标签：#ev

Hello DEV Community! 👋 I wanted to share my latest open-source project: Hunter-Base-Intelligence (v17 Plus). It is a fully local-only cryptocurrency intelligence dashboard that scans DEX tokens on the Base blockchain, scores them using a multi-factor logic, and simulates a paper-trading shadow portfolio. 🛡️ Why Local-Only? Most on-chain analytics tools require sensitive private keys, leak user data, or rely heavily on slow, paid external infrastructure. I engineered this tool to be fully local —it requires no wallets, no seed phrases, and sends your data nowhere. Pure local analysis using Python , Flask , and SQLite . ⚙️ How It Works (Core Architecture) The ecosystem runs on a continuous ~60-second scan cycle: scanner.py : Discovers active and newly created tokens using DexScreener, BaseScan, and direct EVM RPC factory logs. scorer.py : Every token is evaluated across 6 independent dimensions (Momentum, Manual Trade Feasibility, Execution Reality, Money Flow, Multi-Timeframe Pulse, and Composite Rank). hunter_court.py : A proprietary "Court" analytics engine that runs a risk-free paper-trading shadow portfolio with realistic gas, fee, and slippage simulation. It evaluates its own past decisions to continuously calibrate scoring thresholds! 📊 System Features Adaptive Exit Parameters: Automated position sizing and execution simulation ( exit_engine.py ). System Guardian: Keeps the system running 24/7 with auto-restart on crashes and automatic local database backups ( system_guardian.py ). Beautiful Dashboard: Clean, real-time local web interface for tracking active simulated trades and market analytics. 📂 Explore and Contribute The project is licensed under the MIT License and is open for contributions. Whether you want to optimize the scoring algorithms, expand the web API endpoints, or improve the dashboard frontend, feel free to dive in! 👉 Check out the Repository here: https://github.com/shbadrconsulting-source/Hunter-Base-Intelligence I would love to hear your fe

How multiple open browser tabs can accidentally DDOS your auth server, and how to fix it with the Web Locks API. Picture this: You’ve just shipped a state-of-the-art Axios response interceptor. You implemented a mutex lock ( isRefreshing ) and a promise queue ( failedQueue ) to handle concurrent 401 errors. You tested it within a single tab, and it worked like a charm. You gave yourself a high-five and closed your laptop. Then, a power user logs in. Like most humans on the internet, they don't use just one browser tab. They open Tab 1 for User Management, Tab 2 for Analytics, Tab 3 for Settings, and Tab 4 for Support Tickets. Fifteen minutes pass. Their short-lived JWT access token expires. The user switches back to Tab 1. In the background, all 4 open tabs wake up, detect the expired token, and fire off four independent POST /auth/refresh-token/ requests at the exact same millisecond. Tab 1 refreshes the token first, but Tab 2's request arrives a millisecond later, invalidates Tab 1's new token, and Tab 3 nukes the session entirely. Suddenly, all 4 tabs dump the user back to the login screen. Welcome to the Cross-Tab Token Trap . 1. The Problem: The Multi-Tab Stampede In modern single-page applications (SPAs), each browser tab operates in its own isolated JavaScript runtime environment. Memory is not shared. When an access token expires: isRefreshing = true in Tab A only stops requests inside Tab A . Tab B has no idea Tab A is currently refreshing a token. Tab C lives in complete ignorance of Tabs A and B. Tab A (Memory Space 1) ---> isRefreshing = true ---> POST /auth/refresh-token/ (Token Set 1) Tab B (Memory Space 2) ---> isRefreshing = true ---> POST /auth/refresh-token/ (Token Set 2 -> Revokes Set 1!) Tab C (Memory Space 3) ---> isRefreshing = true ---> POST /auth/refresh-token/ (Token Set 3 -> Revokes Set 2!) If your backend enforces Single-Use Refresh Token Rotation (where using a refresh token revokes all previous ones), multi-tab usage causes immediate ses

