Report library

A self-hosted chat interface for local and hosted models.

Scheduling infrastructure — the open answer to Calendly.

Dashboards and observability — a Go backend under a big TypeScript frontend.

Product analytics, session replay and feature flags in one Django app.

A commerce backend: carts, orders, payments, plugins.

The publishing platform behind a large share of paid newsletters.

Backend-as-a-service: auth, storage, functions, databases.

A CRM written in TypeScript, aimed squarely at Salesforce.

Thousands of near-independent device integrations in one Python codebase.

Workflow automation with hundreds of third-party integrations.

Privacy-first web analytics in Elixir and Phoenix.

The Rails forum software running much of the web's community discussion.

Federated microblogging — Rails, Sidekiq and a lot of ActivityPub.

Turns an existing SQL database into a headless CMS and API.

A Java repository platform running university archives worldwide.

Surveys and in-product research, self-hosted.

Error tracking itself: a Django backend and a large React frontend in one repo.

A self-hosted Git service in Go — issues, CI and packages.

Business intelligence in Clojure — dashboards over your own database.

Self-hosted file sync and collaboration, in PHP.

An ERP suite large enough to carry its own web framework.

The database itself. Millions of lines of C, and three decades of review.

A GraphQL commerce API in Django, running real storefronts.

An ASP.NET Core storefront — the .NET end of the scale.

A headless CMS with an admin app, a plugin system and a plugin API.

The Postgres platform, as a monorepo of studio, docs and services.

TypeScript-first schema validation, no runtime dependencies.

A low-overhead Node framework with schema-driven validation.

A 118-byte ID generator that takes its randomness seriously.

A search tool written for speed and reviewed for correctness.

The minimalist Node framework, at its maintained default branch.

A fast HTTP framework in Go, in production nearly everywhere.

JSON Web Tokens in Python — small, security-sensitive, widely deployed.

The utility library much of npm still depends on.

The YAML parser most JavaScript tooling loads.

Composable command-line interfaces for Python.

The Python micro-framework, reviewed for well over a decade.

The templating engine under Flask and Ansible.

JWT, JWS, JWE and JWK for Node, browsers and edge runtimes.

The CSS transformer under Tailwind and Autoprefixer.

The HTTP library most Python code reaches for first.

Python's cryptographic primitives, with a Rust core.

Rust's serialization framework, depended on by most of crates.io.

The CLI framework under kubectl, Hugo and the Docker CLI.

Command-line argument parsing, no runtime dependencies.

OWASP's deliberately broken shop — the canonical training target.

Damn Vulnerable NodeJS Application — the Top 10, on purpose.

OWASP's Node app for learning the Top 10 by exploiting it.

Damn Vulnerable Python Web App — SQLi, XSS and CSRF by design.

A REST API broken on purpose, for API-security practice.

A Django app with planted flaws, used in security training.

A Rails app built to fail the OWASP Top 10.

A corpus of planted security defects, written to test detectors.

A research corpus of labelled, localized vulnerabilities.

The PHP app security courses have taught with for over a decade.

OWASP's scanner test suite — thousands of labelled Java cases.

An OWASP PHP target carrying planted vulnerabilities.

A Java target built for benchmarking security scanners.

Damn Small Vulnerable Web — dozens of classic flaws in one file.

Axios before 1.6.0, where the XSRF token rode along to any host the client talked to (CVE-2023-45857).

PyJWT before 2.4.0, where an ssh-formatted ed25519 public key could be used as an HMAC secret (CVE-2022-29217).

Lodash before 4.17.12 — defaultsDeep could be walked into Object.prototype (CVE-2019-10744).

minimist before 1.2.6, whose argv parser wrote straight into __proto__ (CVE-2021-44906).

node-tar before 6.1.11 — a crafted archive could poison the directory cache and write outside the root (CVE-2021-32803).

Requests before 2.31.0 — proxy credentials survived a redirect (CVE-2023-32681).

PyYAML before 5.4, where FullLoader could still be talked into building arbitrary objects (CVE-2020-14343).

A freelance management platform wearing a "Built with Bolt.new" badge.

Browser-local voice notes, built and hosted on Lovable.

A quiz builder whose README is still Lovable's default.

A self-hosted family dashboard, README: "built entirely with Claude Code".

A self-hosted learning environment, "built entirely with Claude Code".

A Japanese flashcard app. The README opens "Welcome to your Lovable project".

A game-jam tower defense the author calls a vibe-coding proof of concept.

A property search CRM on Cloudflare Workers, built with Claude Code.

The debugging utility almost every Node package pulls in.

CORS middleware for Express — small, and everywhere.

Nine files. The internet's favourite argument about small packages.

The eleven lines that briefly broke npm in 2016.

Concurrency limiting in a few dozen lines.

String to URL slug. One job.