🛠️ All DevTools

[Other] Sandbox: Run untrusted AI code safely, fast

[Other] Show HN: I open-sourced my Go and Next B2B SaaS Starter (deploy anywhere, MIT) Hi HN, I&#x27;m Mohammed, a technical founder who loves shipping and giving back to the community. I&#x27;m open-sourcing the full-stack engine that powers my B2B product, apflow.co.<p>What it is: A production B2B starter with a Go backend and Next.js frontend. Both are fully Dockerized with separate containers. No Vercel. No Supabase. Deploy the whole thing on a $6 VPS, or split frontend and backend across different providers. You own the infrastructure.<p>The problem I was solving:<p>Every SaaS starter I evaluated had the same issue: they locked me into someone else&#x27;s platform. Vercel for hosting. PlanetScale for the database. Serverless functions billing per invocation. Fine for prototypes, but costs become unpredictable at scale and migrating away is painful.<p>I wanted something I could deploy on any Linux box with docker-compose up. Something where I could host the frontend on Cloudflare Pages and the backend on a Hetzner VPS if I wanted. No vendor-specific APIs buried in my code.<p>Why Go for the backend:<p>Go gives me exactly what I need for a SaaS backend:<p>Tiny footprint. The backend idles at ~50MB RAM. On a cheap VPS, that headroom lets me run more services without upgrading. Concurrency without complexity. Billing webhooks, file uploads, and AI calls run concurrently without callback hell. Compile-time type safety. Using SQLC, my SQL compiles to type-safe Go. If the query is wrong, it fails at build time, not in production. Predictable performance. No garbage collection pauses that surprise you under load. The architecture (Modular Monolith):<p>I didn&#x27;t want microservices complexity for a small team, but I needed clean separation. I built a Modular Monolith: features like Auth, Billing, and AI are isolated Go modules with explicit interfaces, but they deploy as a single binary.<p>This structure also made AI coding tools (Cursor, Claude Code) dramatically more effective. Because every module has strict boundaries, the AI knows exactly where new code belongs and doesn&#x27;t break other modules.<p>Full-stack, not just backend:<p>Backend: Go 1.25 + Gin + SQLC (type-safe SQL, no ORM) + PostgreSQL with pgvector Frontend: Next.js 16 + React 19 + Tailwind + shadcn&#x2F;ui Communication: The frontend consumes a clean REST API. You can swap Next.js for any framework that speaks HTTP. Infrastructure: Separate Dockerfiles for frontend and backend. Deploy together or apart. What&#x27;s pre-built:<p>The boring infrastructure is solved so you can focus on your actual product:<p>Auth + RBAC: Stytch B2B integration with Organizations, Teams, and Roles. Multi-tenant data isolation enforced at the query level. Billing: Polar.sh as Merchant of Record. Handles subscriptions, invoices, and global tax&#x2F;VAT. No Stripe webhook edge cases. AI Pipeline: OpenAI RAG using pgvector. The retrieval service enforces strict context boundaries to minimize hallucinations. OCR: Mistral integration for document extraction. File Storage: Cloudflare R2 integration. Each feature is a separate module. Don&#x27;t need OCR? Remove it. Want Stripe instead of Polar? The billing interface is abstracted.<p>Real-world proof:<p>This isn&#x27;t a template I made for GitHub stars. It&#x27;s the exact code running apflow.co in production. When I added document OCR, I built it as a new module without touching Auth or Billing. The architecture held.<p>How to try it:<p>Clone the repo, read setup.md to check the prerequisite, run .&#x2F;setup.sh, and you have a working B2B environment locally in minutes.<p>Feedback I want:<p>I&#x27;d appreciate feedback from Go developers on the module boundaries and cross-module interfaces. Also curious if anyone has suggestions for the Docker setup in production deployments.<p>GitHub: <a href="https:&#x2F;&#x2F;github.com&#x2F;moasq&#x2F;production-saas-starter" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;moasq&#x2F;production-saas-starter</a><p>Live: <a href="https:&#x2F;&#x2F;apflow.co" rel="nofollow">https:&#x2F;&#x2F;apflow.co</a>

[Other] Making web security accessible, automated, and actionable At zdelab, we believe that security shouldn't be a barrier to building great web applications. Our mission is to democratize web security by providing automated, comprehensive security diagnostics that anyone can understand and act upon. We're committed to helping developers, businesses, and organizations protect their web applications from common security vulnerabilities, ensuring a safer internet for everyone.