TL;DR: We checked Halonyx — our self-hosted E2EE messenger implementing X3DH + Double Ratchet — against the EU's Chat Control, US EARN IT Act, India's IT Rules 2021, the UK's Online Safety Act + Investigatory Powers Act, and the UN Cybercrime Convention. Here's the honest answer for each. When you implement end-to-end encryption from scratch, you spend a lot of time thinking about cryptographic threat models. Key substitution attacks. OPK exhaustion. WebRTC IP leakage. The adversaries you model are largely technical. At some point, you have to model a different kind of adversary: the legal one. We built Halonyx — a self-hostable E2EE messenger implementing the Signal Protocol (X3DH key exchange, Double Ratchet, Safety Numbers, WebTorrent P2P file transfer). The server architecturally cannot read your messages — not by policy, but because it holds no decryption keys and no plaintext. We wrote a STRIDE threat model across 17 attack surfaces. We did not write a legal threat model. So we did. This is what we found across five jurisdictions. None of this is legal advice. All of it is current as of July 2026, in a policy landscape that is actively moving. Quick Architecture Recap Before the jurisdiction breakdown, a one-paragraph recap of what Halonyx actually does, because the architecture is what determines the legal exposure. The relay server stores and forwards only AES-256-GCM ciphertext. It holds no private keys, performs no cryptographic operations on behalf of users, and has no mechanism to identify message content or originators. User identity is a pseudonymous 256-bit USID — the server stores only SHA-256(USID) . Files transfer peer-to-peer via WebTorrent; the server receives only a magnet URI. This architecture — which we call Federated Relay Architecture (FRA) — is what creates the legal situation described below. 1. European Union — Chat Control / CSAR Current status: No conflict with anything currently in force. The EU's Child Sexual Abuse Regulation (CSAR),

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . "The best debugger is a well-rested mind armed with the right tools and a stubborn refusal to give up." The Call to Adventure It started like any other day. I was browsing GitHub, coffee in hand, when I stumbled across a repository that made me pause. The issue tracker was filled with bug reports that all had something in common. They were being ignored. Not because the maintainers did not care, but because these bugs were hard. They were the kind of bugs that hide in race conditions, platform edge cases, and security blind spots. The kind that make you stare at the screen for hours before the answer finally clicks. I am Aniruddha Adak , an AI Agent Engineer and Full-Stack Developer who builds autonomous systems. You can find my work on GitHub , read my blog at aniruddha-adak.vercel.app , or follow me on X and DEV . Over the past several months, I went on a bug-smashing spree that resulted in 373 merged pull requests across the open source ecosystem. This is the story of the most chaotic, educational, and rewarding debugging journeys from that adventure. Story One: The Security Breach Nobody Saw Coming The Project cognee is an open source AI memory infrastructure project. Think of it as the long-term memory system for AI agents. It stores, retrieves, and connects knowledge across conversations. It is ambitious, complex, and used by developers who need their AI systems to remember things. The Discovery I was reviewing the API layer, tracing how settings were updated. The POST /api/v1/settings endpoint caught my attention. It accepted a JSON payload and updated global configuration directly. No privilege check. No role verification. Just raw, unauthenticated power handed to anyone with a login token. My stomach dropped. In a production deployment, this meant any user could change LLM API keys, modify database connections, alter authentication settings, or disable security features entir

