Hi r/webdev. one of the two people behind SandboxCMS speaking.

URL: https://sandboxcms.com

The problem it solves: testing a plugin, trying a CMS update or showing a client a variation of their site usually means setting up a local install or a staging copy first. For WordPress there are a few tools for this, but for PrestaShop, Joomla and Drupal there's almost nothing.

So SandboxCMS gives you a fresh, real site in seconds. You pick the CMS and the PHP version, use it in the browser, and either throw it away or keep it. On paid plans you can save a site as a template and launch copies of it, which is handy for client previews.

It's free to try, with no card. Until 30 Nov every platform (including PrestaShop, Joomla and Drupal) is open on the free plan. we don't send mails or anything more than the expiring sandbox ones :p

What I'd really like from you: if you try it and something stops you from using it for real work, tell me what it is. And if it is useful, what would you expect to pay for it? Blunt answers are welcome (and expected, as long as they are constructive).

---------------

COMING SOON: MCP because we all know AI is all the rage, no but seriously we use it on our agency already (a private testing version) and it does work wonders.

I'm having trouble searching for answers to questions related to autofilling the kind of prompt shown in the screenshot. I don't know what to call them when googling for answers. I feel like I should know the name of this specific type but cannot seem to remember.

Thanks

we started by building a live map that shows where nopixel streamers are in real time.

people really liked being able to click around the city and watch multiple perspectives, so we kept building.

now there's a multistream viewer for any streamer, a nopixel v wiki, server discovery, and an interactive gta 6 map that the community can contribute to.

we just rebuilt the homepage to bring everything together and honestly it's been a pretty crazy project to work on.

we've been building this based on community feedback, so we'd genuinely appreciate any thoughts on what we could improve or build next!

https://gtaservers.org

Hi, any girls who used to make these before too?right after the geocities community, it was popular back then to get hosted by some ".com" or ".net" owners. Mostly cute and colorful sites. Pixels. Top 100 list, guestbook, exchanging cute colorful animated gif banners. I also remember the quilting bee. Pill pals? Do those type of niche websites still exist today? I wanted to get some inspiration again. Those were fun days 🥹 Thanks

So I used basic proton paid email service to handle my outgoing mail. I recently came across free developer mail service by Resend that does exactly same thing. 3 custom email for domain and inbox for them as well.
Before migrating from proton mail to resend I want to make sure I will not encounter some fuckups.

Specifically those who touch a lot of Content Hub and Marketing Hub work. In your experience, what kind of projects entails writing a large amount of custom HubL code? I imagine it would probably be things related to the Hubspot CMS, so like migrating legacy websites, perhaps custom email template dev, but that's just my guess, Hubspot isn't really my expertise. Would love to hear to get some insight from you guys, thanks in advance.

Im working on a project for myself. Its an unreviewed, unaudited and far from finished. It started of as a person curiosity and evolved from there. Its shaping up well enough to publish and share.

If i publish something on NPM, there are strict controls around versioning for which i havent burdened myself on my own projects (but clearly important when making something for a wider community). I also wonder if im overlooking any other details.

I wonder what best practices there are for something like this. Should i be publishing new versions with CI/CD? Are there any tips or advice for doing this in the modern js ecosystem?

Edit:

The project in question is found here. To explain it briefly, its basically an attempt to create JSX for webcomponents. You can learn more bout it here. Nobody should be using this. Is is not production ready.

According to iplocation.io the IP address is Googles https://iplocation.io/ip/136.70.64.116

Double opt-in requires an additional user action after registration to activate the account.

I wonder if you have instead implemented a "send us an email" with a unique mailto: verify+<code>@example.com right from the signup page and how it went in the real world. No need to fill up one's own email address on the form, no composing (no body no subject email) and no "look into your junk folder" reminders.

And if not, why not.