[Other] A faster path to container images in Bazel

[Database] Show HN: Spice Cayenne – SQL acceleration built on Vortex Hi HN, we’re Luke and Phillip, and we’re building Spice.ai OSS - a lightweight, portable data and AI engine and powered by Apache DataFusion &amp; Ballista for SQL query, hybrid-search, and LLM-inference across disaggregated-storage used by enterprises like Barracuda Networks and Twilio.<p>We first introduced Spice [1] on HN in 2021 and re-launched it on HN [2] in 2024 re-built from the ground up in Rust.<p>Spice includes the concept of a Data Accelerator [3], which is a way to materialize data from disparate sources, such as other databases, in embedded databases like SQLite and DuckDB.<p>Today we’re excited to announce a new Ducklake-inspired Data Accelerator built on Vortex [3], a highly performant, extensible columnar data format that claims 100x faster random access, 10-20x faster scans, 5x faster writes with a similar compression ratio vs. Apache Parquet.<p>In our tests with Spice, Vortex performs faster than DuckDB with a third of the memory usage, and is much more scalable (multi-file). For real-world deployments, we see the DuckDB Data Accelerator often capping out around 1TB, but Spice Cayenne can do Petabyte-scale.<p>You can read about it at <a href="https:&#x2F;&#x2F;spice.ai&#x2F;blog" rel="nofollow">https:&#x2F;&#x2F;spice.ai&#x2F;blog</a> and in the Spice OSS release notes [4].<p>This is just the first version, and we’d love to get your feedback!<p>GitHub: <a href="https:&#x2F;&#x2F;github.com&#x2F;spiceai&#x2F;spiceai" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;spiceai&#x2F;spiceai</a><p>[1] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=28448887">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=28448887</a> [2] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=39854584">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=39854584</a> [3] <a href="https:&#x2F;&#x2F;github.com&#x2F;vortex-data&#x2F;vortex" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;vortex-data&#x2F;vortex</a> [4] <a href="https:&#x2F;&#x2F;spiceai.org&#x2F;blog&#x2F;releases&#x2F;v1.9.0" rel="nofollow">https:&#x2F;&#x2F;spiceai.org&#x2F;blog&#x2F;releases&#x2F;v1.9.0</a>

[Other] Show HN: TinyPDF – 3KB PDF library (70x smaller than jsPDF) I needed to generate invoices in a Node.js app. jsPDF is 229KB. I only needed text, rectangles, lines, and JPEG images.<p><pre><code> So I wrote tinypdf: &lt;400 lines of TypeScript, zero dependencies, 3.3KB minified+gzipped. What it does: - Text (Helvetica, colors, alignment) - Rectangles and lines - JPEG images - Multiple pages, custom sizes What it doesn&#x27;t do: - Custom fonts, PNG&#x2F;SVG, forms, encryption, HTML-to-PDF That&#x27;s it. The 95% use case for invoices, receipts, reports, tickets, and labels. GitHub: https:&#x2F;&#x2F;github.com&#x2F;Lulzx&#x2F;tinypdf npm: npm install tinypdf</code></pre>

[Other] Scaling Go Testing with Contract and Scenario Mocks

[Other] Show HN: Git rewind – your Git year in review I started an experiment to let a WASM-powered webapp interact with a local git repo and see how well this works. It turns out, it works pretty well!<p>I made it into a &quot;git wrapped&quot; tool that shows you when you committed the most, and what languages and files you most touched.<p>Despite the scary prompt when you use the filesystem API everything happens locally and your code stays private. (You can of course also just try it on cloned public github repos).<p>Let me know what you think!

[CLI Tool] Show HN: Toad. A unified terminal UI for coding agents Hi HN,<p>Up to the middle of 2025, I was the CEO&#x2F;CTO of a startup called Textualize. Somehow I had managed to land seed funding for my Python libraries for fancy terminal output. We wrapped up after three years because the funding ran dry.<p>I honestly thought I was sick of coding at that point. But it turns out I was sick of the stress and working all hours. A few weeks rest was all I needed.<p>It was about that time that coding agents exploded, and I could no longer ignore them. I wasn&#x27;t impressed with the UI these tools offered. Having worked in the terminal for a few years, I knew you could get a better user experience. And so this project was born.<p>I had planned to create some kind of layer between the agent&#x27;s SDK and the front-end. Fortunately after I started building this, Zed Industries released Agent Client Protocol (<a href="https:&#x2F;&#x2F;agentclientprotocol.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;agentclientprotocol.com&#x2F;</a>). Which was precisely what I needed.<p>I&#x27;ve just released the code (It was a private repo for a while). Toad (a play on Textual Code) can run a large number of AI agents, which a nicer terminal UI.<p>Think of it as a &quot;bring your own agent&quot; coding CLI. Use whatever agent you want. I&#x27;m not trying to sell you tokens.<p>Ask me anything. I&#x27;ll be hanging around for a while, if this post takes off.