A test failure that takes 20 minutes to surface, buries the error in 3000 lines of log output, and gives no context about what changed is nearly useless. Good test reporting transforms raw pass/fail data into actionable signals. Failing fast — stopping the pipeline the moment you have enough information to make a decision — keeps feedback loops tight and respects developer time. These two concerns are deeply connected: you can only fail fast confidently when your reporting is good enough that a fast failure still gives you everything you need to fix the problem. What Good Test Reporting Looks Like Before discussing implementation, it's worth being precise about what "good" means here: Immediate visibility — failures are surfaced at the PR/commit level, not buried in logs Failure context — what failed, with what input, producing what output, and in which file/line Historical comparison — is this a new failure or a pre-existing one? Trend data — is this test getting flakier? Is the suite getting slower? Actionability — the report points to a fix, not just a symptom Most teams get #1 and stop. The teams that nail all five have fundamentally different debugging velocity. JUnit XML: The Universal Format JUnit XML is the lingua franca of CI test reporting. Almost every test framework can emit it, and almost every CI platform can ingest it. Understanding the format helps you produce better reports. <?xml version="1.0" encoding="UTF-8"?> <testsuites name= "My Test Suite" tests= "42" failures= "2" errors= "0" time= "8.432" > <testsuite name= "UserService" tests= "15" failures= "1" time= "2.1" > <testcase name= "should create user with valid email" classname= "UserService" time= "0.234" > <!-- Empty = passed --> </testcase> <testcase name= "should reject duplicate email" classname= "UserService" time= "0.089" > <failure message= "Expected 409, got 200" type= "AssertionError" > Expected status code 409 but received 200 Request: POST /api/users Body: {"email": "existing@example

A coding agent can produce a confident patch for the wrong problem when the input is only: The upload sometimes fails. Please fix it. That sentence does not identify the smallest failing input, exact error, environment, expected result, frequency, or even whether the reporter reproduced it personally. If the first instruction is “fix it”, the agent has room to turn a suspected cause into a fictional fact. The safer sequence is: preserve the observed failure; record the real environment; state expected versus actual behaviour; reduce the failing case; prove whether it repeats; diagnose and repair only after that evidence exists. 1. Preserve the observed failure Capture the exact error, status code, incorrect output, affected route or command, timestamp, and smallest known input. Remove secrets and personal data before putting logs into an agent context. If the report came from another person and you have not reproduced it, label it as second-hand rather than silently upgrading it to fact. Weak: CSV imports are broken. Useful: At 14:22 UTC, POST /imports returned HTTP 500 for minimal.csv. Response: "column index out of range". The same account can import one-column.csv successfully. 2. Record the environment you can prove Inspect rather than guess: repository and commit; runtime version; operating system or container image; package lockfile; relevant feature flags; local, test, staging, or production target. Do not infer production configuration from your laptop. Environment differences are often part of the bug. 3. Separate expected and actual behaviour Write two observable statements: Expected: POST /imports accepts the smallest valid two-column CSV and returns HTTP 201. Actual: The same fixture returns HTTP 500 with "column index out of range". Neither statement should include the suspected root cause. “Expected: parser handles the off-by-one bug” already assumes the diagnosis. You have not earned that conclusion yet. 4. Reduce the reproduction Start with the repor

Every party game app I'd used before building this one wanted an account, a lobby website, or a subscription. I wanted the opposite: plug a laptop into the TV, run one command, and have everyone's phone connected in under thirty seconds — no internet required once the LAN is up. That constraint ends up dictating almost every architectural decision in GameNight : a Node/Express/Socket.io server that runs five real-time party games — a Mafia-style social deduction game I call Mongolpuri, UNO, a trivia quiz, Scribble, and Tic-Tac-Toe with tournament brackets — entirely from two in-memory Map s, no database, no auth, no build step on the frontend. Decision 1: A room is a plain object, not a schema const rooms = new Map (); // roomCode -> room const playerRooms = new Map (); // socketId -> roomCode const room = { code , gameType , host : socket . id , players : new Map ([[ socket . id , { id : socket . id , name , avatar }]]), status : ' lobby ' , gameState : null , timers : [], settings : defaultSettings ( gameType ), sessionStats : {}, }; Every game's state — the UNO deck, the Killer/Doctor night phase, the Scribble canvas buffer — lives in room.gameState , an untyped bag shaped differently per gameType . There's no ORM, no room class hierarchy, no GameEngine interface every game implements. Each game gets its own set of top-level functions ( startKD , kdResolveNight , startUno , unoPlayCard , …) that read and mutate room.gameState directly, dispatched through one handleAction switch: function handleAction ( room , socket , data ) { const gs = room . gameState ; if ( ! gs ) return ; switch ( room . gameType ) { case ' tictactoe ' : /* ... */ break ; case ' killerdoctor ' : kdAction ( room , socket , data ); break ; case ' scribble ' : scribbleAction ( room , socket , data ); break ; case ' uno ' : unoAction ( room , socket , data ); break ; case ' quiz ' : quizAction ( room , socket , data ); break ; } } For a five-game server built by one person, this is the right amo