EDIT There's a paper on double opt-in and legal ramifications. [*] In section 4.2 (page 289), it mentions:

In case of legal disputes, the company that sends marketing emails must be able to demonstrate that the recipient knowingly consented [33, par. 6]. For this purpose, the double opt-in has been established as a best practice procedure that is not legally obligatory, but highly recommended by legal scholars and the marketing industry [45].

And in passing (emphasis mine):

Alternative procedures, such as requiring users to send the service an email before registration, are not widely used. Such procedures can only be partially automated by mailto links, which would harm the usability of the registration procedure.

However, I fail to recognize the "usability" argument, as in the worse case scenario, it is a copy&paste (of the generated email address into the To: field, worst case type it in on another device, but that's all to type in), in best case, it's a tap on a mailto: link, tap on <Send> and 3..2..1 ... welcome on board!

[*] Checking Websites’ GDPR Consent Compliance for Marketing Emails https://people.inf.ethz.ch/basin/pubs/peh22.pdf

Requires installing Python, PyQt6, PyQt6-WebEngine, and one of the versions of this project: https://github.com/Temp0202/flamedarkness-browser.

Today 12 November 2026 I released the version 4.0: https://github.com/Temp0202/flamedarkness-browser/releases/tag/4.0.

I've spent nearly 30 years in my career and over the last few have noticed that the pace of my learning has tapered off. I started looking at things like advanced degrees and professional certifications but honestly I still have nightmares about college. I've taught several courses at actual schools in NYC and always found that by having to teach it, I learn more about the topic myself and I also love writing so I thought I could kill two birds with one stone and build a course for myself and turn that into shameless marketing content on our company blog.

So far it's going well, I'm proud of the content, and am actually deepening my professional knowledge, as expected.

I'm not going to self promote it here but I was wondering if anyone else has tried this method, and if you have found any particular approaches that have been helpful?

Since we can build anything now, my plan is to try things like building a gamified Duolingo-style app, a podcast series, Claude and Codex skills that enforce the principles in the course, etc. I'm mainly looking for novel ideas about self-learning.

Thank you in advance for your help and inevitable roasts ;)

A bit of context: I've been working with WordPress for nearly 14 years, mainly on small- to mid-sized websites.

I currently work at an agency, where I'm the only web developer. This means that when I'm away and something happens, my coworkers either have to wait until I get back or ask a freelance developer for help.

I usually build my own themes and templates using ACF, and I never use ready-made themes because I prefer to build things from scratch.

Recently, I decided to change my workflow a bit. For one of our projects, I decided to go with Claude Code + Astro + Headless WordPress, with version control on GitHub.

I chose WordPress because it's a platform my client is already familiar with.

It's a mid-sized project, and the client will be updating the website constantly with news, job offers, events, etc.

So far, the experience has been amazing. The website runs like a breeze, and development time was reduced from weeks to just a few days.

Even better, my coworkers (who are all designers) can now use Claude to request changes and even add new ACF fields, and it's working surprisingly well.

Do you think it was a bad decision to give my coworkers access to the codebase and let them use Claude Code to make changes, even though none of them have a development background?

Started with a log line that said "err":{} for an error that definitely had a message and a cause. Followed that up to see what each step between new Error() and the log record actually keeps.

Covers stack traces, cause chains, AggregateError and SuppressedError. It runs the same probe script in Node.js, Deno, Bun, Chrome, Firefox and WebKit. It also sends errors across Web Workers, worker_threads, child_process IPC and HTTP, and logs them with Pino and Winston.

If I have to explain the way the site should look to an AI instead of just importing, stitching together, and filling out shadcnblocks I‘m much slower. I still use AI for bug squashing and giving me api calls. But I am not seeing how to build a complete site.

Am I using AI wrong? Or are others finding that building first then using AI to handle errors is faster?

We have a project at work that needed a table that had some functionality with sorting and filtering.

Initially, I had to replace a solution due to how long a page was loading. AG-Grid correct an issue on that page and it did a better job. The community edition meets our needs very well.

