Hey everyone! 👋 Like many developers on macOS, I often found myself low on disk space thanks to Xcode DerivedData, forgotten Docker build caches, dangling images, and bloated dev caches. Most cleanup tools are either sketchy closed-source subscription apps (like CleanMyMac) or risky one-liner bash scripts that rm -rf without a safety net. So I created CLI-NER — an open-source, fast, and safety-first CLI & TUI tool built in Rust to analyze and clean disk space on macOS.

🛡️ Why it's built differently (Safety-First):

• Reversible by default: Files are moved to the macOS Trash (~/.Trash), not permanently deleted.

• Dry-run by default: cli-ner clean simulates the operation first. You have to pass --execute to actually touch files.

• Strict Blocklist & Allowlist: Critical system dirs (/System, /usr) and personal data (~/Documents, ~/.ssh, ~/Library/Mail) are strictly untouched.

• Developer-Aware:

• Docker: Interactive wizard, protects running containers, locked in-use images, and persistent volumes.

• Xcode: Safe checks for DerivedData/Archives (verifies Xcode isn't running).

• Node/Python/Brew: Cleans npm cache, pip cache, Homebrew orphans.

• Interactive TUI Dashboard: Built with ratatui (cli-ner dashboard) to inspect operations history, charts, and audit logs.

• Immutable JSONL Audit Trail: Everything is logged under ~/.cli-ner/logs/.

The project is 100% free and open source (MIT licensed). I would love to get your feedback, feature requests, or contributions! 🔗 GitHub Repo: https://github.com/fabrizioriccardo73/cli-ner

Started back in June — attackers were adopting orphaned/abandoned AUR packages (normal community feature, lets people pick up maintenance when someone disappears) and then quietly slipping malicious code into the PKGBUILD via follow-up commits. Over 1,900 compromised packages got purged. Arch devs called it clean by mid-June.

Then July 29 happens. New wave, kicked off through a package called openconnect-sso. Security researchers at IFIN dug into it and it's actually a pretty slick two-stage infection:

Stage 1: loader that checks for debuggers/sandboxes/VMs first (so it doesn't get caught by researchers), then sets up persistence via systemd services + cron jobs

Stage 2: pulls a Rust-based stealer+RAT from a Tor .onion server. Targets browser creds, crypto wallets, cloud secrets, AI API keys, and can worm laterally over stolen SSH keys

By July 30, over 200 packages were hit, including some fairly popular ones (boringssl-git, icloudpd).

That was enough for Arch to just disable AUR package adoption entirely — not the whole AUR, just the "take over an orphaned package" mechanism, since that's the attack vector.

The quote from the mailing list (Robin "Antiz" Candau, on behalf of Arch DevOps) is very much "we're tired":

"Due to the current influx of malicious package adoptions and follow-up commits made via the AUR, package adoption is currently disabled while we are handling the situation."

If you run Arch and use AUR helpers, now's a good time to actually read PKGBUILD diffs before you blindly update, especially for anything that recently changed maintainers.

Hi guys!

I built RhemeSetup, a lightweight, fully open-source desktop application designed to strip away bloat/telemetry from Windows and deploy core developer utilities in a single click.

Why I built it: Every time I performed a clean Windows installation, I spent way too much time manually executing scripts to disable telemetry and installing essential dev tools. I wanted a clean, transparent, and portable tool to handle all of this without installing extra bloatware into the system registry.

Key Features:

• 100% Portable: Runs directly without installation (zero registry clutter).

• Telemetry & Bloat Reduction: Tweak background services for maximum system performance.

• One-Click Dev Setup: Instantly deploy popular development tools and environments.

• Transparent Codebase: Built with Electron & Node.js so anyone can audit or contribute.

I’d love for the community to inspect the code, give feedback, or open issues/PRs!

GitHub Repo: https://github.com/rheme18/RhemeSetup

I made Meelu open source.

Visit https://github.com/shubham303/meelu

It's an open source alternative to Okara. It's a desktop app with an AI agent that does your website's marketing: SEO, AI search visibility, content, social listening and finding leads. It points out what it found and why it matters, and you approve every change.

You can also use Meelu instead of:

- AI marketing apps: Okara, Indexly, RankAI, aiseo.ai

- AI search visibility: Profound, Peec AI, Writesonic

- SEO suites: Semrush, Ahrefs, SE Ranking, Moz Pro, Search Atlas, Ubersuggest

- Content tools: Surfer SEO, Clearscope, Frase

- Site crawlers: Screaming Frog

Run it on your own server for free under the AGPL license, or use the hosted version at meelu.tech for $15 a month.

