DEV Community: Seif Ahmed

You loved my markdown previewer, so I’m giving it a major upgrade.

Seif Ahmed — Fri, 14 Aug 2026 08:07:34 +0000

Building a smooth, lovely experience isn’t just about rich text rendering—it’s about ensuring the database layer under the hood is as fast, flexible, and bulletproof as possible.

Here is a full breakdown of the core backend updates implemented in this release, covering everything from atomic database operations to user-customizable UI settings.

1. Migrating from Manual Rollbacks to Native MongoDB Transactions

The Problem

Previously, deleting a save relied on sequential async operations:

Delete the save document from the database.
Decrement the user's savesCount counter by 1.
Remove the associated share link if one existed.

This execution flow introduced serious data integrity flaws:

Unexpected Crashes: If the Node.js process or server crashed mid-execution (for example, right after step 1), orphan data was left behind, permanently corrupting database consistency.
State Mismatches: If a lookup for a save returned null, the system would still blindly decrement savesCount, leading to negative or incorrect counter states.

The Solution

Instead of attempting fragile, manual rollbacks inside application-level try/catch blocks, it now relies entirely on native MongoDB transactions via mongoose.startSession() and session.withTransaction().

By wrapping our operations—deleting from schemas.Saves, updating schemas.Users, and removing linked records from schemas.Links—inside a single transaction block passing { session }, MongoDB guarantees absolute ACID compliance. If any step fails or an explicit error is thrown (like SAVE_DELETE_FAILED or USER_UPDATE_FAILED), MongoDB automatically aborts the transaction and rolls back every write operation atomically.

Key Architectural Decisions:

Atomic Safeguards: Adding savesCount: { $gt: 0 } directly inside the atomic query condition acts as an absolute guardrail at the database layer, preventing a user's save count from ever dipping below zero under any edge case.
Error-Driven Rollbacks: Throwing inside session.withTransaction() naturally passes control to the enclosing catch block, which immediately aborts the session without requiring manual flag tracking like failed = true.

2. Dynamic Patching for Flexible Save Updates

The Problem

Updating a save was previously locked behind strict schema requirements. Users were forced to submit both title and content on every single edit request.

This pattern created zero flexibility: if a user wanted to quick-edit just the content body, the client application was forced to fetch and re-pass the existing title, introducing unnecessary network overhead and strict coupling.

The Solution

I shifted from rigid validation to a dynamic patch object pattern.

When a payload hits /api/v1/update/save/:id, the controller initializes an empty updateObject = {}. Each field (content, title, and color) is length-validated independently. If a field exists on req.body, it gets appended to updateObject; if it doesn't, the execution flow simply moves on.

Finally, we execute a single schemas.Saves.updateOne() using the $set: updateObject operator. By pairing this with { runValidators: true }, Mongoose validates only the specific fields being modified while ignoring omitted keys entirely.

3. Schema-Enforced Color Selection

The Problem

Allowing users to customize the card background color for individual saves creates a great visual experience, but it opens an immediate security and design vector: How do you prevent malicious actors or API requests from injecting arbitrary strings or broken non-hex values into the UI?

Relying on manual validation checks like colorsArray.includes(color) can be tricky—if an attacker sends a string like "hello #f8f9fa", a loose string check might pass, persisting bad data to your storage engine.

The Solution

Instead of writing defensive JavaScript code before the database write, we shift schema integrity to the ORM level using Mongoose schema enum constraints.

By defining enum: ["#f8f9fa", "#c5d9ec", "#83e6b5", "#ee9595"] directly inside the Mongoose schema definition and enforcing { runValidators: true } during update queries, MongoDB guarantees exact matching. Any attempt to pass an unauthorized color string is rejected automatically before hitting the collection.

If you liked my 🎁, please consider giving it a star on GitHub! It means the 🌍 to me!

[Boost]

Seif Ahmed — Tue, 11 Aug 2026 12:04:19 +0000

Seif Ahmed

Aug 4

I made a gift for you: A clean, lightweight Markdown Previewer

#showdev #github #opensource #webdev

1 min read

Goodbye React Fatigue: How I Built a Social Network Using ONLY My Own Library

Seif Ahmed — Mon, 10 Aug 2026 18:46:29 +0000

I got tired of heavy modern frameworks, so I wrote my own jQuery alternative called NanoScript.