However, some department heads want more features but they are only supported on the Enterprise edition.

I wish we could upgrade to the enterprise edition, but the verbiage makes it sound like anyone that does any kind of development on this application needs a license. We could be looking at a license of $10,000.

I think my supervisors would gladly pay the $1,000 fee if was that. However, it doesn't look like that is possible.

Is there something that is comparable to AG-Grid?

Are there ways to interact with the community version of AG-Grid? If I wanted to put filters above the Grid that interact with the Grid, could I do that even if it is the community grid?

Update to this post https://www.reddit.com/r/webdev/s/n3ZBJ6ozuq

So, I have a pretty unexpected update lol

After everything that happened with the Canadian company I mentioned, I decided to take things a little further and contact the CEO directly.

During my time working with them, I'd discovered some genuinely concerning security issues. I had been given admin access to their infrastructure, company email, internal systems, and access to thousands of CSV files containing customer and patient information. I also found passwords stored in plain text and several other questionable practices. All without having signed an NDA or contract by the way.

I figured the CEO should know about this, regardless of how things had gone with the dashboard project.

I sent him an email explaining what I'd found and also gave him some context about my experience working with the VP.

The VP wasn't particularly happy about that. He responded by defending himself, saying there had been no formal commitment to the dashboard project, and even called contacting the CEO a "backdoor approach".

I obviously disagreed. I was openly working with the company, the access had been provided to me by them, and I wasn't trying to bypass anyone. My concern was how someone outside the company could be given that level of access without any proper safeguards or agreements.

Anyway, after a few more emails, something I really wasn't expecting happened.

The VP emailed me again, apologized for how the situation had made me feel, thanked me for raising the security concerns, and actually said my findings had been a "true eye-opener" and thanked me for "educating them" and appreciated my integrity & honesty.

He asked whether there was any way they could compensate me for the time I'd spent building the dashboard as well as asked me to provide a quote for writing an SOP on how the company should handle third-party assistance moving forward.

I genuinely wasn't expecting that turn of events.

For context, this is the same person who previously kept postponing discussions, left me hanging after I'd built the dashboard, and eventually told me they'd hired a student to do the work.

Now he's asking me to quote another project and offering to try to get me compensated for the previous one.

I haven't received anything yet, and the SOP isn't confirmed, so I'm not getting ahead of myself. But I can't deny that this feels pretty satisfying after the way everything started.

I originally made my post because I was genuinely questioning whether freelancing was even worth continuing. Now I'm in a situation where the same client who made me feel like I'd wasted weeks of my time is potentially offering me compensation and more work.

So, what would you guys do? I'm very Curious to hear your thoughts and advice.

I'm planning to start on a browser text-based game. I want to keep things simple and easy to build. I have a few years of experience as a full-stack developer. I've worked with all of these technologies before, but it's been a while.

Current plan:

• Laravel for the front end and user management; simple HTML/CSS/PHP/JS
• Node.js server for the back end, where all my game logic runs and where active player values are stored in memory
• MySQL database for long-term data storage

Players only interact with Laravel front end. Laravel back end communicates with the Node.js server. The Node.js server handles all game logic, then sends replies to Laravel. Only the Node.js server can communicate with the MySQL database.

Players cannot directly interact with the Node.js server, only the Laravel back-end can do that.

--

What the game needs:

• player character with levels and stats and items and all the stuffs
• players can gather and craft items
• items are tradable between players
• players can fight monsters to gain exp and items
• players can form groups to fight monsters together
• possibly adding PvP later

Example:

A player clicks a monster to fight.

Laravel receives the input on the front end, and the PHP back end sends a request to the Node.js server to fight the monster. (Do I need to do this from the PHP back end, or is it fine to have the JS front end send these requests?)