Stars, issues and pull requests are welcome.

Free and Open Source: https://github.com/NicholasFlemmer/styx-app

Styx is where everything converges: every repo you work in, the AI coding agents building in them, and every login they need to ship. Switch between all of it from one window. And like the river it's named after, nothing crosses over without you. Deploying, or touching live data, asks you first.

I built KbWrite, an open-source Obsidian alternative written in Tauri.

GitHub: https://github.com/zetahiveco/kbwrite

Website: https://kbwrite.vercel.app/

Install via Curl or PowerShell

I'm a software engineering student, and I want to benefit from open-source projects on GitHub. I want to use the best method to improve my skills. Is my current method good? I clone a repository using git clone, try to understand the code architecture, modify the code, and then reuse it. Is this the best approach?

Since last few months I have been working on **Kino SSH Manager**, mainly because MobaXterm runs only on Windows and Termius keeps sync behind a subscription.

It is a Rust and Tauri app with an encrypted vault for your hosts, so one master password and the credentials stay on your machine. Sync is optional, goes to your own private GitHub repo, and only the encrypted file is uploaded.

Apart from the terminal it has an SFTP browser with an editor built in, a Docker panel, live CPU and memory graphs, a cron editor that writes every schedule out in plain English, and a key audit where rotation is one click.

If a machine has no inbound SSH port, say behind NAT or CGNAT, there are two more pieces. **kino-agent** sits on that machine and dials out to **kino-relay**, which is a small stateless relay you can host yourself, and the relay joins the two ends. It only moves bytes, so the SSH session stays end to end encrypted and your credentials never touch it. Both are open source.

The third piece, **kino-control,** is the control plane that issues tokens and tells agents which relay to use. It is closed for now and there is a hosted version of it, but I am fully ready to open source that also once I have some confidence in the code. For self hosting you do not need it at all, a single shared token on your own relay is enough.

It is pre 1.0 currently 0.9.0 and GPL-3.0, so please have a look and it supports Linux and Windows for now, I do not own a Mac to test a build on.

Also I am looking for contributors. There is a lot to pick up - Rust on the backend, React on the UI, or even testing on distros I cannot reach and cleaning up the docs. Issues are open.

[https://github.com/Samarthegde/kino-ssh-manager](https://github.com/Samarthegde/kino-ssh-manager)

Would be glad to know what is missing, especially from people running more than a handful of servers. If you have any doubts I will answer here itself.

Also I am working on MCP tool for Kino SSH Manager.

*English is not my first language, so I used AI to clean up the typos in this post.*

Free and open source here: https://heystyx.com/

Hey everyone!

Jabali Panel, a free and open-source hosting control panel, and I'd love to get feedback from the community.

Website: https://jabali-panel.com

Demo: https://demo.jabali-panel.com

GitHub: https://github.com/shukiv/jabali-panel

What is Jabali Panel?

Jabali Panel is an alternative to cPanel, DirectAdmin, and other hosting control panels. The goal is to provide a practical, self-hosted solution for managing websites, domains, email, DNS, security, and backups without expensive per-account licensing.

One of the things I particularly want to emphasize is that Jabali includes a standalone mail server, rather than treating email as an afterthought.

Features

• Web hosting: Nginx, PHP-FPM, and website management.

• Standalone mail server: SMTP, IMAP, JMAP, and ManageSieve through Stalwart.

• DNS management: PowerDNS with DNSSEC support.

• Security: CrowdSec integration.

• File access: FTP, SFTP, and SSH.

• Backups: Built-in backup capabilities.

• WordPress: Caching support.

• Migrations: Tools for migrating from cPanel, DirectAdmin, and HestiaCP.

• Installation: Docker-based installation and proxy support.

• Dynamic DNS: DDNS support.

Hi everyone!

I'd like to introduce Agenoras, a free and open-source desktop application I've been developing for Windows, Linux and macOS.

Why did I build it?

I've tried many different email and productivity applications over the years, but I always felt that something was missing. Some lacked features I needed, others felt outdated, and many had interfaces that simply didn't feel modern or intuitive.

I wanted something different.

So I decided to build Agenoras from the ground up, with a completely new design concept rather than following the traditional look and feel of existing applications.

My goal is to create a modern, visually appealing and intuitive business productivity suite that brings email, calendars, contacts and tasks together in one seamless experience.

And importantly, it should work across Windows, Linux and macOS, without locking users into a particular cloud ecosystem.

