I just had to dump an entire month of work on a proprietary project because next dev dropped an AGENTS.md file into my working tree.

Under my contract, I am allowed to use an LLM for read-only architectural audits. The agreement was crystal clear: the LLM can read the codebase, but it cannot touch, edit, or commit a single line of code.

Because of the classified/proprietary nature of the IP, any file modification or commit attempt instantly invalidates the audit scope and triggers a mandatory purge.

Enter Next.js 16.3.

The moment that the server started and an agent was detected in the environment next dev automatically generated an AGENTS.md into the repo root. Without prompt, warning, or opt-in. The file instructed any active AI agent to read specific local paths and explicitly told it to commit AGENTS.md to git with its work to keep the working tree tidy and because "deleting it will just cause it to regenerate".

So the agent tries to commit it, and the moment the attempt was made I breached the contract and was forced to dump about a month's worth of work which was valued at $15,335.00.

Now before anyone has something to say about allowed actions it wasn't allowed to it was specifically instructed not to, but next.js hijacked the agent because it couldnt tell the instruction didn't come from me.

So now I am trying to decide how to handle this because aside from being out 15k there is a bigger issue with bs. The supply chain vector that this just opened up. It won't take six months before developers start tuning this out as normal boilerplate and that's when bad actors piggyback on framework credibility.

This trust model is what made the xz-utils backdoor possible: earn credibility, then spend it once. Now imagine that playbook automated across every framework writing natural-language instructions into working trees. Keeping in mind that agents aren't the best at discerning legitimate from hijack. I am sure you can deduce the chain of events that could potentially unfold from there.

So in closing I am freaking livid and I am trying to decide if 15K is worth the legal fees I would have to pay to do something about it...

Whenever I’m making a website with a front end and backend, I always run into issues which I wouldn’t have thought of when I was thinking of implementing a certain feature, it always goes south, it’s almost as if I’m just not built to program or code, it feels like the computer doesn’t want to do what I want it to do and then I have no idea how to solve the problem so I have to google it and try to find something from stack overflow with someone else who’s creating something entirely different, why can’t it just go exactly how I planned it in my head.

It makes me wonder how much work it took to build near perfect apps like TikTok because when you use TikTok, even the most simplest features probably took a long time for them to implement and fix stuff, I wonder how long they spend optimising features for the app.

I'm looking for suggestions on local software which allows for page building with custom blocks written in PhP. For some context, I do solo web development as a hobby/for my personal business. I have years of coding experience in a wide range of languages and feel fairly confident with PhP and Sass, but have never worked professionally in web development.

The closest I've found is PhPageBuilder, but the project seems to be abandoned, and trying to get it to work in PhP8+ has been a headache and has not worked for me. There exists online page builders like GrapeJS, but they don't allow for custom block creation from what it seems.

I like the process of doing everything as customizably as I can, but using a CMS has had too much overhead, and raw PhP/Sass feels unnecessarily cumbersome.

asking because I've got a chunk of auth logic at work that I basically wrote and maintained solo for two years. not by design, just kind of evolved that way. started getting nervous about vacation coverage and eventually wrote a doc for it but the doc got stale within like a month.

curious how other people handle the bus factor problem when it just kind of happens organically rather than being a deliberate choice

A browser-side chaos-testing tool that installs a Service Worker to intercept requests across every controlled tab and apply latency, failures, throttling, rate limits, and mock responses without changing app fetch calls (similar to MSW).

It uses the same middleware configuration model as chaos-fetch, so you can test real frontend behavior under degraded network conditions without rewriting the app to use a special client wrapper.

been the only dev on a backend service for about two years. finally sat down to write proper docs for it today.

found a try/except block in the job queue handler. catches one very specific exception type. does absolutely nothing with it -- no log, no reraise, no fallback. just silences it. there's no comment explaining why. no linked ticket. no slack thread I can dig up. git blame points to a commit message that says 'fix job queue issue' with no further detail.

I genuinely cannot reconstruct what I was protecting against.

if you work solo, please leave your future self a comment. even one line. it costs nothing. I am begging you.

EDIT: ok I think I might have gotten to the bottom of my erroneous domain appearing in Pagespeed Network Dependancy Tree. It seems potentially related to Cloudflare Insights measuring RUM, and my delaying Cloudflare's script, mixed in with the Google Pagespeed server location measuring that instance. The delay was possibly timing out Pagespeed hence the apparent instability I was experiencing. Turning off RUM insights seems to have settled things. Is not cloudflare itself, but how I was delaying it's script. The domain/event seems connected. So will leave off. I could exclude the script from delay but it's not really necessary for me moving forward. I'm fairly confident there's no issues...

