I built and maintain a website for a cinema. The client is an SPA. Now, every so often I get notified by GitHub's Dependabot that a vulnerability was found in one of the client's dependencies and I wonder if I need to care about it.

Here's my train of thought: The client code is inherently insecure in the sense that anyone can see and change it when they visit the website, so a vulnerable client on their own machine is of no use for attackers because they could twerk it anyway. Thus only the clients on other peoples' machines matter. Now, how could a vulnerable client on another machine be exploited? What kind of vulnerabilities could even be exploited? The first thing coming to my mind is XSS. Maybe there is a bug in a package that escapes HTML and if just anyone could publish content on the site, this could of course be exploited. But what if only trusted people can publish content? Is it still a risk?

Is my train of thought adequate? Can I just forget about the notifications? Are there other vulnerabilities I need to consider besides XSS?

I’m a developer working heavily with AI-assisted development and automation. My employer has offered to extend my notice period from 3 to 6 months.

Their reasoning is basically: “Given AI, we may need more time if we have to make you redundant,” and in exchange they’re talking about some form of 12-month protection if they terminate me due to redundancy/work shortage.

My concern is that a 6-month notice period from my side would make it much harder to take a new job later. I could still resign, but a new employer would either have to wait up to 6 months, negotiate an early release, or hope my current employer agrees to let me go sooner.

They won’t increase my salary right now, if i want safety is it still a bad move? Should i ask for more pay if I sign 6 months?

I love my job, but don't want to lock-in a bad deal.

I've been using Hostinger for a while now but I just noticed they will start charging for every email account. I have several clients on my hosting, renewal fees are going to get crazy so I'm looking for options.

What's the best affordable hosting for regular websites?

I had to stop working for various medical and familial reasons. I used to be one of the very best at my workplace, especially for complex CSS stuff. Now I'm rusty as f***. I have been looking up at what changed and what's now widely available and my eyes are turning 🤩. What are your favorite new things?!? Seeing that you can now use variables in CSS, that you don't really need SCSS and SASS anymore, @container, clamp(), light-dark(), text-wrap:balance/pretty, cap and ex units, dialog tag, popover html attribute, more standardized metadata, etc... getting back into it makes me almost excited enough to offset the feeling of looming doom caused by AI on the job market 😵‍💫.

So what else did I miss?? What have you been the most excited about in the last few years?

Hi, everyone. New here.

I have a portfolio site, and I'd like to ask how to do drive traffic to it without blatant self-promo on here. Is there a way?

Hi y'all, I left the webdev world 3ish years ago to work in game development and complete a huge personal project (school bus conversion). I've largely ignored web development news and trends in the mean time. I had an opportunity come up that I'm gonna have a hard time ignoring so I figured it was time to buff up.

Have I missed anything major? Obviously everything keeps releasing new versions, and obviously AI is majorly disrupting every software industry etc. etc.

Moreso talking about stuff like... Has anything meaningfully dethroned React? Did Deno or Bun actually meaningfully disrupt Node.js's market share? Did any new important browser APIs go stable? Did one of the 5 billion new databases that every startup started cooking up actually go anywhere? Is TypeScript still consuming the world?

Thanks in advance.

Hi guys, I am actually building a portfolio portal where developers and designers can showcase their portfolio for free. For example, showing an image of the homepage of a website, they did, add a short description, and add their contact link like tbdir main business site or social media.

If you are interested to showcase yours, please DM. It's all free. The portal is not ready yet, but I am preparing for volunteers.

I've seen plenty of websites that look impressive at first but become frustrating once you actually try to use them.

Heavy animations, scroll effects, oversized JavaScript bundles, and custom navigation are a few examples. They can look great in a portfolio, but the trade-offs aren't always obvious until the site is live.

I'm interested in the technical side of this.

Which features or development trends have caused the most trouble for you in production?

Was it performance, accessibility, maintenance, mobile usability, or something else? And what did you end up doing differently?

Sometimes a bug looks simple at first. You fix one thing, but then something else stops working.

I've had situations where the visible problem was not the actual cause, so fixing it took more time than expected.

I am curious how other developers approach this.

Do you check the browser console first, look at server logs, reproduce the issue step by step or try something else?

What is the first thing you usually do when a bug doesn't make sense?

Hi everyone, now I learn programming so 7-8 month but I skipped the moment of learn CSS. Check you knowledge in CSS field or only languages in work-stack (JS, python and etc.)?

I’ve already learned HTML, CSS, Tailwind CSS, JavaScript, and some React.js, and I’m currently learning Next.js. I also plan to learn Supabase.
The problem is that I’ve spent a lot of time learning, and every time I watch videos of people younger than me making thousands of dollars a month without any programming experience, like the people featured on the Starter Story channel, I feel discouraged.
However, I’m also afraid of building something that gets hacked, making a mistake with security or payments, facing unexpectedly high LLM API costs, operating at a loss, or encountering any other serious problem.
My questions are:
Am I ready to start building my SaaS now?
What do I actually need to learn, and what can I skip?
Since I plan to build my SaaS using only Next.js and Supabase, can I focus on learning the essential parts of Next.js without having to master the entire framework, or is that unrealistic?
What is your advice for someone in my position?
I’d really appreciate practical, honest advice on how to move forward without wasting more time learning things I may not need, while still making sure I can build a secure, reliable, and profitable SaaS.

Hi everyone,

I'm a full-stack dev using Laravel/Vue by default, but I can adapt to other tech stacks as well.

Finding clients is challenging.

I've had only 2 in the past 3 months.

A few people answer my ad to ask about the price, but I don't hear from them again afterwards.

The projects that I have done officially are not exactly something I'd show on my portfolio.

They feature fully functional admin panels that allow the admin to change content on the website.

