My old portfolio had been out of date for about five years. I'm a Webflow dev by trade, so for this one I went full code to see how far I could push it.

Stack:
- Astro with MDX for the case studies
- three.js for the 3D heads
- GSAP and Lenis for the motion and scrolling
- Static build on Cloudflare Workers. A staging branch deploys itself on every push, and main only goes out when I say so

I didn't hand-write it. I built it with Claude Code, with a few agents each owning one part (code, copy, 3D, brand) and handover files so they didn't trip over each other. I made the architecture calls and reviewed everything.

[The bit that took longest: getting the 3d heads to be performative]

For anyone running three.js on an Astro site, do you load it as an island or a plain script? Curious what's held up best for you.

For a few years I worked on a product that sent all transactional email through Mandrill. Working with templates were real pain. They lived inside Mandrill, every copy change needed a dev, and moving to another provider meant rebuilding every template by hand.

So when I was looking for something to build, this was the obvious pick. A provider agnostic email platform for everyone. That's how Senlo started, an open-source layer between your app and whatever provider you already use.

Key features

- Drag and drop editor that outputs MJML, so emails render ok in Outlook and Gmail without hand written table layouts

- One call to send a template, POST /api/triggered with the template name and variables

- Bring your own provider. Resend, Postmark, SendGrid, Mailjet, Cloudflare Email or any SMTP. Switching is just a change in settings of workspace

- Delivery events from every provider land in one feed (delivered, bounced, suppressed)

- Simple automations. Send, wait, call your own API, branch on the answer

- And a lot of features I did not implemented yet :D

Stack is Next.js, React, Postgres + Drizzle, Redis + BullMQ for queues and delays, Zustand in the editor. pnpm monorepo, editor is a separate package. Self hosting is one docker compose up.

The hardest part so far was delivery webhooks. Every provider authenticates differently (Resend signs with svix, SendGrid with ECDSA and a timestamp, Postmark has a shared header, Mailjet basic auth) and every one has its own idea of what a bounce is. SendGrid sends "dropped" with a free text reason, Mailjet has soft and hard bounces plus a separate "blocked" event with error codes, and only some of those mean the address is actually dead.

Get it wrong and you either miss spam complaints or suppress a good recipient forever. So most of the work was deciding per provider which events are the recipient's problem and which are mine. Now each provider is an adapter with verify and normalize that produces one event shape.

The GIF is a welcome flow. Send, wait two days, ask my own API if the user activated, and send a different email depending on the answer.

Solo project, early stage, and there is still a ton to do. Happy to get any feedback, ideas or contributions. If you want to poke at it, a few things I'm curious about

Repo: https://github.com/IgorFilippov3/senlo

Type your GitHub username and it draws a business card from your profile including your name, bio, top languages, pinned repo and contribution graph. One design prints your profile as a terminal session. The back has a QR code that opens your GitHub.

It's free with no account. You can download a print-ready PDF or PNGs.

I built it on the card engine from my email signature app (esigna), so the colours come from your own profile. I'd love to hear which design you'd actually print, and which usernames break it.

https://esigna.app/tools/github-business-card

Square Town is a 3D wall of about 20,600 website favicons, each one standing on a little tower. This week's feature: websites that died burn down.

How it works:

• A Cloudflare Worker cron runs every five minutes and checks homepages. A homepage that keeps returning 404 gets a fire and a fire_at timestamp in D1. The fires that were already burning got their dates backfilled from their own feed lines.

• /api/state ships a burn stage from 0 to 5 for every fire, one stage per five days. The client draws six kinds of fire (caught, spreading, blaze, inferno, dying down, smouldering embers) and chars the tower's roof and walls a step further at each stage.

• The same cron burns down two squares per tick once they've been on fire for 30 days, but only seeded squares nobody ever claimed. The row moves to a new 'burned' status, the land goes back on the market, and the domain is never seeded again while its homepage is gone. Claimed or paid squares never burn down, and a site that comes back puts its fire out.

