... people shipping with Lovable, Bolt, v0 or Cursor. Building fast is the whole point, but the same few problems keep showing up on freshly shipped apps when you look at them from the outside: admin or debug routes left reachable, API endpoints that return another user's data if you change an ID in the URL, Supabase or Firebase tables readable without logging in, and API keys sitting in the frontend JavaScript. None of these need a hacker to find ...

... oddly specific tool you ve built with AI that you still use? Tell me what it does and what you used to do before you had it. Comment from Aleksandr Kubarskii(@al_kub): @spilstudios  sounds cool, is it reachable? would like to check Comment from Matheus Paranhos(@matheus_paranhos1): Interesting POV! I've been through this a lot lately, little scripts and internal tools that started because I got tired of copying the same things between places. What ... ... think people will keep these tools private, or will some become proper products? Comment from Bryan Spileers(@spilstudios): @new_user___1132024007e8749605c4bb9  I misread the title! I didn't see the 'that only you use' part. It's reachable

... here is the most embarrassing thing we found last week. Our 11-page wedding template has eleven pages that all render correctly and all sit in the sitemap - and the header links to three of them. Six pages were reachable only by typing the URL. Every page passed review individually, so nobody caught that the graph connecting them was broken. If you build multi-page templates, crawl your own site from the homepage and diff the result against your sitemap ...

... absence would stop the product doing one of its functions. If your app is a thin client over your API, that API is not a separate service you can wave at. It's part of the product. This product-versus-service line is the genuinely contested bit, and I'm reading the Commission's guidance and a pile of law firm notes rather than a court ruling. I'm a founder, not a lawyer. If you're near the boundary ... ... market, not a "product with digital elements") than to the thin-client case. I'd hold that loosely though. Everything I've read from the Commission and ENISA keeps coming back to "placed on the market as a product vs

... Partly a test: it walks every file that starts with "use server" and fails CI if any of them exports the 2 functions that take a user as an argument. Those are the ones that must never be reachable from outside, so they're pinned by name. But, the weak spot is that it only knows the names I gave it. A brand new helper with a userId parameter goes straight past it. For those it's review: after ...

... Your network has things on it that never say a word. A printer asleep. A camera that only ever talks to its own cloud. A Pi you set up in March and forgot. They are powered on and perfectly reachable, and until now Netfox could not show them to you not because it was hard, but because everything it knew came from whatever announces itself, or whatever has already spoken to your Mac. Sweep a range, and it asks each ...

... Apple's own support pages. Apple In-App Purchase: 26%, or 15% if you're in the Small Business Program, the Mini Apps or Video Partner Programs, or on an auto-renewable subscription after the subscriber's first year. Alternative payment processing inside your app: 20%, or 10% for those same groups. Out-of-app offers with an actionable link: a 15% store services commission, or 10% for those groups, on anything bought within 7 days of the tap. Apps ... ... distributed outside the App Store entirely - an alternative

... information that piles up over time - project notes, a work or personal journal, meeting decisions, code snippets, study notes. Plain files in folders on your Mac, no account, no sync service, no database. Shipped since launch Projects are reachable straight from the main sidebar instead of buried in Prefs Search improvements: much faster, and title matches now outrank body matches Internal links between notes with K The in-app docs are now mirrored on the website, generated straight from ... ... same way Text zoom in the editor, with shortcuts YouTube embeds that render inline but stay plain Markdown macOS Sequoia 15 or later. Screenshots and a demo video: https://muse23.com/apps/minknote/ If you've made this call yourself, trial versus

... existing review and merge process. Shared workspaces, fine-grained permissions, centralized audit and fuller automatic orchestration remain planned. Remote access lets a phone or another computer reconnect to the running Windows workbench. Cross-network access can use a reachable self-hosted HTTPS relay; the desktop must stay on and connected. Agent processes remain on that host. Termexo is MIT-licensed. Agent CLIs and model services require their own setup. Local-first does not mean model requests never leave the computer ...

... Linux, macOS and Windows, plus containers; the Termexo desktop app is for Windows 10/11 x64. v2 session traffic uses AES-256-GCM after an authenticated handshake. Relay login and the desktop token are independent access checks. You need a reachable HTTPS relay and a desktop that stays on with Termexo connected. What would you use this for first: checking a long-running agent, answering its next question, or continuing from another computer? Release: https://github.com/gemron/Termex... Self-host the relay ...

... identical to board cards Followers and social icons on every card Up to three audiences per seller Featured now scrolls past three picks A lid with two sales in 12h is featured automatically Unpaid-Stripe lids off the board, reachable by link only THE DASHBOARD: Re-design: - Two tabs: Overview and Content, with a live preview of the page - Stat tiles: sold, net, views, days left Logos to approve at the top, with a count in the header Waiting logos ...

... af67bf41b28): Three host issue caught my attention. I usually think of sign in pages as simple routes, so loading separate fonts, CSS and unused JavaScript feels like an easy thing to miss. Do you now check every stranger reachable route automatically ...

... file picker and a progress bar, which is exactly the kind of layout that folds badly. I am not rebuilding for a phone almost nobody owns yet. I am just checking that the one button you actually need stays reachable at any width. Comment from Bastien Renard(@bastienrenard): That third layout thought hit too me. In practice inner screen behaves like a small iPad so autolayout saves you. I would still check your onboarding illustrations now. What would break first ...