To see if it actually worked, I used it to build a whole social network called Vlox.

Read the technical breakdown here: https://dev.to/codemaster_121482/can-my-dom-library-build-a-real-working-social-media-app-4ic7

The app is live too. It’s running on a free container tier, so give it a few seconds to wake up if needed: https://vlox.containers.snapdeploy.app/ or https://vlox.bonto.run

Fellow devs, let me know what you think.

[Boost]

Seif Ahmed — Mon, 10 Aug 2026 18:02:14 +0000

Seif Ahmed

Aug 4

I made a gift for you: A clean, lightweight Markdown Previewer

#showdev #github #opensource #webdev

1 min read

Building a password-protected link sharing workflow

Seif Ahmed — Sun, 09 Aug 2026 14:01:05 +0000

Ever wondered how to build a clean, secure system for sharing user content via unique links? It gets interesting when you have to separate public access from password-protected private shares.

Here is a breakdown of how the frontend and backend interact to extract IDs, enforce security via bcrypt, and protect against brute-force attacks with rate-limiting:

How It Works

URL Activation: A user opens the link http://localhost:3000/?id=POST_ID.
ID Extraction: The frontend parses the URL and extracts the ID using URLSearchParams.
Request Initiation: If an ID is present, the frontend requests data from /api/v1/get/save-from-link/:id.
Backend Verification: The backend checks if the ID exists in the database.
Public Access: If the link is public, the backend returns the content (link.for.content).
Private Access: If the link is private, the backend responds with a success signal and need_password: true without sending any content.
Frontend Evaluation: The frontend checks the need_password flag.
Content Display: If false, it renders the public content.
Password Prompt: If true, a popup prompts the user to enter a password.
Rate Limiting: Users get 10 password attempts per 7 minutes across all private saves globally.
Password Validation: The frontend sends the ID and password to /api/v1/validate-save-password/:id.
Security Match: The backend queries the ID ensuring status: "private", then verifies the password using await bcrypt.compare(password, link.password).

The Code

// In server.js
app.get("/api/v1/get/save-from-link/:id", checkValidID, async (req, res) => {
  try {
    const id = req.params.id;
    const link = await schemas.Links.findOne({ for: id }).populate("for").lean(); // Do you have permissions to see this doc?
    if (!link) return res.status(400).json({ error: "Invalid link!" });
    if (link.status === "private") return res.status(400).json({ success: true, need_password: true }); // Send a success singal, but warns that a password must be entered
    return res.status(200).json({ success: true, content: link.for.content });
  } catch (e) {
    console.log("Error: " + e.message);
    return res.status(500).json({ error: "Server error" });
  }
});

// In actions.js
router.post("/api/v1/validate-save-password/:id", validatePasswordRateLimiter, checkAuth, checkValidID, async (req, res) => {
  try {
    const id = req.params.id;
    const { password } = req.body;
    if (typeof password !== "string") return res.status(400).json({ error: "Password must be a type of string!" });
    if (!password) return res.status(400).json({ error: "You didn't enter a password!" }); // Find link
    const link = await schemas.Links.findOne({ for: id, status: "private" }).populate("for").lean(); // Check password match
    const isMatch = await bcrypt.compare(password, link.password);
    if (!isMatch) return res.status(400).json({ error: "Invalid password. Do you want to try again?", invalid_password: true });
    return res.status(200).json({ success: true, content: link.for.content });
  } catch (e) {
    console.log("Error: " + e.message);
    return res.status(400).json({ error: "Server error" });
  }
});

Liked the project? Please consider giving it a star on GitHub at https://github.com/Hfs2024/Markdown-Previewer

Building a Bulletproof Comment Reply System in Node.js & MongoDB 🚀

Seif Ahmed — Sat, 08 Aug 2026 18:17:49 +0000

When building a nested reply system, most developers worry about deep tree complexity or messy data structures. For Vlox, I took a different approach: keeping things flat, fast, and secure by reusing a single Mongoose schema with smart atomic limits.

Here is a deep dive into how I engineered a production-ready, race-condition-safe reply mechanism using MongoDB transactions, strict type sanitization, and automated limits.