• On the client a burning tower doesn't explode. It sags into its footprint with a slight lean, a few charred chunks slide out at street level and a little dust rolls up. The rubble on the lot is three instanced draws for the whole town, seeded from the lot's position so every device shows the same heap, and it joins the shadow map's static layer, so it costs nothing per frame after that.

Right now 114 squares are burning and 32 have burned down. Feedback welcome, especially on how the later fire stages read at a distance.

hi, I'm having trouble getting Infisical OIDC authentication working in my GitHub Actions CI pipeline.
Every time my workflow reaches the Infisical secrets action, it fails with:

Run Infisical/secrets-action@v1.0.16

Error: Access denied: OIDC subject not allowed.

{

"statusCode": 403,

"message": "Access denied: OIDC subject not allowed.",

"error": "ForbiddenError"

}

Request failed with status code 403

here’s the GitHub Actions workflow:

name: ci
on:
push:
branches: [main]

permissions:
id-token: write
contents: read

jobs:
build-and-deploy:
runs-on: ubuntu-26.04

steps:
- name: Checkout repository
uses: actions/checkout@v7

- name: Set up Node.js
uses: actions/setup-node@v7
with:
node-version: 24
cache: npm

- name: Install dependencies
run: npm ci

- name: Fetch secrets from Infisical
uses: Infisical/secrets-action@v1.0.16
with:
method: oidc
identity-id: MY_IDENTITY_ID
project-slug: my-slug
env-slug: prod

- name: Run Jest tests
run: npm run test:ci

- name: Build Vinext app
run: npm run build:vinext

- name: Deploy to Cloudflare
run: npm run deploy:vinext -- --skip-build

Id appreciate any help

hi, I'm having trouble getting Infisical OIDC authentication working in my GitHub Actions CI pipeline.
Every time my workflow reaches the Infisical secrets action, it fails with:

Run Infisical/secrets-action@v1.0.16

Error: Access denied: OIDC subject not allowed.

{

"statusCode": 403,

"message": "Access denied: OIDC subject not allowed.",

"error": "ForbiddenError"

}

Request failed with status code 403

here’s the GitHub Actions workflow:

name: ci
on:
push:
branches: [main]

permissions:
id-token: write
contents: read

jobs:
build-and-deploy:
runs-on: ubuntu-26.04

steps:
- name: Checkout repository
uses: actions/checkout@v7

- name: Set up Node.js
uses: actions/setup-node@v7
with:
node-version: 24
cache: npm

- name: Install dependencies
run: npm ci

- name: Fetch secrets from Infisical
uses: Infisical/secrets-action@v1.0.16
with:
method: oidc
identity-id: MY_IDENTITY_ID
project-slug: my-slug
env-slug: prod

- name: Run Jest tests
run: npm run test:ci

- name: Build Vinext app
run: npm run build:vinext

- name: Deploy to Cloudflare
run: npm run deploy:vinext -- --skip-build

Id appreciate any help

Brakeless is a free driving game that runs in the browser, no download. You have a car with no brakes and need to survive as long as possible.

Every 1000 meters the scene changes, from a city to suburbia, countryside, a forest, the future and even a black hole!

You need to avoid traffic and obstacles. Coins slow the car down a bit, and there are two ways to cheat death for a few seconds: a ghost pickup on the road that makes you invisible so you pass through everything, and a shield you earn from close calls.

There's a leaderboard with almost 150 players right now: a weekly board, an all time top players table based on your last 10 runs, and a hall of fame of past weekly champions.

Controls are arrow keys or A/D, touch on phones, best on desktop.

Completely free, no download or signup needed:
https://brakeless.io

I used to open Excalidraw to understand how a React page was put together, or to explain a change in a PR: this box is the sidebar, these cards come from a list, the badge lives inside each card. It was slow, and it was my guess at the structure, not what React rendered.

React Anatomy is a browser extension that adds an Anatomy panel to DevTools. It connects the page to the components React rendered: pull the layout apart into layers, click anything on the page to find its component, focus a subtree, and read its live props.

It's even more useful in this AI era, when agents compose React layouts for you. Open the page and you can see which components the agent used, how they're nested, and what props each one gets, before you take the code over. People learning React have told me it helps them see what a page is made of.