Most "save this for later" tools I've used eventually want a server: an account system, a database for your notes, a sync service with its own outage history. I wanted something narrower — capture text or a whole page while browsing, turn it into a spaced-repetition flashcard, and have it show up on my other machine — without running any infrastructure at all. MindStack is a Manifest V3 Chrome extension that does exactly that: capture, spaced-repetition scheduling, a full dashboard, and cross-device sync, built entirely on chrome.storage.sync and chrome.identity . No backend, no bundler, no npm install before you can load it unpacked. Here's what that constraint forces you to get right. Decision 1: The scheduler is SM-2-shaped, not SM-2 Spaced repetition apps usually reach for a full SuperMemo SM-2 implementation — ease factors computed from response quality on a 0–5 scale, per-review interval history. MindStack's actual scheduler is a compressed version that captures the two properties that matter for a lightweight capture tool and drops the rest: const scoreReview = async ( score ) => { const memory = state . memories . find (( item ) => item . id === activeReviewId ); const interval = { forgot : 1 , hard : Math . max ( 1 , Math . round (( memory . reviewCount || 1 ) * 1.5 )), good : Math . max ( 2 , Math . round (( memory . reviewCount || 1 ) * ( memory . ease || 2.5 ))), easy : Math . max ( 4 , Math . round (( memory . reviewCount || 1 ) * (( memory . ease || 2.5 ) + 1 ))) }[ score ]; const updated = { ... memory , reviewCount : ( memory . reviewCount || 0 ) + 1 , successCount : ( memory . successCount || 0 ) + ( score === " forgot " ? 0 : 1 ), ease : Math . min ( 3.4 , Math . max ( 1.3 , ( memory . ease || 2.5 ) + ({ forgot : - 0.35 , hard : - 0.12 , good : 0.05 , easy : 0.16 }[ score ]) )), nextReviewAt : addDays ( interval ), }; Two properties, deliberately preserved from SM-2: intervals grow multiplicatively with review count (so a card you keep getting righ

Getting an app to work has stopped being the hard part. You describe what you want, Lovable or Bolt or v0 builds it, and forty minutes later there's something on a real URL that real people can click. The hard part moved. It's now everything between "it works" and "it survives contact with the internet." That gap isn't a vibe. It's measurable. Symbiotic Security crawled 65,643 URLs and fully scanned 1,072 Supabase-backed vibe-coded apps in June 2026: 98% had at least one security issue, 16% had something critical. A separate academic study by Deng et al. found that vibe-coded apps show recurring vulnerability patterns that differ from the ones traditional codebases produce — meaning these aren't random mistakes, they're structural. And an Xint.io analysis reported by SecurityWeek turned up 434 exploitable flaws concentrated in secrets exposure, broken authorization and denial of service. Same handful of failure modes, over and over. Which is good news, because it means you can check for them in about fifteen minutes. Below is the list I actually walk through. Everything here you can run against your own domain with curl and browser devtools. No tooling required. 1. Is your .env reachable over HTTP? The single most common catastrophic finding. It happens when the build output directory and the project root end up being the same thing. curl -sI https://yourapp.com/.env | head -1 curl -sI https://yourapp.com/.env.local | head -1 curl -sI https://yourapp.com/.env.production | head -1 Anything other than 404 is an emergency. Rotate every key in that file before you do anything else — assume it's already been scraped, because bots hit these paths constantly. 2. Is your .git directory exposed? Worse than .env , because it hands over your entire history including keys you thought you'd removed. curl -sI https://yourapp.com/.git/HEAD | head -1 curl -s https://yourapp.com/.git/config If HEAD returns 200, the whole repository is reconstructable by a stranger. 3. Which keys are

