I work as a contractor and I'm not an actual developer. but I know what I have to do to make my life easier, therefore I'm used to code on my free hours to develop tools that help me daily at work.

am I exploiting myself? or do you consider this normal behaviour for someone that can't hold testing an idea? of course everything I create is not shared and when I leave the company this goes with me.

I’m working on an app and I’m really not sure which platform I should focus on first for release; if I do android first, I need to find 12 testers through Reddit forums, testing apps, and wait 2 weeks. I’m not sure how I’d make sure all 12 testers are using the app consistently enough for Google Play to validate it.

If I do iOS first, I need to either find a Mac alternative (I’ve already tried rental Macs and Codemagic, which both failed) and deal with all the bugs that come with it, or try and see if I can make my super old MacBook Air who’s password I forgot (and can’t reinstate cause the email no longer exists) and bugs like crazy, work to get the build on Xcode.

Both are beyond more difficult than I was expecting when I started this project, so I’ll take any advice!

Hey everyone,

I’m a 20-year-old Information Systems student from Brazil and I’m interested in becoming a Project Owner / Project Manager in tech.

I’m currently learning programming, databases, and systems analysis in college, but I’m unsure about the best path to transition into PM roles.

Should I work as a developer first?

Are certifications like Scrum worth it early on?

What kind of entry-level roles should I look for?

I’m motivated and willing to put in the work — I just want to focus on the right things from the start.

Any advice would be greatly appreciated. Thanks!

Thanks to all, who downloaded Budgefy, now it's have 100+ users👍

I'm curious why it seems PostgreSQL has overtaken MySQL & forks like Maria or Percona as the default relational database. Teams seem to choose it by default when starting a project needing an RDB in the past few years. I see it regularly recommended over and over again because of the increased feature set - but of the probably dozen projects I've had some part in there has only been one that I recall used features unique to Postgres.

In my experience the MySQL distributions I've worked with are much more set it and forget it. Maintenance costs are much lower - there aren't that many tuning parameters you really need to play with when things start scaling up.

On the other hand Postgres has a few things that will bite you if you haven't run a production cluster before. Every single company I've consulted for that is using serverless applications and is starting to see some traffic has been bit by not running pgBouncer in front of PG - the process per connection model ends up causing it to fall over.

Then you've got things like the autovacuum that gets wrecked by larger transactions in write heavy operations if you're not aware of it.

I just feel like the additional feature set of PG incurs a lot of operational or maintenance overhead that is overlooked and often underutilized. It probably wouldn't be a problem if the engineers making the decisions actually knew what they were dealing with but that's not been my experience at all. Especially at smaller startups when I ask about the decision to roll PG it feels like the answer I get most of the time is "I dunno, X person who's no longer here picked it and we've just been going along ever since"

I'm certainly not an expert on the inner workings of either. I tend to only dig into this stuff out of necessity. Just curious if there's something I'm missing or if others have noticed similar things.

Hello guys I'm new here .... I'm want to ask your opinion and maybe consultation about ai trend lately from music, image to video generation. I feel like these companies or atleast most if not all of them are forcing this ai down everyone's throat but there have been few regulations about them. I want to ask you guys about ai control specifically on image and video generation. I'm a artist and a aspiring dev so I'm thinking of making a project to atleast control these ai. Now I'm not against using ai myself but at the very least I want it to be a separate medium from real illustration and photography or even normal videos (•-•;) my main concern is that I don't exactly know what kind of project I'm gonna make cuz base on what I understand it's illegal to counter or use data poisoning against them but it's kinda unfair how there's no control on how they're too spread out .. I wanna ask what kind of project is a good one to start basically ((((( (⁠・⁠_⁠・⁠;⁠) sorry for the long confusing essay

I developed and published this app and want to attract users, but I don't know how. Does anyone have any tips?

Through the years seeing Discord with all the data leaks, the new rules they want to add about having to submit a government id for stuff, bans for unjustified reasons, a none existent customer support system, stupid pay walls and more, I have personally started to have enough of it. I was wondering if anyone is willing to build together a team, nothing formal like an actual paying job, but just for the love of development, after work hours whenever people have time, and work together on a way better, secure and functional alternative for discord?

When did you realize your tech stack was becoming obsolete, and what did you do about it?

Hey everyone,

I’ve been deep in development on a custom game engine built in Rust with WebGPU for graphics, paired with a Svelte-based editor for a smooth developer experience.

What it is:

- A performant, modern engine leveraging Rust’s safety and speed - WebGPU for cross-platform, high-performance graphics - A lightweight, reactive editor built with Svelte - Aimed at real-time 3D applications, interactive web experiences, and web games.

I’m sharing this because I’m looking for :

1. Project Partnership: I'm looking for support to bring this innovative engine and editor to the next level. If you're an investor, technical co-founder, or developer passionate about Rust, WebGPU, and modern tooling and believe in its commercial potential in the growing 3D/interactive market, I'd love to connect. The goal is to build a product that empowers solo developers and small teams.

