YPYash Panchalinnitroide.hashnode.dev·2d ago · 4 min readThe postMessage Sanitizer: A Recipe for Anyone Building iframe ToolsWhen I security-audited NitroIDE for the v25 release, the worst hole I found wasn't in the iframe sandbox. It was in the trust my own parent page placed in its own iframe. NitroIDE is a browser IDE wh00
YPYash Panchalinnitroide.hashnode.dev·6d ago · 5 min readI Deleted My Share Backend and Replaced It With a URLEvery "share" feature you've ever used is really three servers in a trench coat: a database to store the thing, an auth system to gate it, and an API to move it around. When I set out to add code shar00
YPYash Panchalinnitroide.hashnode.dev·Sep 26 · 6 min readThe 0ms Preview: How NitroIDE Renders Your Code Instantly With srcdoc + postMessage (No Bundler)Open CodeSandbox and the preview pipeline looks like this: keystroke → websocket → cloud container → bundler → HMR diff → back to your tab. Every hop adds milliseconds, and a cold container adds secon00
YPYash Panchalinnitroide.hashnode.dev·Sep 25 · 5 min readNitroIDE v25: I Security-Audited My Own Browser IDE — Here's Everything That ChangedThere's an exercise every developer should run on their own project at least once: attack it like you hate it. I build NitroIDE — a browser-based IDE where your code never leaves your machine. No serv00
TTw93inhitw93.hashnode.dev·Sep 8 · 18 min readFrom Mole CLI to Mole for Mac: What I LearnedLately I've piled up a lot of thoughts on indie development and wanted to pull them together, so this is the story of taking Mole from an open source CLI to a paid Mac app. What I was thinking at the 11H
SWShi Warreninwslabs.hashnode.dev·Aug 28 · 5 min readI Built the Same “Modify” Feature Twice. The User Contract Was Completely Different.When I first added a “Modify” feature to my tattoo product, I assumed the interaction pattern would be reusable. Both workflows looked similar on the surface: generate an image keep the result descri00
JSJules Sarahinjulessarah.hashnode.dev·Aug 27 · 6 min readHow to Find 12 Testers for Google Play Closed TestingIf you opened a personal Google Play developer account after November 2023, you cannot publish to production until twelve testers have been opted into a closed test for fourteen continuous days. Findi00
CSChandravardhan Singhinthecvs.hashnode.dev·Aug 27 · 7 min readI Thought Building the iOS App Was the Hard Part I thought finishing the app would be the hard part. It wasn't. Building ReturnPing took plenty of time, but at least development felt predictable. Something breaks, I fix it. A screen feels wrong, I r00
IIrvinginirving-builds.hashnode.dev·Aug 12 · 7 min readI Built an AI Website in 3 Hours. It Got 562 Sign-Ups in 8 Hours—and Left Me More Lost.This is a true story from eight months ago. One night around 9 p.m., I noticed a search term beginning to spike on Google Trends. It looked like people were starting to search for something new—and th00
CCrispininbitshovel.hashnode.dev·Jul 23 · 4 min readFour Signals I Check Before Trusting an Indie Product PageThis essay uses BitShovel as a practical context for the four signals below. When I find an unfamiliar product, the feature list is rarely the missing piece. Landing pages are good at telling me wha00