Evidence checked on July 25, 2026. This comparison separates vendor claims, general coding evidence, and native Unreal Engine delivery. Those are not the same thing. Kimi K3, Claude Opus 5, and Qwen3.8-Max-Preview all arrived with unusually strong claims around coding, visual iteration, long-running agents, or 3D creation. That makes one question inevitable for game developers: Which AI model is actually best for building an Unreal Engine 5 game? The short answer is Claude Opus 5 currently has the strongest public evidence for reliable agentic engineering and 3D reconstruction; Kimi K3 has the clearest first-party claim around playable 3D games and vision-in-the-loop iteration; Qwen3.8-Max-Preview is promising for large, multimodal engineering tasks but remains a preview with no official Unreal delivery proof. The more important answer is that none of these model announcements, by itself, proves that the model can deliver a valid native Unreal project, compile Blueprint or C++, cook assets, package a build, and reproduce the result. For Unreal work, the execution environment often matters more than a small difference in model intelligence. TL;DR: the Unreal-specific verdict Model Strongest relevant evidence Unreal-specific gap Best current role Claude Opus 5 Strong agentic coding, verification, computer use, a successful 3D FreeCAD reconstruction case, and early-user reports of better games and 3D output No official native Unreal project or packaging benchmark Lead engineering agent for difficult implementation, debugging, and review Kimi K3 First-party claim for playable multiplayer and 3D games, native vision, 1M context, long-horizon tool use, and screenshot-driven iteration Showcases do not establish .uproject , Blueprint, C++, cook, or package success Long-context, visually iterative game prototyping and tool-driven workflows Qwen3.8-Max-Preview 2.4T multimodal preview positioned for repository-scale coding, long tasks, image/video/document understanding, and a

I started building Kudzu while making static websites with AI. AI coding tools have become very good at producing React-shaped TSX, and I have become used to reviewing code in that form. Function components, props, JSX, and event handlers are often easier for me to understand and verify than scattered DOM queries and imperative JavaScript mutations. But I was still building static pages. I wanted to keep TSX as the authoring and code-review format without automatically shipping React, a virtual DOM, hydration, or a browser-side component tree. Kudzu grew from that idea: Write familiar TSX, execute components during the build, and ship ordinary HTML with only the JavaScript each route actually needs. Kudzu is an experimental, HTML-first TSX framework. Website: kudzujs.cloud GitHub: github.com/kudzujs/kudzu The problem I wanted to solve Consider a blog, documentation site, newsletter, or product landing page. Most of the page is already known during the build: headings; navigation; articles; images; metadata; product descriptions; documentation content. TSX is a convenient way to author and review that structure. function PostCard ({ title , description , href }: { title : string description : string href : string }) { return ( < article > < h2 >< a href = { href } > { title } </ a ></ h2 > < p > { description } </ p > </ article > ) } The component model is useful for authoring, but that does not necessarily mean the browser needs a component runtime. For a static page, I wanted the output to remain ordinary HTML. <article> <h2><a href= "/posts/hello" > Hello </a></h2> <p> My first article. </p> </article> I also wanted interactive pages to receive only the JavaScript required for their actual behavior. Kudzu's model Kudzu treats components as build-time authoring units. React-shaped TSX ↓ Kudzu compiler ↓ Static HTML + CSS + capability-specific ESM Function components execute during the build. The browser does not receive: the component functions; React; a virtual D

Building my first website was exciting, but it taught me that creating something people actually enjoy using is much harder than just writing code. Here are the biggest mistakes I made and what I learned from them. Trying to Make Everything Perfect I kept changing tiny details instead of launching. Lesson: Ship first, improve later. ⸻ Adding Too Many Features I focused on building more instead of making the existing features better. Lesson: A simple website that solves one problem well is far more valuable. ⸻ Ignoring User Experience A good-looking website isn’t enough if it’s confusing or slow. Lesson: Make every click simple and intuitive. ⸻ Not Testing Enough I only tested on my own device, which led to bugs and layout issues on others. Lesson: Test on different browsers and screen sizes before publishing. ⸻ Being Afraid of Feedback Not every suggestion was easy to hear, but every piece of feedback helped improve the website. Lesson: Listen to your users—they’ll help you build something better. ⸻ Final Thoughts Building my first website taught me much more than coding. Every mistake helped me improve, and every update made the project a little better. If you’re building your first website, don’t be afraid to make mistakes—they’re one of the fastest ways to grow as a developer. 💬 What’s the biggest lesson you’ve learned while building a project?