[IDE/Editor] Show HN: Composify – Open-Source Visual Editor / Server-Driven UI for React Everyone&#x27;s shipping AI tools right now, and here I am with a visual editor. Still, I think many teams are very familiar with the problem of &quot;marketing wants to change the landing page again.&quot;<p>I&#x27;ve run into this for years. Campaign pages come in, engineers get pulled in, and tickets stack up. It&#x27;s usually the same components, just rearranged.<p>A few years ago, at a startup I worked at, we built an internal tool to deal with this. You register your existing React components, they show up as drag-and-drop blocks, and the result is a JSX string. No schema to learn, no changes to your component code.<p>We used it in production, handling real traffic in a messy, legacy-heavy environment. It held up well. Over time, it powered roughly 60% of our traffic. Marketing shipped pages without filing tickets, and product teams ran layout-level A&#x2F;B tests. That experience eventually led me to clean it up and open-source it.<p>Composify sits somewhere between a no-code page builder and a headless CMS. Page builders like Wix or Squarespace offer drag-and-drop, but lock you into their components. There are also solid tools like Builder.io, Puck, and Storyblok, but many require you to adapt your components to their model. Composify is intentionally minimal: it lets you use your actual production components as they are.<p>It&#x27;s still early. The docs need work, and there are rough edges. But it&#x27;s running in production and has solved a real problem for us. If you already have a component library and want non-devs to compose pages from it, it might be useful.<p>Homepage: <a href="https:&#x2F;&#x2F;composify.js.org" rel="nofollow">https:&#x2F;&#x2F;composify.js.org</a><p>Happy to answer questions or hear feedback!

[Other] Your job is to deliver code you have proven to work

[API/SDK] Show HN: Python SDK – forecasting with foundation time-series and tabular models We’ve built a Python SDK for running inference on foundation models designed for time-series and tabular data. They are new SOTA models for time-series and tabular tasks and work out of the box. They do not require model training or feature engineering. The link to the GitHub repository is: <a href="https:&#x2F;&#x2F;github.com&#x2F;S-FM&#x2F;faim-python-client" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;S-FM&#x2F;faim-python-client</a>

[Other] Microsoft kills IntelliCode in favor of the paid Copilot

[Other] GitHub Actions for Self-Hosted Runners Price Increase Postponed

[API/SDK] Auto-localization to 165 languages using AI, context-aware AI-powered localization for developers. Translate i18n files in 165 languages while preserving format, keys, and placeholders—no post-editing needed. Free plan. Developer-friendly with Open API, SDK, CLI, GitHub Action, and plugins. A clean UI for localization teams plus a Figma plugin for design translation. Faster and more affordable than traditional services.

[IDE/Editor] Understand code instantly — through visuals, not words. Codur is an AI-powered VS Code extension that turns code into simple visuals and explanations — helping developers understand, debug, and onboard faster. Early access now.

[IDE/Editor] Visual mind maps, DB & JSON tools for Python code Every developer knows the pain of exploring an unfamiliar codebase—endless scrolling, manual tracing, scattered tools. DoraCodeLens brings clarity by turning Python projects into interactive visual mind maps inside VS Code–supported IDEs. It visualizes modules, classes, and functions with complexity scores, generates DB diagrams from ORM models, detects frameworks, adds inline code lens insights, Git analytics, and handy JSON tools—all in one fast workspace.

[Other] Protect your websites in minutes, not days SecureNow is a SaaS platform that automatically scans your web applications for security vulnerabilities, SSL issues, and performance problems. Get detailed reports with actionable fix instructions - no security jargon, just clear explanations. Key Features: 🔍 Automated Scanning - Check for vulnerabilities, SSL certs, open ports, rate limiting 📊 Dashboard Overview 📖 Plain-English Reports 🎯 Framework Support ⏰ Scheduled Scans

[API/SDK] Show HN: DocsRouter – The OpenRouter for OCR and Vision Models Most products that touch PDFs or images quietly rebuild the same thing: a hacked-together “router” that picks which OCR&#x2F;vision API to call, normalizes the responses, and prays the bill is sane at the end of the month.<p>DocsRouter is that layer as a product: one stable API that talks to multiple OCR engines and vision LLMs, lets you route per document based on cost&#x2F;quality&#x2F;latency, and gives you normalized outputs (text, tables, fields) so your app doesn’t care which provider was used.<p>It’s meant for teams doing serious stuff with documents: invoices&#x2F;receipts, contracts, payroll, medical&#x2F;admin forms, logistics docs, etc., who are either stuck on “the OCR we picked years ago” or are overwhelmed by the churn of new vision models.<p>Right now you get a REST API, simple SDKs (coming soon), a few pluggable backends (classic OCR + newer vision models), some basic routing policies, and a playground where you can upload a doc and compare outputs side by side.<p>I’d love feedback from HN on two things:<p>1- If you already juggle multiple OCR&#x2F;vision providers, what does your homegrown router look like, and what would you need to trust an external one?<p>2 - Would you prefer this or use the LLM&#x2F;OCR providers directly, with the possibility of changing the provider every so often?<p>Demo and docs are here: <a href="https:&#x2F;&#x2F;docsrouter.com" rel="nofollow">https:&#x2F;&#x2F;docsrouter.com</a>

[Other] Security vulnerability found in Rust Linux kernel code