How It Works 🛠️

User Action: A user clicks the reply icon and submits their reply.
The Payload: Vlox's system sends 3 fields via the endpoint /api/v1/reply/comment/post/:id:
- id: The post ID (passed as a URL parameter).
- rootCommentId: The ID of the root comment being replied to.
- reply: The raw text entered by the user.
Sanitization & Validation: The incoming reply is instantly converted to a trimmed string. It then passes through two critical validation checks:
1. Existence Check: The reply must exist. (If a malicious actor sends a payload without a body, the string literally evaluates to "undefined" and gets blocked).
2. Length Limit: The reply must be under 201 characters, enforcing the standard comment limit.
Atomic Transactions: If the validation checks pass, the system initiates a Mongoose transaction to execute the following steps safely:
- Permission Check: It verifies if the user has permission to reply by checking the post's status via await schemas.Posts.findOne(hotQueries.find_user_post(id, req.session.userId));.
- Creation: If permissions are valid, it creates a new reply. (Fun fact: It reuses the exact same schema as standard comments!)
The Reply Schema Structure: The reply object functions just like a normal comment, with two distinct exceptions:
- It does not contain a repliesCount field.
- It includes an extra rootId field, which explicitly points to the ID of the root comment being replied to.
Concurrency & Caps: To guarantee that a single comment never receives more than 10 replies while simultaneously incrementing the counter, the system runs this precise atomic query:

  {
      _id: rootCommentId,
      repliesCount: { $lt: 10 },
      rootId: null
  }

Error Handling: To catch race conditions or instances where a user attempts to reply to a thread that is already full, the system evaluates the write operation with if (result.matchedCount === 0) throw new Error("COMMENT_UPDATE_FAILED");. Inside the catch block, it intercept this with if (txError.message === "COMMENT_UPDATE_FAILED") return res.status(400).json({ error: "You can't reply to this comment!" });.

The Production Code 💻

// In actions.js
router.post("/api/v1/reply/comment/post/:id", checkAuth, checkValidID, async (req, res) => {
    try {
        const id = req.params.id;
        let { reply, rootCommentId } = req.body;
        reply = String(reply).trim(); // You can change this to an explicit string check too
        if (!reply) return res.status(400).json({ error: "Reply can't be empty!" });
        if (reply.length > 200) return res.status(400).json({ error: "Reply cannot exceed 200 chars!" });
        const session = await mongoose.startSession();

        try {
            await session.withTransaction(async () => {
                // Find post
                const post = await schemas.Posts.findOne(hotQueries.find_user_post(id, req.session.userId));
                if (!post) throw new Error("POST_NOT_FOUND");

                // Add reply
                const newReply = new schemas.Comments({
                    content: reply,
                    rootId: rootCommentId,
                    for: id,
                    by: req.session.userId
                });

                await newReply.save({ session });

                // Inc comments
                const result = await schemas.Comments.updateOne({
                    _id: rootCommentId,
                    for: id,
                    repliesCount: { $lt: 10 },
                    rootId: null
                }, {
                    $inc: {
                        repliesCount: 1
                    }
                }, { session });

                if (result.matchedCount === 0) throw new Error("COMMENT_UPDATE_FAILED");
            });
        } catch (txError) {
            if (txError.message === "POST_NOT_FOUND") return res.status(400).json({ error: "Post not found or you don't have permissions to see it!" });
            if (txError.message === "COMMENT_UPDATE_FAILED") return res.status(400).json({ error: "You can't reply to this comment!" });
            console.log("Error: " + txError.message);
            return res.status(400).json({ error: "Failed to reply. Try again." });
        } finally {
            session.endSession();
        }

        return res.status(200).json({ success: true });
    } catch (e) {
        console.log("Error: " + e.message);
        createErrorMessage(e, req.session.userId, req.originalUrl);
        return res.status(400).json({ error: "Server error" });
    }
});

// In server.js
app.post("/api/v1/get/post/replies/:id", checkAuth, checkValidID, async (req, res) => {
    try {
        const id = req.params.id;
        const { rootCommentId } = req.body;

        // Do you have permissions to access this post?
        const post = await schemas.Posts.find(hotQueries.find_user_post(id, req.session.userId));
        if (!post) return res.status(400).json({ error: "Post not found or you don't have permissions to see it!" });

        // Find replies (Note: You might want to add limit(10) here as a best practice, though it is optional)
        const replies = await schemas.Comments.find({
            for: id,
            rootId: rootCommentId
        })
            .populate("by", "-password -recoveryCodes -pinnedPosts -email -pinnedPostsCount"); // Removes secrets and non-essential data

        return res.status(200).json({ success: true, replies: replies });
    } catch (e) {
        console.error("Fetch Replies Break: ", e.message);
        return res.status(500).json({ error: "Could not retrieve replies." });
    }
});

I built an ultra-light social network for you and your hobbies

Seif Ahmed — Fri, 07 Aug 2026 19:57:15 +0000

A thousand packages in the tree,
A heavy runtime, rarely free.
You spin up React just to write a post,
While memory leaks consume your host.