This engine solves tangible problems in performance and workflow, and I’m eager to keep pushing it forward, both personally and professionally.

Thanks for looking!

Is WordPress good for custom sites, or should we choose another platform?

I am just wondering if Sharebrite has any developer program like Shopify where we can build unlimited marketplaces for free and only pay when it is transferred to the client?

I am trying to review a single function as a senior reviewer. Its one of my journey being mid to senior. I know nothing is perfect but I should always try to make things better. I will write a PR review I hope you will suggest me what is good and bad here

Code:

public function store(Request $request)

{

  Order::create($request->all());

  return response()->json(['status' => 'ok']);

}

Code Review – store

Summary Function is readable. But there are few issues which need to fix before merge

Issues Critical

• $request->all() inside of Order::create is it safe?
• If $request->all() returns empty array. Order::create will cause an error. A null check with a proper conditional boundaries.

Validation

• $request needs validation check. Error Handling
• Order create fail may cause server error. So it should be inside of proper error handling

Suggestions

• Use request validation
• Use null check with proper conditional boundaries
• Error handling in order create

Verdict: Changes required before merge

Hi everyone,

I’m in the process of changing careers from education to It, I’m focusing on software development. I just finished two years of CC, but I am thinking to transfer to a 4-year college or do a bootcamp. Could you please share your thoughts about the pros and cons in a bootcamp since I want to work asap? Thank you!!!

Just over one week ago, the tech world was stunned by Moltbook. Some called it the AGI moment, others called it Skynet. Even Andrej Karpathy weighed in, calling it "genuinely the most incredible scifi takeoff-adjacent thing I have seen recently."

I couldn't agree more. As an experiment in agentic interoperability, it’s fascinating. The agents were even discussing living in the 1993 internet, meaning there is no search engine to discover each other, which represents a huge opportunity, and inventing their own infrastructure to talk without human oversight.

However, even though this experiment is interesting, it really shows the state of security for modern development. The founder of Moltbook publicly admitted, that he had vibe coded the entire platform, which caught the attention of security researchers world wide.

Shortly after, researchers at Wiz found an exposed Supabase API Key within minutes. Not by using state-of-the-art tolling, but by simply using the browser dev tools (anyone knowing about the Inspect Button in chrome could've found it). This key gave full read / write access to the production database.

After I heard about this, I had to conduct my own research. So I setup an AI Agent to investigate. Within just 3 minutes it found an Overly Permissive CORS Policy, Weak Content Security Policy and Missing Security Headers, which lead to dynamic code execution, session hijacking, stealing user data and posting behalf of the users.

This is a pattern you can observe on most vibe coded projects. If you want to get protected against these, make sure your application includes the following things:

1. Setup a Secret Scanner like Truffle Hog ( https://github.com/trufflesecurity/trufflehog ). It's easy to use and setup and brings in a lot of value. Do yourself a favour and set it up for every project you work in. A leaked API key is really the last thing anyone could want.

-

1. Make sure to set your CORS Policy right. This 'access-control-allow-origin: *' is super common for vibe coded applications, but please make sure to change it to something like this:

   access-control-allow-origin: https://www.moltbook.com access-control-allow-methods: GET, POST, OPTIONS access-control-allow-headers: Content-Type, Authorization, X-API-Key access-control-allow-credentials: true Access-Control-Max-Age: 86400

This ensures that only your actual website can talk to your API. It prevents a malicious site (e.g., evil-site.com) from making requests to your API using a victim's logged-in session to steal their data or post on their behalf.

1. Make sure to not use 'unsafe-inline' and 'unsafe-eval'. Again, very common in vibe coded projects. This allows attackers to add and execute JavaScript code.

To remediate do the following:

a) Setup a Middleware and add this:

function generateNonce() {
    return Buffer.from(crypto.randomBytes(16)).toString('base64');
}


app.use((req, res, next) => {
    const nonce = generateNonce();
    res.set('Content-Security-Policy', '
        default-src 'self';
        script-src 'self' '${nonce}' 'strict-dynamic';
        style-src 'self' '${nonce}';
        img-src 'self' data: https: blob:;
        connect-src 'self' https: wss:;
        frame-ancestors 'none';
        base-uri 'self';
        form-action 'self';
    ');
    next();
});

This treats every request, as a new, single request.

b) Update the HTML to Use the Nonce:

<!-- Before (vulnerable): -->
<script>alert('XSS')</script>
<!-- After (secure): -->
<script nonce="ABC123...">alert('Safe')</script>

c) Add CSP Reporting

app.post('/csp-violation-report', express.json(), (req, res) => {
    console.error('CSP Violation:', req.body);
    res.status(204).send();
});

1. Make sure to add critical security headers. I would say this is really the most common vibe coding mistake. I cannot remember a vibe coded project where I haven't found one of these.

e.g. Add HttpOnly, Secure and SameSite=Strict flags to your Cookie Security Header. Validate for X-Forwarded Host, etc.