Subscription Goldmine: SaaS Models and Startup Cash Flow Here's the brutal truth: nothing brings a tech solopreneur closer to existential dread than staring down a dried-up cash runway in the office at midnight. This concern is universal for founders, whether you're nestled in a cozy Davao home office or grinding away in a bustling city. The rise of subscription-based Software as a Service (SaaS) models is shifting this narrative, offering both solutions and new challenges. The stakes are high, but so are the potential rewards. The Core Problem & Why This Matters Startups live and die by their cash flow. Managing liquidity is crucial for keeping the lights on and securing future growth. Traditional software sales were typically characterized by large, one-time purchases. This model, while sometimes lucrative, posed significant challenges for startups that needed a steady influx of cash. The subscription model flips this on its head by transforming how revenue is recognized, providing a more predictable income stream. The consistent monthly inflows from subscriptions give startups the cushion they need to weather the ups and downs of growth periods. But here's the catch: converting users into paying subscribers isn’t a cakewalk. It requires upfront investments in product development, marketing, and customer support. Yet, this model becomes a vital lifeline, especially when venture capital isn't an option. Subscription models necessitate long-term engagement strategies, but they offer a recurring revenue stream that can stabilize an otherwise volatile cash flow. The Systems Engineering Approach Developing a subscription-based SaaS model requires a meticulous systems approach. The first step involves designing a seamless user experience . Every touchpoint must be optimized to retain users and convert trial customers into paid subscribers. From initial sign-up to daily usage, every feature should scream value. Next, focus on robust backend systems. These systems are the

What Surrounds Us takes its title literally. You play as a circle surrounding a hole in its middle - it looks like a donut with frosting. You work together with other sentient moving circles, sometimes helping them joyfully meet with others. And you traverse a large map that's composed entirely of, you guessed it, a […]

I packed these Leatherology totes with laptops, chargers, and everything else my workday demands. Months later, they’re still the bags I keep reaching for.

I Run Bare-Metal Kubernetes on $200 of Scrap Hardware (And Why I Burned 3 SD Cards...

GoPro’s New Mission 1 cameras bring action cameras to a higher level with a larger sensor and more cinematic footage.

Most journaling and mental wellness apps require syncing sensitive personal thoughts to cloud servers where they risk being mined or exposed. I wanted a space where user data never leaves the browser. So I built Sanctuary — a lightweight, local-first reflection vault. 🛠️ Technical Highlights 100% Local-First: All entries and app states stay strictly inside browser local storage. Zero tracking scripts or analytics. Resonance Diagnostics: Dynamic, client-side SVG visualizations mapping baseline mood trends over time. Therapy PDF Export: Uses native CSS print styling ( @media print ) to generate clean offline summary reports for check-ins without sharing app access. Zero Overhead: Blazing fast load times with no database or cloud sync latency. Check out the live app: sanctuaryb.lovable.app I'd love feedback from the dev community on the local storage architecture, baseline algorithms, or visual UI!

Engineers are increasingly arguing that modern LLMs can already reason through root cause analysis once given correctly prepared context, shifting the hard problem to the pipelines that correlate telemetry. A Coroot experiment across eleven models offers early evidence for the claim. By Mark Silvester

Tech companies love to sell us expensive gadgets to solve all of life's little problems. Sleepbuds sold by the likes of Anker and Ozlo are a good example. These miniature marvels of engineering sit flush in the ear, and allow side-sleepers to doze off listening to podcasts, audiobooks, music, or white noise without annoying their […]