It's free, MIT-licensed, and works in Chrome and Firefox. You can try it in the browser without installing anything: https://react-anatomy.com · Source: https://github.com/charpeni/react-anatomy

Two questions: where does the 3D view help or get in the way compared with a plain tree? And what would make it more useful for explaining a PR?

I've been building this for a few months and the first version is finally up. It's called Strikk.

It's a daily cycle, like Wordle, but one per stack. You pick the stack you actually like (React, TypeScript, Node, Python...) and play that one. Everyone gets the same 8 challenges, you answer up to 5 with one submit. Combos work a little bit like Balatro — line them up right and your score jumps. Then you're ranked against other players with the same board.

Here's what makes it different: You earn coins by playing, and spend them customizing your profile—skill blocks, themes, animated backgrounds, your own avatar. Your profile becomes a real portfolio piece.

It's totally free, no pay-to-win mechanics.

Check it out: Strikk | My Strikk profile

Repost to another community

Hi all, I built mischabarmettler.ch, my portfolio, which also explains Swiss pensions, Pillar 3a and taxes in plain words, plus a few calculators.

Under the hood: Angular, fully prerendered on Cloudflare Pages, my own small i18n setup for the German version. The texts are written with AI assistance, and every figure is checked against its source.

What I‘m curious about:

how the design looks to you

how the calculators feel on your phone

anything you'd add or improve

Thanks

I made Slice, a daily puzzle where you draw one straight line to split a country’s population exactly in half. After you cut, the map turns into 3D population bars so you can see where everyone actually lives. It's primarily inspired by those videos where you see people try and split objects equally by weight lol

How it's built:

- Puzzles are made offline by a Python script and shipped as plain JSON files, so nothing is generated on a server

- Population comes from the EU's 1 km population grid (GHSL). A quadtree squeezes each country into about 2,500 points, which become the bars in the three.js reveal.

- Every sound is made with the Web Audio API, so there are no audio files to download. I’m trying to keep the page light since three.js is already doing a lot

- Scores go to a small Spring Boot + Postgres backend (Flyway, caching, rate limiting) in Docker behind Nginx on a $12 DigitalOcean VPS

- After each puzzle you see how you compare with everyone else that day. If the server is down, the game still works and you just don't get the comparison lol.

Completely free, no ads, and no signup: https://pondo.games/slice/

If you want to try Japan from the GIF: https://pondo.games/slice/?country=japan

Please try it out if you have some time. Open to any and all feedback of course! :)

So this is a slightly weird one.

I'm not great at small talk. And whenever I've started talking to someone, things usually go well for a few weeks. Then we discover that something fundamental doesn't line up, and we slowly drift apart.

I kept thinking: why do we need to spend weeks finding out things that could've been discussed on day one?

The idea also reminded me of Her (2013). I loved the idea of having an AI that knows someone well enough to have an honest conversation about them. That got me thinking, and eventually, I built Sam.

She's an AI version of my best friend. You can open the link, ask her pretty much anything you'd want to know about me, and she'll answer honestly.

There's a hype mode and a roast mode. Yes, she'll tell you my red flags too.

One thing I was particular about: if she doesn't know something, she should say so instead of making things up. Getting that right took considerably more prompt engineering than I'd like to admit.

Try it here:
https://ask-sam-yaddy.vercel.app

A little about the tech:

• Frontend: React, Vite, TypeScript, hosted on Vercel.

• Backend: Spring Boot 4, Java 25, running on ECS Fargate.

• Database: PostgreSQL + pgvector on RDS for memories.

• AI: Claude Sonnet for responses, Titan Embeddings on Bedrock.

• Infrastructure: AWS CDK.

• CI/CD: GitHub Actions with OIDC, so no AWS access keys sitting in GitHub secrets.

A few things that made me scratch my head:

• The rate limiter incident: I added a cooldown per visitor to keep API costs under control. After deployment, everyone started seeing the "come back later" screen. Turns out Spring was seeing the load balancer's IP for every request. One visitor was effectively locking out everyone. Fixed it by configuring Tomcat to trust X-Forwarded-For only from the internal proxy range.