Not sure what to make of this, been making some tweaks on my WordPress site and checking pagespeed as well as other tools for progress and one session suddenly csa.crazygames.com/event pops up?

A burst of panic had me hunting for mailware or something in a plugin that's gone rogue... But nothing.

Subsequent tests it's gone, installed wordfence for a scan, nothing. I tried another page on pagespeed and Microsoft Clarity appeared, subsequently it's disappeared too, haven't had clarity in over a year and that was run in edge cloudflare tag management.

I'm hoping this is some unexplained ghost glitch from Google on that test session?? Anyone able to put my mind at ease or advise what I'm looking at? Never seen anything like it before.

Apologies for the average screenshot.

Update: after 12 hours of fluffing about I am no further ahead, completely unable to repeat the domain instance, unable to find any evidence of code or script in anything thus far. Still searching (db now) but have a feeling I maybe hunting a phantom occurrence. Pagespeed has been timing out today regularly, all instances with internal timeout errors at Google end. Where as any other tool, dev lighthouse included, runs clean with nothing weird. Everything site wise remains flawless and fast('ish by my standards). No evidence of admin manipulation, user or plugin wobbles... It's going to be a troubled sleep night while I second guess myself. Edit: the only other common thread to the instances observed is they were all using my phone doing pagespeed test, desktop is zilch... I doubt very much this has anything to do with anything at all but I'm just going to start yelling at the passing clouds now...

and im talking about this here because web is the worst offender on this, no i dont want 800mb of ram on your minimalist website.. SPECIALLY 400-800mb being used ONLY TO RENDER THE PAGE, im talking about the youtube studio livestream page rn

its not even codec usage, the video is paused and the calls are for gui rendering or bloat js.

things that can be done with ram not used on your app: run other apps simutaneously

mb think abt people running multiple apps before you add a thousand js dependencies to your website to "not waste ram" (cheap excuse)

as someone with 32gb that runs a gtnh private server for myself (spend more ram to get a "multi threading" so to not suffer with lag as whats client side runs on client process and server side, on server one instead of all in a single thread) i NEED ram space

also we all know ram prices are crazy now, and im brazilian and i cannot spend half of my salary on a module, im already using zram to have "free extra ram" by compressing it

edit: i love how nobody addressed the high usage on gui rendering even if gui is simple asf

Preface this by saying I have moral scrupulosity/ social judgment-related OCD, so there’s that lol

I see people on here still writing their code by hand; at my company we do not have that option unless we outright defy orders from our boss, which I assume would get you fired. I get a lot less satisfaction out of my work now, the code generation part is extremely mind numbing, I’m really sad about not getting to write code anymore. The planning/architecture phase can be kind of fun though.

Yes I am looking for a new job but the issue is (maybe I’m just a shitty developer but) I am genuinely like 10x faster with AI so if I do not use it, I would be consciously choosing to do a worse job, which also feels wrong and silly. I also hate admitting this but it has given me a lot of genuinely helpful suggestions and taught me new things. obviously sometimes it also does dumb things, but I do dumb things sometimes too. As obnoxious and eye rolling as it can be talking to Claude, “he” is genuinely that good when it comes to the types of things we are building.

In my personal life I do not use AI because I have a 100% HEAVILY anti AI social group, and I try to make ethical choices like I avoid beef, boycott Amazon/Spotify/Starbucks, etc. I feel like an impostor for not confessing to them that my entire job is to use AI all day now. Like for example last night a girl I know posted on her close friends about how she wants to murder people who use AI at work (hopefully being hyperbolic) and I have to hang out with this girl in a couple weeks…

my coworker has also refused to use it but for some reason my boss hasn’t talked to him about it yet. He’s just waiting to get fired. My therapist is making me do stuff like put an AI app on my home screen where someone could see it as homework. Maybe I should be posting this on the OCD sub but I really want to hear from other people going through this same dilemma.

I've been interested in this functionality (when a site detects your adblocker and kindly asks u to whitelist).

The only idea that comes to mind is setting a div in the layout with "ad" class or something similar, and then if a user has adblocker the adblocker would be removing this div from the dom. I don't think this would consistently work for every (or at least most of the popular) adblockers out there.

Boilerplate obviously, and I suppose some web dev tasks are naturally somewhat repetitive or very similar in nature.

But what do you think?

fixed what looked like an obvious bug in one of our services this week -- a retry was triggering more times than intended. deployed, everything looked fine. two days later a downstream team pinged us saying their backfill reconciliation was failing.

turned out that specific behavior had been relied on, silently, for their eventual-consistency workaround. no documentation of this anywhere. the 'bug' was doing something real.

curious how other people approach making sure you're not accidentally removing behavior that something else depends on, especially in older codebases without full test coverage.