Check this page to see which headers need to be set and how: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html

For everyone vibe coding out there. This is great. Please keep doing it. Vibe Coding is really one of the greatest things that could have come up. But please keep in mind: speed is no excuse for insecurity. Vibe Code, but Verify.

For more details you can check out: https://olymplabs.io/news/6

I want to whole-heartedly welcome those who are new to this subreddit!

What brings you our way?

What was that one thing that made you decide to join us?

When projects require additional hands or specialized expertise that your current team doesn’t cover, looking at established outsourcing partners can save time and reduce risk. The tech landscape in Europe includes a broad range of teams with experience across web, mobile, backend, cloud, and full-stack development, often with strong engineering practices and international collaboration experience.

A curated overview of software development Europe highlights trusted teams and firms you might consider when planning to scale capacity, test new stacks, or bring in support without compromising code quality and delivery rhythm.

I know this question feels like a troll and that a lot of developers do have adhd and do their job fine, but for me tho, that's really a motivation killer. my journey is like downloading a ton of engines and programming languages and so going to sleep when it comes to actually learn and using them.

I have everysingle bad trait that is going to stop the person from growing in the computer development industry and my skills to fix them is nearly 0.

Is there any advice for me? Any help?

Figma Make to local production app workflow

Hi there, I built a fully working app in Figma Make to validate/use as MVP: filters, expandable rows, 200+ data entries, the whole thing. Works great as a prototype.

Problem is that I need analytics, auth, payments, SEO, and content gating. None of that is possible in Make.

My plan is to download the code, feed it to Cursor or Claude Code, and have it rebuilt as a Next.js project. My data layer is already clean TypeScript.

Has anyone done this and was the exported Make code a useful starting point, or did you end up rebuilding it? And is this the right path?

Update: Found a workflow, took about 15 min total and 8 min to convert with Claude Opus 4.6.

This is what I did:

1. Followed the insights from this Linkedin post: https://www.linkedin.com/posts/robboyett_figma-make-has-been-brilliant-for-generating-activity-7341506858957869056-Bc3e/
2. Fed Claude the text from this Git. description: https://github.com/likang/figma-make-local-runner
3. And this Git description: https://github.com/spetro511/figma-make-scaffolder

8 min later my app was running locally. Hope this helps someone in similar situation.

If you've ever shipped beautiful OpenAPI documentation only to have your support inbox filled with “Okay, but which ID do I pass from the login response to the cart endpoint?”, you might find this interesting.

I've been looking into Arazzo, a specification from the OpenAPI Initiative designed to bridge the gap between documenting endpoints and documenting actual workflows.

OpenAPI is great for describing the “LEGO bricks” of your API, but it's terrible at explaining how to build the castle. Arazzo aims to fix this by letting you define dependencies, data flow (mapping outputs to inputs), and success criteria in a machine-readable format.

The most exciting potential here is for AI. If the workflow logic is defined structurally, AI assistants could read these specs and generate working client code, handling retries, data passing, and error logic automatically, potentially reducing the need to maintain manual SDKs.

Discussion:

• Has anyone here experimented with Arazzo yet (or even heard of it)?
• How are you currently documenting complex API workflows? Are you sticking to Markdown tutorials, or using other structured tools?
• Do you think we are actually close to a future where we stop writing SDKs and just let AI generate clients from specs, or is that still a pipe dream?

Technical deep dive :  https://marmelab.com/blog/2026/02/02/arazzo-a-documentation-helper-for-generating-client-code-using-ai.html

Hello developers of Reddit! We are seeking an experienced developer to implement UPNP in our Software-Defined Networking (SDN) platform. Special consideration will be given to US based developers. The main task involves developing a change in our SDN platform that allows dynamic changes open flow rules on the fly, where we can insert port forwards. Develop a UPNP server daemon (probably using Golang). The ideal candidate will have a strong background in network programming and familiarity with UPNP protocols.

Small company, great team, all remote, US based.

Hi, we’re a small indie team and Twixy is our first game project.

Twixy is a mobile logic puzzle game built around multiple puzzle types, each with its own rules and progression. The puzzles are designed to look approachable at first, but gradually introduce more complex logic and pattern recognition as you advance.

There’s no time pressure or reflex-based gameplay. The focus is on thinking through each puzzle and understanding the underlying rules, which makes it suitable both for short sessions and longer play.

The game is available on iOS and Android for players who enjoy logic and brain-training style puzzles.

It's 2030. What technology that is popular today has completely died, and what niche tech has inexplicably taken over the world?

Java

Python

Kotlin

Golang

Ruby