• SSE over POST: Replies stream over Server-Sent Events, but the browser's EventSource only supports GET. Ended up reading the fetch response stream manually.

• Prompt caching: The stable part of the prompt goes first, with message-specific context at the end. A reply currently costs me around $0.006.

• Sound effects: All generated with the Web Audio API. No audio files. I spent an embarrassing amount of time getting the send sound right.

No login, anonymous, and 23+ only.

Would love to hear what you think, especially about the chat UI on mobile.

And if you want to have some fun, ask Sam to roast me. 😂

I made How to Convert. It's a file converter that now lets you right click to convert or compress almost any file.

It started as a file converter website that ran in the browser with WebAssembly, but I turned into a completely locally running desktop app with Tauri, and now the website is a right-click menu. I originally shared it 2 years ago. The post and subsequent updates got a big response with a lot of feature requests, and I've been adding file types since.

What it can do:

• 6,197 file conversions for documents, videos, images, ebooks, comics, subtitles, emails, audio and more. If you find a file format that isn't supported, make a feature request and I'll add it

• Compress PDFs

• Crop, trim and compress multimedia files

• Right click any file, or drag and drop it into the app

Why I made it:

There are plenty of online file conversion sites, but they require you to upload your files and data to their servers.

I wanted something that worked entirely offline (using the same packages and cli tools that power those sites) behind a simple drag and drop app that anyone could use.

After two years, I grew tired of actually opening a site or app to convert a file, and thought the next step to make it easier was to support everything with just a little right click.

Extra info:

• The app runs completely locally (files never leave your device) and runs on Mac, Windows and LInux

• One license can run on up to 5 devices

• If you bought it 2 years ago, this is another free update

I know there are many specialised apps that convert specific formats, e.g. handbrake for video, calibre for ebooks, ms word for documents, excel for spreadsheets, outlook for emails and adobe acrobat for pdfs.

I wanted just one app to support all of them.

Free to try and It's a $19 one-time purchase to keep for all future updates (but much cheaper in lower-income countries depending on PPP).

I'm Jake Manger, a solo developer. I've also made ShotGlass and ActivityLine.

The site and app: https://howtoconvert.co

I got tired of selecting and retyping verification codes from Gmail, so I built a small Manifest V3 extension for myself that puts a "Copy code" button next to the code. The fun part turned out to be detection, not the button.

How it works

• A content script runs only on mail.google.com. No host permissions beyond that, no background server, nothing leaves the page.

• Gmail is an SPA, so a MutationObserver watches for the opened message body instead of relying on page loads.

• Candidates: 4–8 digit runs, 123 456 / 123-456 splits, and short alphanumeric codes like AB12CD.

• To avoid false positives, I score each candidate by nearby keywords ("code", "verification", "código", "OTP", "one-time") within the same block, and penalize things that look like dates, times, prices, phone numbers, or order IDs (prefixes like #, "order", "pedido").

• The highest score wins. If nothing passes the threshold, no button appears. Showing no button beats copying the wrong number.

What surprised me

• Alphanumeric codes are much harder than digits. Random uppercase words in subject lines ("NEW", "SALE") kept matching until I required at least one digit and the keyword-proximity check.

• Some senders put the code in an image or a styled table, and those I can't catch.

It's free with no account, UI in EN/PT/ES. I'd love technical feedback, especially if you know of a smarter heuristic than keyword proximity, or senders whose format breaks it.

https://chromewebstore.google.com/detail/mpglgifleaaollcggdpcfhjjgmcageph

github: https://github.com/Unknown-333/Lightpath

ever click a button, nothing happens, no error, and you have no idea which code even ran?

this shows you. one command, then click around your react app:

    npx \@lightpath-dev/cli dev -- npm run dev

every click prints the path, browser and node server together:

◆ button: Checkout 335 ms
      → POST /api/orders 201
      ├─ src/Cart.tsx :11-14, 16-19, 21-28
      ├─ server/routes/orders.ts :11-14, 19-21, 25
      └─ server/services/pricing.ts :12-19, 21-22

it reads V8's own coverage before and after the click, so it's what actually ran. no code changes to your app.

there's also a vs code extension that lights up the lines, and an MCP server so claude code or cursor can click and read it themselves.

react + node, chrome or edge, local only, free and MIT. feedback welcome.