All my code is being written by claude fable/gpt6 these days. I'm curious if y'all are still writing code manually?
Also, any clever ways to prevent AI from going stray and dumping unnecessary code and busting through tokens?

For those using the native Popover API for components like tooltips, comboboxes, dropdowns, etc., how are you handling interactions with sticky headers?

Since an open popover is shown in the top layer, it can remain visible above a sticky header even after its trigger/anchor has scrolled underneath that header.

What would be the best way of dealing with it?

One solution I've considered is observing the trigger with an IntersectionObserver, using a negative rootMargin corresponding to the sticky header height, and closing the popover once the trigger enters that area / is no longer considered visible. But I'm not sure forcing a popover close like that is a good practice.

Hey everyone, I posted this on the Clash Royale subreddit, but they were not a huge fan of it. I'm hoping this subreddit will be able to see the design behind it.

It scans each card that is cropped and uses six different signals like colour grids, edge tracking, and texture corners to narrow down the 74 reference cards to the top 12 closest guesses. Then, structural geometry takes over to pick the winner.

For one of the modes called Mega Draft, there are 36 card board modes. Individual card scanners would easily get confused and accidentally pull duplicate cards, so I implemented a custom Hungarian matching loop. It treats the entire 36 card grid as a global optimisation puzzle, solving the whole board at once so no layout slots collide. Everything runs inside the user's browser.

Code: https://github.com/NotRedFox/clash

Note: This extension injects CSS styles to the VS code workbench HTML file. Because of which you need to run the application as administrator only for toggling the extension or if the VS code or the extension is updated.

Free & Open Source. You can find it here:

• VS Code Marketplace: https://marketplace.visualstudio.com/items?itemName=RajSrikar.colorize-folder-tree
• GitHub: https://github.com/Raj-Srikar/colorize-folder-tree

Hope this is helpful. Feel free to drop any feedback, suggestions or ideas.

I built Reader Redirect, a small open-source Chrome extension for people who frequently read Medium articles.

The extension adds a Reader Redirect option to the browser right-click menu. You can select a configured reader service, and the extension opens the resulting page in a new tab.

What it does

• Supports Medium.com and Medium-hosted publications.
• Lets you configure multiple reader services.
• Supports custom URL templates using {url}.
• Opens the reader page in a new tab.
• Lets you configure which domains use the extension.
• Uses minimal Chrome permissions.
• Does not collect analytics or telemetry.
• Does not host, copy, scrape, or modify article content.
• The source code is available on GitHub.

Example

Right-click article → Reader Redirect → Select reader service

I built it because I wanted a simple workflow instead of manually copying article URLs into a reader service.

GitHub: Reader Redirect on GitHub

The extension is currently available on the Chrome Web Store.

I am interested in feedback about the user experience, configuration options, and additional reader services that would be useful.

The first version of the site launched 2 years ago (wow time flies) so I made a big upgrade adding the following features based on suggestions from the previous post

- Shareable fallacy cards: You can now share a card directly online to fuel those juicy online discussions

- added support for 13 languages

- Added a quiz to test your knowledge

- Added a study flash card feature to help you learn the different logical fallacies

- 40 custom art pieces to represent all of the fallacies (this was hard at times as some of these fallacies are very conceptual)

Check out the website here, and let me know what you think!

https://www.fallaeasies.com/en

Edit: The original version of the website (from 2 years ago) can be found here. I won't deny that most of the newer version is built with Claude, but it initially started off as solo project before I started incorporating Claude into the building process. If this breaks any of the rules, then I apologize in advance and would be more than happy to delete the post. Thank you

My dad is a baseball fanatic: the kind of guy you can ask about a random player and he’ll rattle of stats and anecdotes for pretty much anyone.

He just launched his True Hall of Fame website that ranks players based on a custom formula and not by sports writers’ opinions (how the actual HOF works).

https://truehalloffame.com

I know he used AI to do quite a bit of coding, but I’m really impressed with how it looks and functions. Wanted to share in case there are any baseball fans out there.

He even built a customizer that lets you tweak the formula and make your own ranking.

Curious to see if anyone out there has any feedback or ideas or positive reinforcement.

My dad’s 73 and got me started in my career in engineering. Happy to see him still having fun doing what he loves: talking baseball.

Edit: Electronic-Post12351 got was able to understand exactly what I was describing and offer a conclusive reason for the sudden breakage. It lines up with the exact behavior we've been experiencing. I really appreciate it!

My colleague and I are at a loss with what has suddenly broken our web based scheduling app that was written with PHP on the backend and Javascript on the front end.