So I carved a space away from the noise,
To bring back simplicity, speed, and choice.

A sanctuary for you and your hobbies

No Virtual DOM to drain your pace,
Ghost States ensures you never lose your trace,
Pure NanoScript flowing clean and light,
A private network built just right.

The Bloated Way	The Vlox Way
React (hundreds of MBs)	NanoScript (a few KBs)
Complex state boilerplate	Automatic Ghost State saving
Sluggish edge environment loads	Instant response

Take a breath, leave the bloat behind, and see how fast the web can be when it isn't weighed down.

Explore the architecture:

🚀 Live Demo: https://vlox.containers.snapdeploy.app/ or https://vlox.bonto.run/
⚡ Vlox Codebase: https://github.com/Hfs2024/Vlox

Most social media apps are so corporate. Try Vlox, the stylish alternative.

Seif Ahmed — Fri, 07 Aug 2026 12:36:27 +0000

Forget standard, bloated apps. I wanted to see how far raw web architecture, instant real-time data streaming, and sleek deployment efficiency could go without a massive budget.

The result is Vlox—and it is live right now.

👉 Launch App: vlox.containers.snapdeploy.app

🛠️ The Anti-Corporate Tech Stack

Most social media apps are so large. But Vlox? That's a whole different story.

Frontend: 100% Vanilla JS driven by NanoScript, my custom, ultra-lightweight DOM engine.
Backend: Pure, event-driven Node.js and Express.
Database: Clean, modeled MongoDB with Mongoose.
Deployment: High-efficiency microservices via SnapDeploy.

⚡ The Challenge: Break the System

Local tests are too sanitized. I need raw, unthrottled traffic to push my custom connection pooling and scaling limits to the edge.

Enter Vlox: Open vlox.containers.snapdeploy.app
Stress Test: Create accounts and post at lightning speed.
Analyze: Watch the network tab for any bottlenecks or memory leaks.

Support the aesthetic of independent engineering by grabbing the Vlox Setup Handbook here: seifahmedcoder.gumroad.com/l/vlox

🎁 Exclusive: The first 3 users to post or find a bug gets the Vlox Setup Handbook completely free.

Feel free to drop your feedback, console errors, or bug reports in the comments below.

Build & Host Your Own Node.js Social Network (Source Code + Ebook)

Seif Ahmed — Wed, 05 Aug 2026 09:39:06 +0000

I built a full-stack social platform from scratch without AI help—meet Vlox!

After 3 years of building frontend apps and JS libraries, I challenged myself to engineer a complete, production-grade backend from scratch.

No AI helpers, no heavy full-stack frameworks—just raw Node.js, Express, MongoDB, and my own custom DOM library, NanoScript.

The result is Vlox: a modular, open-source social network built for performance and simplicity.

🔗 Try It Out & Explore the Code

💻 GitHub Repo: Hfs2024/Vlox
🌐 Live Demo: Vlox Live Instance

📖 The Vlox Setup Handbook

Want to deploy your own instance step-by-step? I put together The Vlox Setup Handbook ($5 on Gumroad).

It covers:

⚙️ Zero-to-Hero Setup: Complete guide for Node.js, Express & MongoDB.
🔐 Configuration: Safe .env setups & session security.
☁️ Free Cloud Hosting: Step-by-step containerized deployment (avoiding serverless traps!).
📄 Formats: Includes PDF, HTML, and Markdown.

👉 Get The Vlox Setup Handbook ($5)

Thanks for reading! Your support helps me keep building open-source projects. 💙

I made a gift for you: A clean, lightweight Markdown Previewer

Seif Ahmed — Tue, 04 Aug 2026 16:48:30 +0000

Demo

Your browser does not support the video tag.

You seem so tired, deep in thought,
With every question and answer you brought.
So as a gift to ease your view,
I built a markdown previewer for you.

