Gallery
Workspaces people published. Open one to read how it works — every block, every line of code — then fork it into your own account and run it.
Being forked
What people are taking into their own accounts.
Watch a page for changes
A cron that fetches pages, strips the noise, compares a hash against last time, and says nothing at all unless something really moved.
1 fork APIPassword sign-in done properly
PBKDF2 with a per-user salt, a constant-time check that costs the same for an unknown account, rate limits on both the address and the caller, and sessions stored as hashes.
DataCRUD API over your own Postgres
A REST resource over a database you already have. Parameterised queries throughout, credentials only ever as a vault handle, honest status codes.
Real-timeLive status page
A page that updates itself without polling. One held-open request per viewer, a full state published on every change, correct after a reconnect.
SiteLanding page with a contact form
A real page on its own domain, plus the endpoint behind its form: rate limit, honeypot, validation, and an inbox you can read back.
APIAPI behind a JWT you did not issue
Auth0, Entra, Cognito or your own issuer in front of an endpoint: signature and claims verified against a JWKS, scope checked separately, rows scoped to the proved subject.
WebhookStripe webhook to Slack
Verifies the signature against the raw body, keeps the events worth reading, posts them to a channel. The signing secret never touches the code.
DataForm submissions to a downloadable CSV
Collects submissions and hands them back as a file a spreadsheet opens correctly: stable columns, a BOM so accents survive Excel, and no formula injection.
DataFeature flags with percentage rollout
Flags evaluated server-side so a rollout needs no deploy, bucketed by a stable hash so nobody sees a feature flicker, written with compare-and-swap.
AutomationDaily digest email
A weekday cron that reads a time window out of the store, groups it, and emails a digest — or stays quiet when nothing happened.
APICached API proxy with a rate limit
Put your own endpoint in front of somebody else’s API: a fixed-window rate limit in one call, a cache that also remembers misses, and an honest 502.
WebhookGitHub webhook router
Verifies the HMAC against the raw body, drops duplicate deliveries, and turns the handful of events worth reading into one line each.
Just published
The newest arrivals.
URL shortener
Three endpoints and a key-value store. Mints unguessable codes, refuses to become an open redirect, counts follows atomically.
WebhookStripe webhook to Slack
Verifies the signature against the raw body, keeps the events worth reading, posts them to a channel. The signing secret never touches the code.
APIPassword sign-in done properly
PBKDF2 with a per-user salt, a constant-time check that costs the same for an unknown account, rate limits on both the address and the caller, and sessions stored as hashes.
AutomationWatch a page for changes
A cron that fetches pages, strips the noise, compares a hash against last time, and says nothing at all unless something really moved.
1 fork DataCRUD API over your own Postgres
A REST resource over a database you already have. Parameterised queries throughout, credentials only ever as a vault handle, honest status codes.
Real-timeLive status page
A page that updates itself without polling. One held-open request per viewer, a full state published on every change, correct after a reconnect.
SiteLanding page with a contact form
A real page on its own domain, plus the endpoint behind its form: rate limit, honeypot, validation, and an inbox you can read back.
APIAPI behind a JWT you did not issue
Auth0, Entra, Cognito or your own issuer in front of an endpoint: signature and claims verified against a JWKS, scope checked separately, rows scoped to the proved subject.
WebhookGitHub webhook router
Verifies the HMAC against the raw body, drops duplicate deliveries, and turns the handful of events worth reading into one line each.
DataForm submissions to a downloadable CSV
Collects submissions and hands them back as a file a spreadsheet opens correctly: stable columns, a BOM so accents survive Excel, and no formula injection.
DataFeature flags with percentage rollout
Flags evaluated server-side so a rollout needs no deploy, bucketed by a stable hash so nobody sees a feature flicker, written with compare-and-swap.
AutomationDaily digest email
A weekday cron that reads a time window out of the store, groups it, and emails a digest — or stays quiet when nothing happened.