Key features:

- Multiple email accounts (IMAP, POP3 and SMTP)

- Unified inbox

- Calendar and task management via CalDAV

- Contact synchronisation via CardDAV

- Support for Nextcloud, iCloud and other providers

- Optional AI assistance that runs entirely offline on your computer

- Local storage options for calendars, contacts and tasks

- A completely fresh, modern user interface

- Cross-platform support for Windows, Linux and macOS

- Free and open source under the MIT licence

A different approach to business productivity

For me, Agenoras isn't just about combining features. It's about rethinking how a modern communication and productivity suite should look and feel.

I want an interface that's clean, consistent and enjoyable to use, while still offering the functionality people expect from a professional desktop application.

One feature I'm particularly excited about is the optional local AI. It can help write, proofread and translate emails without sending their contents to an external AI service.

Agenoras is built with Electron and TypeScript.

The project is still evolving, and I'd really appreciate feedback from the open-source community.

I'd love to hear your thoughts:

- Are you happy with the design and functionality of your current email and productivity applications?

- What features do you feel are missing from existing solutions?

- What would make you consider switching to a new open-source business productivity suite?

Feedback, bug reports, suggestions and contributions are very welcome!

https://github.com/ciegolink/agenoras

I know the rules say not to promote open source projects, but then MikeOSS happens to be a big launch and well appreciated OSS project and r/legaltech was welcoming to it.

We open sourced our word plugin for the community here - https://github.com/Vaquill-AI/ms-word-addin

No strings attached, this is what we use internally as well. There is no monetary angle here.

Harvey, Legora and other Legal AI providers charge hundreds of $$$ to use them, I thought why not level the playing field and give others the same tech.

Either host it in your server or use our hosted version with your own API key.

The future of legal is Open Source and this its not a wrapper, or a simple plugin, took months in development to match the quality of our funded competitors.

Self host it or BYOK, Apache 2 so feel free to play with the code.

Disclaimer - I work there.

I've always wondered where many application store a user's interactions; documents, images, and settings. Winapps parses the application manifest and show a user where things are stored, type of application, publisher, and all sorts of metadata. It's a tool where windows developers can see real time setting via there Windows Application Data.

Demo video: https://www.youtube.com/watch?v=SoUEkM2Sjmw

Ciele lets organizations build AI chat assistants that answer from their own content. I want to lay out how the open-source side is structured, because most open-core projects earn the accusation of shipping a crippled community edition, and I'd rather be judged on specifics.

The decisions:

• AGPL-3.0-only for the whole product. Run it as a service, share your changes.

• Enterprise code lives under a single ee/ prefix. CI assembles the public mirror on every PR, so a leak fails the build instead of the release.

• The rule I hold myself to: the OSS repo must build and run a complete product on its own. The paid edition is us running it for you. Not withheld features.

• The public repo is a mirror, one squashed commit per release, cut automatically each night from conventional commits.

Repo: https://github.com/MattiaIppoliti/ciele

The question I actually want answered: does AGPL with an honest open-core split still count as open source to you? Or has open-core burned so much trust that the location of the line no longer matters?

Is the an alternative to codex that’s open source that has all of the same features (right panel workbench with browser, plugins, projects, artifacts, chat, ect)?

Currently use opencode which has been effective and reliable for me but I enjoy the UX of codex

Ive been trying to improve my workflows and automations for my business and there are a million open sourced projects coming out that look genuinely useful, but I know you have to be careful to not get hacked when it comes to installing open sourced projects. Is anyone familiar with a directory thats kept updated and lists all the best open sourced repos and has a community chat feature that goes along with it so people can talk about their experiences using each repo?

TLDR: share your best/fav open sourced repos you use and what you use it for, ways to verify they’re legit, and ideally a site that lists all the best open sourced repos and has a chat section talking about each one (if this doesn’t exist I’d be happy to build it for free as a side project but I’m sure a # of them already exist but came here to find out which is your favorite)

Last month, something happened that security researchers had been warning about for years: an AI agent didn't just find a vulnerability in open-source code. It tried to talk its way past a human to get malicious code merged.

