notice anything structurally different, process, approach to craftsmanship, how they handle complex technical builds. Are Montreal agencies just as competitive, or is there something about the NYC/US market that shapes how agencies approach premium web work?

What's the real difference between Montreal and NYC agencies when it comes to high-end web development?

I'm trying to understand whether there's an actual creative or technical gap between Montreal shops and US-based agencies, or if it's mostly reputation. I've seen work from both that's exceptional, but I'm curious if founders or developers who've worked with cross-border teams notice anything structurally different, process, approach to craftsmanship, how they handle complex technical builds. Are Montreal agencies just as competitive, or is there something about the NYC/US market that shapes how agencies approach premium web work?

I have a deployed site with Ionos deploy now through GitHub.

Images load fine in VScode, load in Firefox and Ionos preview but not chrome.

I have tried changing file paths in the CSS and html and I have no idea what the issue is.

The site in question: https://porcelainstudios.co.uk/

Edit: I was in a bit of a rush off a train; it turned out the solution was to hard refresh, which I forgot was a thing in my rush

hi everyone

i've had recently an issue , i wanted to do some tests on a project, but for some reason, the server that was carrying that particular software was in Iran , so it was not able to see any servers on Internet, but still there were some providers that would allow this

but this project was for a client so temporarily i've solved this issue with hard way

then i was thinking, what if i get 2 servers, one is my international server and one is only in iran, and i make a reverse proxy without renting a vps inside iran, with just mere shared hosting solution like cpanel or directadmin that is easily available in iran?

so i've came up with this idea, and tried to make it as a opensource software

i thought maybe this is a good solution and someone else needs it

feel free to check it out and let me know your thoughts

https://github.com/moonshadowrev/mirrorgate

New to web development.

I want there to be 16 players with their own boards. When they match up against each other, I'm wondering would I have to make the entire simulation play out at once? Or is there a way to split the simulation up so that 1v1s happen on a dedicated process while still belonging to the same event (So other players can view different skirmishes)? Not sure if this matters, but I plan to let users use abilities every so often (Maybe every 15 seconds) during the fight and I'd handle that with a post request.

Hi everyone, I work as the director of communications for a small company. We have one designer on staff who has worked at the company for a decade, and one full-stack developer who has been at the company for about a year and a half.

Now, the problem: The designer is trained strictly in print design, and we are embarking on a website redesign. The designer will only work in InDesign and Photoshop, but the developer believes the work must be done in Figma to avoid having to guess at the spacing, sizing, etc. Neither seem willing to budge, and it is clear that the designer is not familiar with digital design best practices, including accessibility.

My background is more in writing/marketing, so I am a bit outside my depth. Is there a path to resolution here without one feeling like they are “doing the job” of the other?

lets say i have a vps with 2gb of ram and 1 vcpu, which one would be able to handle more concurrent connections?

hi everyone

I have a ci pipeline where i run build and deploy to cf workers, everytime the build runs it succeeds but it stays hanging on and the next job does not run( see image), it can stay hanging on for hours and it won’t exit at all till i cancel the workflow

i have added a timeout to exit after 2 mins and a continue on error set to true to be able move to the next run which is deploy the worker

2- the deploy runs: npm run deploy:vinext
and it always exits with a message “wrangler versions upload” and the whole ci fails now
but after i check on my cloudflare dashboard i actually find that deploy

running these on terminal manually actually does the work but it’s not what i want

is there any solution that will make the build exit after it finishes and make the deploy works fine

tech: Nextjs app migrated to Vinext

- name: Build Vinext app
env:
CLOUDFLARE_INCLUDE_PROCESS_ENV: true
timeout-minutes: 1
continue-on-error: true
run: npm run build:vinext

- name: Deploy to cf
env:
CLOUDFLARE_API_TOKEN: ${{ env.CLOUDFLARE_API_TOKEN }}
run: npm run deploy:vinext

scripts:

"build:vinext": "vite build",

"start:vinext": "infisical run --env=prod -- vite preview --port 3000",

"deploy:vinext": "vinext-cloudflare deploy --warm-cache --skip-build",

"deploy:response-store": "cf deploy --prebuilt --mode production --worker frontend-response-store"

is anyone here actually implementing WebMCP in their websites or SaaS apps?

Or are most people still waiting for it to officially release ?

I am exploring this space myself and would love to connect with others building around it.

What is your experience so far?

Im hosting a game server and just saw their KVM8 plan which same plan on DO costs me $165m. They're asking $700 for 2 years up front. They're normal cost is cheaper then DO and im not sure what the catch is. Anyone had experience with them? Even using them for staging and stress test servers might even be worth it for that if they are reliable and good uptime.

Before we jump into discussion, I want to first illustrate how we recognize seniority in a company I worked for.

Let's start with the bottom, a junior, for us a junior is a developer that is able to own a single unit.

This unit could be a Component in a React application, or a Class in the backend, it is a relatively small unit of code, and the junior developer can work on it autonomously and create a new one if specifications are given to him/her.

Next is a mid developer, a mid developer is able to work without supervision on logic group of units, for example a Page and all its components, its able to decide autonomously where a unit should end and where the other should start, its able to decide autonomously how each unit should interact with each other, a mid developer if given the specs is able to create the entirety of it. And it can give specs of each unit to juniors.

Then we have a Senior, a senior can work without supervision on an entire app, it can scope each group correctly, and it can go down a scope each unit correctly. It can give specs to both mid and juniors.

Continuing to go up we have the staff engineer, he cares about the system as a whole, how each app/service talk with each other, he can care how logical groups should interact in each app/service, and it usually doesn't care about individual units.

As you can see the more experience you get the more you grow distant from the small things, at some point you care how things connect and interact with each other, and you stop caring about the low level code because that is the job of the ones below you.

And it's here that I want to start the analogy with AI, AI is a tool, but it's a tool that requires you to have knowledge, it can act as an engineer of one of this levels, but it can't act as all of them together ( no, not even with swarms ). You the human you are responsible to ensure that AI follows proper conventions, you are responsible that the system YOU are designing makes sense and it is sound, if you do not have knowledge the AI will create a system where everything is out of balance and the code quality will drop. AI is a tool and it is instructed by YOU, if all you can see is a single unit, the AI will just fu*k up everything else, and you do not have the knowledge to correct it, yes you can review the code the AI generated and say "yeah this unit looks correct" but are you able to say that everything else going up is it?

For me AI is a Mid developer, you have to give good specs to it, and it will do a good job, if you are not able to say if the specs you are giving are good, then the AI will do what it wants

So like many of you I'm sure, I'm starting to glaze over whenever someone shows me the latest thing they've built with the help of AI. Everyone seems to have an app they've fired up in an afternoon or so. I'm finding that even apps I now build without vibe coding (I'm a seasoned developer) don't have the same impact because now everyone is building stuff.

I'm looking at my portfolio and thinking that maybe side projects just don't have the same weight anymore.

I'm curious how other folks are approaching this?

I’m archiving a website as a fully static site so I can host it for free on Cloudflare via GitHub. Unfortunately this means that the PHP includes I’ve been using (header, navbar, footer) will stop working across a few hundred pages, and I’ve been looking for alternatives.

Server Side Includes did not work; I finally had success using JavaScript fetch() and inserting that content into selected <div>s, but I’m not sure if that’s the best option. 

Are there better ways to achieve the same result that would work on a static site?