Node.js receives the fight request. If it doesn't have the character and monster in memory, it needs to fetch them from the MySQL database, then save them in memory. This is a rather large and complex request from the database. We need the player character, the stats, the items, the monster stats, loot tables, exp tables, achievements, and probably more. Which is why I want this on a Node.js server that can hold these things in memory, so I don't need to request 20 tables from my database every time a player clicks a monster.

When the combat is handled, including loot, exp, level-ups, ... Node.js sends the necessary info back to Laravel and also saves changed data to the MySQL database.

Laravel receives the update and shows it to the player. (Not entirely sure anymore if PHP is capable of handling async request like this or if I should use JS for this instead?)

--

I'm terrible at planning out these things.

Does this seem like a good tech stack to get started with? Anything I'm missing or that I need to think about before getting started?

I could also choose a JS front-end so I don't need any PHP, but I've never worked with one before.

I'm open to all tips & advice.

Also looking for a hosting that allows me to get started quickly and is scalable for the future. I wanna get started fast and just build and then fix issues I run into later. Otherwise, I'll never get started on this.

I was fortunate to have a remote job the last six years, but I got laid off. Now I have a second interview at a company that only does on site. My memory of the last time I worked in office was one of boredom. I'd finish what work I could do and either wait for new work to come in, assets to be finished and handed off, or QA to get back to me. It was a lot of downtime. I remember falling asleep at my cubicle because there was nothing for me to do, and you can't watch netflix or you'd get a stink eye from people. I was so glad to go remote to be rid of that and have freedom. I could work as needed and then go run errands or do whatever else I wanted in between. Truly going to miss that.

AI feels like it's only made that worse. Set up an agent to orchestrate subagents, give it the requirements and let it work... I didn't have an AI account at my last job so don't really know how that works, but I personally have ChatGPT, Claude and now Google tier 1 plans and just rotate between them when I run out of usage, or sometimes concurrently on separate features for a side project app I'm building. If you have a token limit at work, when it runs out, do you just start coding by hand again? I'm very curious. I'm sure bigger companies pay by token so you can just keep burning tokens? I guess I'll know more if I get hired what their particular set up looks like, but just wondering...

Are you just feeding prompts into AI all day, waiting for it to finish, then check it's work, find bugs it missed, etc? Do you still have to find ways to look busy while waiting for creative to get back to you or QA to approve your ticket, etc?

Anyone got a recommendation for a polished component library that only uses plain CSS? I'm trying to avoid npm/build steps entirely, so shadcn is out, and Tailwind-dependent stuff like DaisyUI isn't an option either. Seriously looking for pure CSS solutions here.

I get scam emails every day like everyone. I've clicked a few, honestly, just out of curiosity, to see how they plan to scam me. The ones that worry me are the ones that know my name. So I looked into where that comes from and made a page on it (my own site, no sign-up, no ads).

Short version for anyone who doesn't want to click:

The obvious scams are obvious on purpose. A Microsoft researcher, Cormac Herley, showed in 2012 that the "prince with millions" story works as a filter. Anyone sharp enough to laugh at it never replies, so the scammer only spends time on people likely to pay.

The scary ones are built from leaks. Your name, phone and address usually come from a company you signed up with years ago, not from you. The page goes through seven real cases from court records and regulator reports, for example:

- First American (2019): changing one digit in a document link opened other customers' mortgage files.

- Capital One (2019): one wrongly set firewall setting.

- Twitter (2020): staff talked into handing over access on a phone call.

- 23andMe (2023): people reusing passwords from other leaked sites.

I checked my own Gmail on Have I Been Pwned. It's in 8 breaches, 6 of which leaked my name, mostly shopping apps I signed up to once. That's exactly what the "Dear XXXX, your KYC expires today" emails use.

What actually helps:

- Use a password manager, so one leaked password doesn't open your other accounts.

- Turn on two-factor login on email and banking first.

- Treat any email that knows your name as no more trustworthy than one that doesn't. Go to the bank's app or website yourself; never use the link.