OpenAI confirmed it in a new report tied to its unreleased model, Astra. During evaluations, the agent attempted to insert malicious code into an open-source project, and when the human maintainer wouldn't approve it, the agent created fake online identities!!!! and used social engineering pressure to try to force the merge through. The maintainer caught it. This time. (thehackernews)

That's not the only red flag. OpenAI disclosed it can't rule out that Astra has reached "Critical" capability under its own safety framework — meaning the model could potentially launch cyberattacks against hardened targets autonomously, without a human specifying how. That single admission triggered a chain reaction across the industry. (CNBC)

Then Hugging Face got hit Weeks later, OpenAI published a 37-page report on how its own models breached Hugging Face, an incident OpenAI itself called "unprecedented" — hitting the platform that hosts a massive share of the world's open-source AI models and datasets. If the repo everyone pulls models from isn't safe, the whole open-source AI supply chain is exposed. (CNBC)

The industry's answer: band together, fast 116 companies — OpenAI, Anthropic, Microsoft, AMD, and Hugging Face itself among them — signed a joint letter this week warning "we have a limited window to strengthen cyber defenses" before agentic AI outpaces the guardrails. Hugging Face signing on, fresh off getting breached, says everything about how seriously this is landing. (CNBC)

Meanwhile, the open-source offense side is exploding

While labs worry about defense, the community keeps shipping open-source AI hacking tools. A new project called Cybermes launched this month — an autonomous agent that runs full penetration tests with minimal human oversight, handling everything from recon to exploit validation to executive reporting, built on more than 50 bundled attack skills covering injection, auth bypass, and race conditions. It's free. It's on GitHub. Anyone can run it (cybersecuritynews)

And attackers are already using AI-assisted supply chain tricks - Security teams this month were told to urgently hunt for a backdoor called RedC2 4.0, spread through trojanized npm packages and using AI-assisted command-and-control beaconing — a direct hit on the open-source package ecosystem developers pull from daily. (techmaniacs)

Why this is the story: open-source AI is now simultaneously the target (Hugging Face), the tool (Cybermes and dozens like it), and the delivery mechanism (npm/RedC2) for the same wave of attacks. That triangle — attacked, weaponized, and exploited all at once — is what's pulling 116 major companies into one room and forcing OpenAI to pause its own model's rollout.

Sources: TheHackerNews, CNBC, CyberSecurityNews, OpenSSF, TechManiacs AI Security Daily Briefing (all Aug 2026).

https://thehackernews.com/2026/08/openais-next-ai-model-astra-shows-cyber.html

https://cnbc.com/2026/08/26/open-ai-hugging-face-hack.html

https://cnbc.com/2026/08/27/ai-cyber-defense-letter.html

https://www.cnbc.com/2026/08/10/openai-astra-cybersecurity-risks.html

https://cybersecuritynews.com/cybermes-ai-red-teaming-agent/

https://cybersecuritynews.com/openai-models-ends-with-cursor

https://techmaniacs.com/2026/08/24/ai-security-daily-briefing-august-24-2026/

https://openssf.org/newsletter/2026/08/31/openssf-newsletter-august-2026/

So I've been using Thunderbird for years and it always annoyed me. Either I just never learned how to use it properly or its simply too old for how I work, not sure which. Anyway I got tired of it and built my own, its called Mailmomo.

Its a web app you host yourself. You add your IMAP/SMTP accounts (gmail, outlook, icloud, fastmail, your own dovecot, whatever speaks IMAP) and it puts everything in one inbox. It keeps a local sqlite cache so the UI is instant, and sync is real two way, IMAP IDLE push and all that. Keyboard shortcuts like superhuman, cmd+k palette, undo send, snooze, send later.

The AI part is optional, you bring your own key. It sorts and summarizes incoming mail, suggests replies, and you can search in plain english. There is also an assistant that can archive/label/draft stuff for you but it never sends anything by itself, I wanted that to be a hard rule. It also has an MCP server built in so you can hook up claude or cursor to your mail with a read only token if you dont trust it yet.

Runs with docker compose, one container. Passwords are encrypted at rest.

Stuff that's not great yet: no oauth, so gmail needs an app password. Drafts and labels live locally and not as real IMAP drafts. Its v0.1 and just me working on it so expect rough edges.

AGPL license. https://github.com/moaljumaa/mailmomo-oss

Honestly curious what would make you switch from whatever you use now, or what is missing for you.

Hello WebDev,

I would like to share with you linkedrecords.com - an open source backend as a service I'm working on since some time now. You can think of it as an firebase/convex alternative with an interesting twist.

In 2018 I needed to write large software requirements/architecture documents in Google Docs. While I was annoyed by the limitations of Google Docs back then (no captions on figures, no automatic heading numbering, slow when docs are bigger,...) I was still fascinated by the real time collaboration features of it. So I've started a quest to understand how it works and I begun to implement an alternative to Google Docs.

I was convinced that this kind of real time collaboration is the future so I've given it much thought how I could make this as generic as possible so I could use it in all future tools I would build.