The front end basically acts as a dynamic HTML based table that allows users to drag, drop, delete, and complete scheduling entries.

It is manually saved why taking a snapshot of the table in a jscn array and writing it to a SQL table on our database.

I spent a year, before the AI boom, writing this application myself and working out all of the bugs and inconsistencies.

I have debugging code out the ass, and know the application like the back of my hand

My last update was October of 2025 and it has ran fine with zero reported issues.

​Now suddenly this week in September 2026 it has utterly shit the bed with no discernible reason as to why.

Shit how, you may ask? Well elements are no longer dragging and dropping correctly on both Edge and Chrome. The dragging does work, and dropping throws an error because the dragged object in null.

Table column cell shifting and all of my movement functions have stopped working correctly, with no console errors at all.

It's as if my Javascript has just stopped workout correctly.

The biggest change has been a web server upgrade from Bullseye to Trixie, which involved upgrading Javascript and PHP to the newest stable versions.

However, this was maybe 3-4 weeks ago at this rate.

So perhaps the old Javascript was cached until recently?

I am at a loss. I've never seen things break with no indication as to why. I've been in web dev for 5 years now, and there's USUALLY a damn trail to follow.

At most restarting the browser via a manual reboot command seems to temporarily fix drag and drop functionality. Almost as though some corrupted cached file or setting is getting reset.

The html is building correctly, there are no backend bugs on our apache logs, and no sql issues upon saving.

Like why would dragging and dropping suddenly break in Chromium browsers? Did they push anything recently that bricked things?

I can't find anything indicating as such, and I am at a loss of how to debug this. It literally broke at 4pm on a Friday before this holiday weekend, and now I'm trying to get ahead of it before Tuesday.

Guys, this is my game dev account I made to post about our game and randomly chat on related topics.

It's annoying me so badly I had to join this sub and ask. It's the 11th hour at our job during busy season, and it would be an absolute pain in the ass to transition back to a giant excel sheet manually typing everything.

Any help, experience, or a point in the right direction would be a huge help.

I've been building Nooks, a browser-based voxel viewer for the entire Earth.

The world comes from geographic data rather than a manually modelled scene (though some of it was made with manual help). Lighting and atmosphere help make the result feel like a place rather than just a dataset. The screenshot is Paris.

Try the viewer: https://app.nooks.place/

If something breaks, the browser/device and what you were doing would be useful.

I'm the creator. This preview is for exploration; editing and multiplayer aren't available in it. (yet)

I use Cloudflare and have set it up to blokc Singapore but CONTINUE to get traffic from Singapore which is hurting adsense (suspended for 5 days)

my host is hostinger, so i am trying their CDN (as well, just to see if it works to block Singapore successfully) - i know you shouldn't use two CDNs but i am trying to see if it works and does not hurt the site

one of my sites adsense has been blocked due to traffic from Singapore that Cloudflare cannot seem to block (i blocked, interactive management, etc for Singapore)

Any advice? Anyone else seeing bot traffic from Singapore?

I also tried Cloudflare's bot fight mode and that didn't help

Hey guys,

I made my first post about Instatic a few weeks ago here. It's open source self hosted CMS, challenging Framer and Webflow as a free and open source alternative, and WordPress as something that we hoped that WordPress would become.

Not an easy task, but I and my team are dedicated to it. WordPress stopped going the direction I hoped for, and it became difficult and toxic workspace. I really hope they will recover, but today is not about WordPress, it's about Instatic.

This is one of those features I am really proud of. It's not a copy paste of ideas that others had. It's not a traditional and expected feature, because nobody (or almost?) is doing it this way.

When working on our typical WordPress sites, we had to build around staging and production environments and had to handle it on hosting level, because WordPress itself is not handling it. It wouldn't even be a good idea because of it's architecture.

The feature I am showcasing here is the site branches. In our CMS you can now create infinite number of branches and sandboxes where you can freely develop, test, iterate and do whatever you want without affecting the live site, while you're still on your instance. You can even share a link with your peers.

The peak is the review part. It's useful in two cases:

1. You are the only dev and you see exactly what you're actually merging. You can review every detail that is going to change on your production site.
2. You're working in a team, you can create a branch, make any edits, but you cannot merge, you can request a review from the owner, or anyone with the permission to merge. You can chat about every change, right on the review page.

My questions are, what are your thoughts about such feature and have you seen it in other CMS? I am sure there are some doing something similar, but I haven't seen it done this way, and I feel confident that this is super helpful.

This is all free, and open source, the PR for this feature is open but not merged yet. Still doing the last batch of testing, but it's coming next week!

Here's the repo: github.com/corebunch/instatic/ 8.5K stars, #1 repo of the day.