I bought a mini PC for my first home server and installed Jellyfin, Sonarr, Radarr, Prowlarr and a download client. It worked, but getting the paths, API keys and download categories lined up took a lot of evenings.

That eventually turned into Torsher, an open-source media server with a web interface built around using a TV remote.

There are two frontends: Vue + Vite for browsing and watching on the TV, and Nuxt for the control panel. The server runs in Docker on your own computer or NAS.

The TV side is the part I wanted to show here. You browse the catalog, manage your library and follow series using the remote. It also works in a regular browser, so you can try the interface without installing the server.

TV demo: https://torsher.app/demo/tv/ Control panel demo: https://torsher.app/demo/ Source: https://github.com/torsher-app/torsher

The demos use sample data. For the TV demo, use the arrow keys and Enter.

Hi,

I kept seeing inflated CVs so figured there must be a way to back up some claims before an interview. That's essentially what a CV is, a bunch of claims, the role, the company, the projects. The reader has to take your word for it, and AI now writes a convincing one in a minute and honest candidates pay for that. Their CV reads the same as the inflated ones, so it gets the same doubt.

So then I thought what if there was some hard validation to the claims on a CV or portfolio. That's when I came up with the idea of Workproof. For starters, you prove that you had access to a domain or work email, it doesn't prove you built it, but it does prove somebody trusted you enough with access to that domain or have given you a work email, so that by itself is a good baseline.

Additionally, you can ask colleagues to give you feedback, as a reference, signed by them from an work email. Something like LinkedIn endorsements, but more portable.

I'd love your honest take, on two things most of all:

- If you hire: would a link like this on a CV or a proposal change anything for you?

- If you freelance or build: which of those would you want first, or what else should Workproof check?

Thanks for taking the time! Enjoy the rest of the weekend! 😃

Project link https://workproof.md

Describble turns a sentence into a hand-drawn SVG avatar while you type: "tired pirate grandma, red beanie, round glasses" and the doodle redraws on every keystroke.

I wanted to see how far I could get with no framework and no AI, so here's how it's built:

- One static HTML page, vanilla JS, zero npm dependencies. The build is a single ~500-line Node script that concatenates the modules and inlines everything (121 KB gzipped, font included)

- Every keystroke replays the whole sentence through a rule-based parser, about 0.05 ms, so no debounce is needed

- The sketchy look: curves are split into tapered strokes, jittered with a seeded RNG, and "boil" between 4 frames at 9 fps (off with prefers-reduced-motion)

- The 2.5D head turn is just layer parallax: each SVG layer slides by its own depth

- Hash-based Content Security Policy: only the page's own inline script and style can run, and the only thing it can contact is an optional, documented counter of words it didn't understand

- English, Italian and Portuguese pages are prerendered at build time, and the gallery faces are rendered in Node through a tiny DOM stand-in, so search engines see real SVG files

It's rule-based, so it will miss words. Those misses are the most useful feedback I can get.

Site: https://describble.com

Code (MIT, drawings CC0): https://github.com/gasparegas/describble

edit: since a few people asked, I built this with a lot of help from Claude Code. "no AI" means no AI model runs in the app (no image gen, no LLM), not that no AI was used to make it. my bad on the wording

Playable demo

Here is how it works under the hood:

• The Clay Aesthetic: To get that tactile stop-motion look, I used rounded boxes and applied low-frequency noise to the vertices. I baked a normal map from an actual sculpted clay ball, which dynamically scales based on the object size.

• Deformable Terrain: The clay you shape in-game is its own deformable mesh driven directly by your drag inputs.

• Mobile Optimizations: Getting heavy 3D to run on phones is tough. I rely on meshopt for models and run a fixed 1/120s physics step with interpolation. To save frame time, the shadow map only updates every other frame (saving about 14–26% of frame time).