... what's new: https://netfox.app Would love to hear what you want to see next. Comment from Giovambattista Fazioli(@gfazioli): @adams_parker  yeeeah, and the split has a weak spot worth knowing: it needs a reachable reference host past the router... when that's unreachable you get the first hop on its own rather than an invented total - less satisfying, but imo a missing half beats a made-up one Comment from Giovambattista Fazioli(@gfazioli): @alira_salu  should ... ... most like to see either way Comment from Adams Parker(@adams_parker): @gfazioli   That is actually a good approach. Knowing the first hop on its own is still useful, especially when the next reference host is not reachable

... which subreddits gate on this. It seems to be entirely at each mod team's discretion and none of them publish the threshold. Has anyone mapped this, or found a cleaner way to tell whether a community is actually reachable before you spend a fortnight talking to nobody? Comment from Gal Dayan(@galdayan): the r/phcareers trick is clever but you already found its limit - it tells you your score, not whether a specific sub will actually let you through ...

... niche or even still active. You end up wasting hours filtering noise before you can even start outreach. Retrolien tries to fix that: - Filter opportunities by niche, country, and link type - Live-check whether a submission URL is actually reachable before you invest time - See free/paid status, dofollow attributes, and login requirements upfront - Export a clean, focused shortlist to PDF or CSV It also includes a free technical SEO audit (titles, headings, indexability) and Search Console insights. It's completely ...

... audited my own navigation this week and found the same destination reachable under three different names. In a banner near the top it's a hard technical label. In the footer it's warm and studio-ish. In the header it's the word people expect when there's an account involved. None of that was a decision. Each one got written in the context of the page it sits on, months apart, and each is arguably right where ...

... coverage report is the concrete thing I'm taking from this. Different cadence, different granularity, and I'd have kept staring at coverage waiting for it to say something it structurally can't say. The absent-from-your-logs versus 5xx-in-your-logs split is the better half though, because it doesn't depend on anyone's report being honest about why. Absence is the signal, which is a strange thing to have to instrument for. On generating ugly ... ... designs a monitor around this. I went and checked the docs: zone Logpush is Enterprise only, and the availability table lists Free, Pro and Business all as No. There's a carve-out where Workers Trace Events Logpush is reachable

... line is the one to act on. That one came from a reader in this very thread on the 0.27.0 launch, who noticed a +1 could sit above a +4. The detail I enjoyed getting right: reachability and power travel in opposite directions along a chain. Whatever can start the caller reaches everything it calls, however deep. But power doesn't accumulate GitHub only ever lets a called workflow reduce what it was handed, so a workflow asking for contents ... ... sharper framing than anything in my own release notes, and it generalises well past workflows. It does compose past two hops, because it isn't pair analysis every workflow on a branch goes into one set and reachability

... finding. My own release workflow asks for contents:write and reads two secrets, and it is correct it fires on a tag push, so only someone who can already push tags can reach it. What scores is power reachable from untrusted input: a pull_request_target workflow holding your secrets, or a self-hosted runner an outsider's pull request can actually target. Scoring power by itself would flag a large share of GitHub and teach everyone to ignore ... ... reach it are people who could already push tags. if that scored, a big chunk of github lights up and everyone learns to ignore the axis inside a week. so the rule became: capability isn't a finding, capability reachable

... listening ports, split into the ones only it can reach and the ones the network can Only on this Mac bound to loopback. Nothing else on your network can reach them. Dev servers, database engines, helper tools. Reachable from the network anything on your Wi-Fi can connect. Usually intended. Occasionally a surprise. And names instead of numbers. 3000 tells you nothing. shop.local:3000 tells you which project it is. If your hosts file has names pointing at a listener, they ... ... that way: The Ports tab on a network device, grouped by category Also fixed: a closed port now says closed. A port that actively refuses a connection was being reported as filtered and those mean different things. Nothing listening, versus

... makes the interface harder to trust, so I m working with more explicit states: Fresh data when the latest update arrives on time Cached data when the last validated result is still useful Delayed data when the source is reachable but has not updated Unavailable data when there is nothing safe to display The current design also tries to keep the last readable content visible instead of clearing the entire page because one API request failed. A news request should ...

... didn't nominate a VPN, a filter, a manual entry an extra row says so. The rest of your network is still using what it was given. The Network panel on the Overview How well is each device really reachable? Every device now has a Link quality panel: the round trip from your Mac, how steady it is, how often it doesn't answer at all, and a chart of the day. Link quality on a device: latency, variability, packet ...

... thing? Comment from Arnold Oshenye(@oshylabs): Thread views, and it took two rejected posts to work out why. I posted two threads on the same day in July. Both were rejected. Neither told me at the time. They stayed reachable at their URLs and rendered completely, so they looked entirely published. The only difference was that they never entered the feed, so they sat near zero views. For a while I read those numbers as nobody cared. Wrong read ...

... read-only metrics endpoint, so your own monitoring can scrape your network. Handy and, it turns out, far too easy to leave wide open. Switch on "allow access from other devices" without setting a token and that endpoint was reachable from anywhere on your network with no authentication at all . What it serves is your entire device inventory: every IP, every MAC address, every hostname, every open port. That's fixed, and it's the kind ...