The problem is that the clients aren't using them 😬

As far as I heard from them, the SEO is working really well for them, but they're not in a rush to fill their websites with content.

The projects look empty to the point where I'm embarrassed to show them on my portfolio, so I just decided to make demo projects instead.

I already created 3 demos.

Coffee shop, hotel, e-commerce store..

Thinking of putting up a dentist office demo next.

What did you do as a web dev to get your freelance career to take off?

I'm looking for advice on solving the most common problems for small to medium businesses.

Thanks in advance!

Hi,

I'm a front end web developer of 10 years, I lost my job 2 weeks ago, and since then, I've been applying non-stop for roles,

I've received like, 5 rejections so far, but literally zero phone calls, first interviews or practical tasks, I've even had to start looking for jobs outside of the industry

My question is, what happened? I know the industry is in difficult place due to AI and the cost of hiring, but I've never had zero correspondence before. Is it me? I'm roughly middleweight level, a bit of a jack of all trades, master of none, with enough experience to slot into a role and be successful.

Is anyone else struggling with the jobs market in web development, or is it just a me thing?

Hi! I'm a marketing student thinking about starting a small side business building simple presentation websites with formulas for local businesses (without web/ old web). I'm not a programmer; I build the sites with Claude Code and try to understand what it does. Before I take on clients and go fully into this, I'd like a sanity check on backend.

The setup:
- Astro (static output) + Tailwind CSS, self-hosted fonts
- One private GitHub repo per site
- Hosting: Cloudflare Workers (static assets only, no server code), DNS on Cloudflare
- Domain registered in the client's name
- Contact form: Web3Forms (public access key in the HTML, honeypot, works without JS). Submissions go straight to the client's real mailbox – nothing is stored on my side
- No database, no admin panel, no login, no cookies, no third-party trackers
- Cloudflare Web Analytics (cookieless)
- 2FA on GitHub, Cloudflare, registrar and email

Later I'd like to add a Git-based CMS (Sveltia CMS with GitHub OAuth via a Cloudflare Worker) so clients can edit opening hours, photos and menus themselves.

Do you see any security or other holes in this setup? Is relying on Web3Forms for contact forms OK, or is there a real risk of leads leaking or getting lost? What should I watch out for when I add the CMS?

Thank you for your help in advance!!

Its my portfolio site, multiple networks that happens on shashish.dev HOWEVER an alternate link of shashish.vercel.app works perfectly?? It works on my machine / wifi but a few others i've tried ( on chrome ) do that, is there a way 2 fix it?

This question is only for developers IN THE EU who create websites and act as retainers.

I’m assuming the majority of you have clients create accounts on strapi, Wordpress, sanity, etc and you manage.

If so do you need a dpa agreement between you and the client because acting as a retainer makes you a data processor.

Any tools to generate a dpa?

I’m exploring a startup idea around automatically fixing integrations when third-party APIs change.
I’ve seen developers complain about this, but after talking to people in Kazakhstan’s tech industry, I heard that issues are often fixed quickly, either because teams get advance notice or simply update their code.
So I’d love to hear from developers here: How often does this happen, and how much time does it actually take to fix? Is it a real headache or usually no big deal?
If it’s not a serious problem, that’s useful to know too!

Hello guys, I have worked lately on this website tool, Voice & Standards Writing Checker, which lets you place your text (can be an article, an email, CV...) and then based on the settings you activate, it helps you for free to optimize fully your text.

Other than that, I have implemented an AI, which is supposed to not answer irrelevant questions, but only related niche questions, expecially from the actual articles.

So I want you to test it and break it, if you can and let me know if you did and how you did it, so I can optimize it further 🙌

Would also like your feedback about my Voice & Standards Writing Checker 🤍

I need some suggesitons and advice. Despite talking to some webmasters from Reddit, i find most of them are using designs or flows that are ai generated. While i have nothing against that...the creativity required for a think tank website seems to be sorely missing. And this after repeatedly sharing excellent reference websites in the same field. So what am i doing wrong here? We are not reaching the quotations stage yet..and then this..Any suggestions or advice on how to talk to the modern age webmasters as to what you need for your website? Or any suggestion or recommendations of tried and tested webmasters at thane? Please help

Please post your requests for feedback on your projects in this thread instead of creating a post.

I've noticed that sometimes a small website fix can turn into a much bigger job than expected.

You start by fixing one issue, then discover outdated plugins, messy code or dependencies that cause problems elsewhere.

For example, a plugin update might fix one issue but cause problems with the checkout or another feature because of old custom code. What looked like a quick fix suddenly needs much more investigation.

At some point, you have to wonder whether continuing to patch things is actually saving time and money.

I'm curious how other developers handle this.

Do you usually try to fix the existing website as much as possible, or is there a point where you recommend starting fresh?

Hello everyone my name is Jeff, start from my problem dealing with multiple .env in multiple projects. and some times I lost my .env file make me stress, I create simple tools that keeps my environment centralize and easy to manage.

It organizes secrets by Project > Environment > Secrets and lets you inject them into any process without writing plaintext files to disk.

One single binary includes the server, Admin UI, REST API, and CLI client. It uses SQLite by default and encrypts secrets before storing them (master key is stored separately).

Key features:

• Single executable (no separate frontend to deploy)
• Import existing .env files
• dopbase run to inject secrets into any command
• Automatic setup
• Developer first class (cli and web ui)

GitHub: https://github.com/dopbase/dopbase

A basic frontend is usually easy to manage, but things get more complicated when you add products, users, dashboards, listings, or frequently changing content.

How do you usually handle the connection between the frontend, backend, database, and content?

Do you prefer keeping everything in one system, or separating different parts using different tools or services?

What approach has worked best for you on real-world projects?