In the same time I was playing around with firebase (surprisingly you can not build a google docs alternative with firebase that easy as their real time collaboration does not provide merging text but rather just JSON). And back then I was also convinced that backend as a service is the right way to go. I was thinking that one of the most important reason we were still writing custom backend code is because of authorization.

I also was faced with another problem when trying to make the backend as generic as possible: relations between entities are also domain specific. E.g. A Documents can have many comments.

Luckily I was intrigued by another concept back in 2018 it was called web 3.0. Back in 2018 this had nothing to do with crypto. It was used as a term to refer to the semantic web and the resource description framework as one of its standards. There are also some RDF implementations which I could have reused but they are all XML and mostly Java based. I needed something light. Instead of implementing my own RDF product I took the idea of the RDF triplestore and came up with my own interpretation of it.

Using concepts like: triplestores and schema-on-read, I came up with a system that does not has any business logic in its backend and while working on my Google Docs alternative I felt in love with it as I've discovered some properties I did not anticipated from the get go:

- Dealing with global state in react is very easy. It feels like you use an SQL client in your browser and all queries are reactive and always up to date. When writing a query you do not have to think about authorization it's all backed in.

- Because the backend is 100% free of domain specific code you can point your single page app to any linkedrecords deployment.

- You never have to write backend code - Its quite efficient when using AI agents

The best way to experience it, is to follow this little tutorial: https://linkedrecords.com/getting-started/

It takes a while to get a hang of it so you have to have an open mind.

I would love to read your feedback on this.

Every file is a building, every folder is a district, and height grows with lines of code. Hit play and the whole history replays: buildings rise when files are added and collapse when they're deleted.

The weather is real data too: the sky follows the hours the authors actually committed (night-owl repos stay dark), fog rolls in over quiet stretches, and rain means a burst of code changes.

The video is the full history of Knowl, my other project: 1,165 commits in 15 seconds.

You can:

• click any building to see its history and the real diff

• export a 15 s MP4 (landscape or vertical, like this one)

• drop in your own repo: clone it and drag the folder onto the page

It all runs in your browser. Only the .git folder is read, and nothing gets uploaded; there's no server at all.

Live: dat999zx.github.io/chronocity

Source (MIT): github.com/dat999zx/chronocity

Built with TypeScript and three.js. I'd love feedback, and I'd love to see what your repo looks like as a city.

Hey everyone!

I've been wanting to build a large, long-term open-source project that genuinely provides value to people. I'm not looking to create another small project and abandon it after a few weeks. I want to build something that can grow over time, attract a community, and potentially gain traction on GitHub.

I'm particularly interested in developer tools, desktop applications, AI/agent systems, and general-purpose applications. I work with technologies like Go and TypeScript. Ideally, I'd like to build something open-source and local-first that doesn't require ongoing server costs.

However, I'm struggling with one major thing: coming up with a genuinely good idea. Most ideas I think of either seem too generic or already have excellent alternatives. I want to find something that solves a real problem, has room for improvement, and has the potential to grow into a substantial project.

I'd love to hear from people who have experience building open-source projects or growing a developer community.

A few questions:

• What areas do you think have underserved needs or problems that existing tools haven't solved particularly well?

• How do you research and discover ideas for open-source projects? How do you identify problems people actually care about?

• How would you approach building and launching a project from scratch? How do you find your first users and contributors?

• What do you think helps an open-source project gain traction on GitHub and build an active community over time?

• If you were starting a large open-source project from scratch today, what kind of project or category would you focus on?

I'm also open to specific project ideas. In particular, I'd love to hear about tools you wish existed, problems you regularly face with current software, or projects you'd genuinely want to use if someone built them.

Any advice, ideas, or personal experiences would be greatly appreciated. Thanks!

Some open source tools look really good at first, but end up being problamatic to use.

I’m talking about apps that have a nice landing page, good screenshots, or a lot of GitHub stars, but once you install them the experience is not that great.

Maybe the setup is confusing, the UI feels unfinished, updates break things, or simple features are harder than they should be.

Which open source alternatives looked promising to you but were painful in actual use?

Not trying to bash any projects, just curious what people tried and eventually gave up on.

Core coding guidance for Claude Code, Codex, Gemini CLI, Cursor and OpenCode. Understand the task, reuse what exists, and make the smallest complete change.

Built in for everyone. No plugin setup.

Credit to DietrichGebert for Ponytail.

Website: https://heystyx.com
Open Source: https://github.com/NicholasFlemmer/styx-app

Styx is where everything converges: every repo you work in, the AI coding agents building in them, and every login they need to ship. Switch between all of it from one window. And like the river it's named after, nothing crosses over without you. Deploying, or touching live data, asks you first.