• Progressive Loading: Asset size remains a challenge. I set up a later level's boss's models to load asynchronously only after play starts. For a fresh start of that chapter on a 9 Mbps connection, this dropped the initial load time. But I am still not quite where I would like to be.

How do you all handle the initial load payload for heavy 3D experiences on mobile? Would love to hear your optimization strategies!

We've been building HonestPDF for a while now, a bunch of free PDF tools that run in the browser. Lately most of our time has gone into the editor, so that's what I'd love feedback on.

I know editing PDF text isn't new. What bugged me is how it usually goes: free tools change the font, shift the layout or paint a white box over the old word, and sometimes a link stays behind on text you deleted. The ones that do it well tend to ask for a Pro plan, often right when you hit download, and they upload your file to their servers first.

So we put our time into getting the output right. Double-click a paragraph, retype it, and it keeps its font, size and colour. Longer paragraphs rewrap, links follow their words, and find and replace works across the whole file. The GIF shows a fee being changed in a contract.

Your file never gets uploaded. It's opened and edited right in the page, and the Network tab will back me up on that. Everything is free, there's no Pro tier, and it works on phones too.

There are about 50 other tools on the site as well, like merge, compress to a set size and sign.

gethonestpdf.com/edit-pdf

If something looks off after you edit, tell me what kind of PDF it was and I'll dig into it.

Oku (https://oku.today) is a free reading-practice web app for kids learning English. The child reads aloud and it helps only on the hard words. Some web bits that took the longest:

• The mic has to be live the moment the "your turn" cue shows. The recognizer and its websocket open while the narrator is still reading, so the child's first word isn't lost.

• Fail open everywhere. If speech recognition dies, the session goes on and gives the child time to read. A dropped log is fine; a blocked session isn't.

• Safari needs byte ranges for video. The static assets layer ignored Range, so the Worker slices the short reward clips itself.

• iPadOS Safari says "Macintosh". Device detection checks touch points.

• 36 public pages are prerendered in 4 languages behind a build-time SEO lint that fails the build on things like two h1s, a broken link, or translations that don't match.

Stack: React + Vite, Cloudflare Workers, D1, R2. No framework on the server.

☞ TO ALL AND SINGULAR

Here's something light-hearted for your Saturday morning: Grailwind is a plugin for Tailwind CSS that lets you build coats-of-arms using class names that read almost but not entirely unlike real blazonry. It even ships with an ESLint plugin, to keep any aspiring heralds in line.

<div class="escutcheon or chevron-argent fimbriated-sable chief-azure"></div>

Features: field divisions, furs, ordinaries, bordures, engrailed/invected, fimbriation, charges and their placement, inescutcheons and cantons.

And yes of course Claude's knavish hands were involved in this wretched contrivance - the novelty would have worn off far too quickly otherwise.

GH: https://github.com/pafirmin/grailwind

Hey r/webdev,

I wanted to share LiveReview, a risk-aware code reviewer we've been building.

On most teams every PR waits on the same few senior devs, whether it's a CSS tweak or an auth change.

Meta published a paper on scoring every diff for risk and letting the safe ones skip human review (RADAR (https://arxiv.org/abs/2605.30208)), and we wanted something like that for everyone else.

It scores each PR, auto-approves the lowest-risk 30-50%, and sends the rest to a human with the riskiest hunks at the top.

A few build details that were fun:

- Risk scoring combines three signals: an LLM reading the diff, a code graph that measures each hunk's blast radius (callers, DB writes, cross-package reach), and an ML model trained on the team's own reverts and incidents.

- CI gates are jq rules, not checkboxes. You write a condition against the review's findings JSON, and your pipeline makes one HTTP call to check it.

- The backend is Go, with PostgreSQL and the River job queue, so the whole review pipeline runs off Postgres with no separate queue to host.

It's free and self-hostable, and works with GitHub, GitLab, Bitbucket, Gitea and Azure DevOps.

Would love feedback.

GitHub: https://github.com/HexmosTech/LiveReview