A Little Rest for Your Code

Crisp headers shine so bright and clear,
Soft lists and tables now appear,
No walls of text to strain your mind,
Just tidy code left far behind.
Then shouldn't you come here and never hide?

Before	After
Bad design	Clean design
Weary Look	Refreshed view

So take a break and watch it glow,
And let your mind rest and slow.

Give it a try: https://github.com/Hfs2024/Markdown-Previewer.

I built a real-time social network to challenge X/Twitter. Try to crash it.

Seif Ahmed — Mon, 03 Aug 2026 07:11:13 +0000

Let’s be honest: building another social media app is usually a cliché.

But I wanted to see how far I could push modern web architecture, real-time data streaming, and deployment efficiency without spending a fortune.

The result is Vlox—and it's live right now.

👉 Launch App (Primary): vlox.containers.snapdeploy.app
👉 Mirror / Backup: vlox.bonto.run

🛠️ The "No-Framework" Tech Stack

I built everything from scratch. No React, no Next.js, no heavy state management tools.

Frontend: 100% Vanilla JS powered by NanoScript—my own lightweight, custom jQuery clone for DOM manipulation and event binding.
Backend: Pure Node.js event-driven server architecture and Express.
Database: MongoDB with Mongoose for clean data modeling.
Deployment: Containerized microservices running via SnapDeploy.

⚡ The Challenge: Try Vlox

I have optimized the connection pooling and container scaling, but local testing only goes so far. I need raw, unthrottled traffic.

Go to the app: Open https://vlox.containers.snapdeploy.app/.
Spam it: Create accounts and post rapidly.
Inspect the network tab: Look for bottlenecks, slow queries, or memory leaks.

You can buy the Vlox Setup Handbook and support the platform here: https://seifahmedcoder.gumroad.com/l/vlox

🎁 Bonus: The first user to create a post and email me at requestse@gmail.com will get the Vlox Setup Handbook guide for free!

Drop your feedback, console errors, or bug reports in the comments below.

🎉 VLOX IS OFFICIALLY LIVE!

Seif Ahmed — Sun, 26 Jul 2026 10:10:36 +0000

The wait is finally over—VLOX is live and running beautifully!

Check it out right here: 👉 vlox.bonto.run

I’ve been working hard on this platform, and I am proud to say the platform is bug-free this time!

💡 A Quick Favor...

Vlox is 100% free to use. To keep it that way, it is currently running on a lightweight setup with limited memory and storage space.

I’d absolutely love for you to jump in, create an account, and test it out! However, please go easy on the system so we don't accidentally overload the limits or crash the server. 😅

Now, go set up your account and feel free to post ANYTHING! 🚀

DEV Community: Seif Ahmed

You loved my markdown previewer, so I’m giving it a major upgrade.

1. Migrating from Manual Rollbacks to Native MongoDB Transactions

The Problem

The Solution

Key Architectural Decisions:

2. Dynamic Patching for Flexible Save Updates

The Problem

The Solution

3. Schema-Enforced Color Selection

The Problem

The Solution

[Boost]

I made a gift for you: A clean, lightweight Markdown Previewer

Goodbye React Fatigue: How I Built a Social Network Using ONLY My Own Library

[Boost]

I made a gift for you: A clean, lightweight Markdown Previewer

Building a password-protected link sharing workflow

How It Works

The Code

Building a Bulletproof Comment Reply System in Node.js & MongoDB 🚀

How It Works 🛠️

The Production Code 💻

Links:

I built an ultra-light social network for you and your hobbies

A sanctuary for you and your hobbies

Explore the architecture:

Most social media apps are so corporate. Try Vlox, the stylish alternative.

🛠️ The Anti-Corporate Tech Stack

⚡ The Challenge: Break the System

Build & Host Your Own Node.js Social Network (Source Code + Ebook)

I built a full-stack social platform from scratch without AI help—meet Vlox!

🔗 Try It Out & Explore the Code

📖 The Vlox Setup Handbook

I made a gift for you: A clean, lightweight Markdown Previewer

Demo

A Little Rest for Your Code

I built a real-time social network to challenge X/Twitter. Try to crash it.

🛠️ The "No-Framework" Tech Stack

⚡ The Challenge: Try Vlox

🎉 VLOX IS OFFICIALLY LIVE!

💡 A Quick Favor...