DEV Community: glitchbound

Lovable put a .env file in my GitHub repo. Is my Supabase key leaked?

glitchbound — Fri, 13 Nov 2026 17:08:00 +0000

You open your project on GitHub and see a file called .env. Inside is your Supabase address and a long key. Every guide says never commit a .env file. Is your app leaking?

Usually not. My own checker made this exact mistake. Its first version raised its loudest alarm on this file in three of six apps, and it was wrong all three times.

What is in the file

In the apps I looked at, the file held the project address, a key named VITE_SUPABASE_PUBLISHABLE_KEY or VITE_SUPABASE_ANON_KEY, and one more public setting such as the project id.

Two things make these harmless to publish.

The VITE_ prefix. The build tool copies every value with that prefix into the code that runs in the browser. Anyone who visits your app already has it.
The kind of key. Supabase has public keys and secret keys. The publishable key is the public kind, and Supabase's own guide calls it safe to expose online. The older anon key is the earlier version of the same thing.

So the file tells the world nothing your website does not already tell it.

The condition that matters

The public key is safe only if your database rules are in place. It opens the door to the database, and Row Level Security decides what the visitor can do once inside. With a table that has no rules, that public key is usually enough to read and change the table.

That is the real question. It is not "is my key visible". It is "what can someone do with it".

Which key is the dangerous one

New style: a key starting with sb_secret_ is secret. One starting with sb_publishable_ is public.
Old style: both keys are long strings starting with eyJ. In the Supabase dashboard one is labelled anon and the other service_role. The service_role key is the secret one.

A secret key skips every rule you have. It belongs on a server only. It is a real leak if it appears in any of these places:

In the .env file in your repository.
In any variable whose name starts with VITE_, even if the file is not committed.
In an older commit. Deleting a file does not remove it from the history.

The same goes for keys of other paid services, such as an AI provider or an email service.

If the secret key was exposed

Deleting it is not enough. First take it out of the code, so the new key does not leak the same way. Then create a new key in the Supabase dashboard, switch your server to it, and turn the old one off. Supabase calls this rotating the key.

The two-minute check

Run this in the Supabase SQL editor. It only reads.

select schemaname, tablename, rowsecurity from pg_tables where schemaname = 'public' order by tablename;

Any table with rowsecurity = false has no rules at all. That matters far more than the .env file.

One more thing to know: Supabase says it is deprecating the older anon and service_role keys by the end of 2026, so a move to the new keys is coming either way.

If you want your app checked

I read your repository and its history for a fixed list of problems, including secret keys in the code and tables without rules, and report each with its file and line. It is an option with the scan on my Upwork listing. The scan costs $95, and the security check adds one day and $50. That is an opening price for the first five clients. After that it is $150. An empty report does not mean the app is secure.

Vibe code cleanup: how to know the cleanup did not break your AI-built app

glitchbound — Tue, 10 Nov 2026 20:48:13 +0000

You built an app with Lovable, Cursor, Bolt or Claude Code, and it works. People use it. But every new feature now breaks an old one, and the AI keeps writing things again that it already wrote.

The fix is a cleanup. The problem is that a cleanup can break the app that works today, and you may not find out until a customer does.

I offer a cleanup service for AI-written code, and its whole promise is that you get proof nothing broke. Before selling that, I wanted to know whether the proof could be trusted. So I ran it on a real app and then tried to fool it.

The app

I picked an open-source web app with more than 900 stars. Its author describes it as vibe-coded, built over about a year with AI tools. It is a real product that people use, and it comes with 817 automated tests of its own.

A scan found what a year of AI-written code usually leaves behind. The same small function was written several times in different files. Old copies of files were left lying around with nothing using them. Some files had grown to thousands of lines.

The cleanup

I merged the identical copies into one, deleted the files nothing used, and split two oversized files into smaller ones. That came to 28 files changed and 2,937 fewer lines.

I left alone anything that would change how the parts of the app talk to each other. One 4,906-line piece of code stayed as it was, because splitting it is a design decision that belongs to the owner.

Then I broke it on purpose

On a throwaway copy, I removed one small step from one of the merged functions. It was the step that turns a file name into lower case.

All 817 tests still passed.

In the app itself, four export screens now produced My-Demo-File-_v2 where they used to produce my-demo-file-_v2. It is a harmless example of a serious problem. "The tests pass" is the usual evidence that a cleanup was safe, and here it would have been wrong.

What caught it

The cleanup is checked four ways, and each one compares the old version with the new one.

Every piece of code in the old version is matched to the new version. All 2,348 were accounted for. This check caught the planted bug.
The app's own tests run on both versions. All 817 passed on both, and no test was edited.
The same screens are opened in the old build and the new build. All 16 were identical down to the pixel, with the same text, errors, network requests and saved data. This check caught the planted bug too, on exactly the four screens that use the function.
The functions that were touched are run with the same inputs on both versions. 594 of 594 results were identical.

One more thing came out of the first check. Eleven places in this app define a function with the same name, and they do not all do the same thing. Merging the wrong two would change behaviour far away from the edit, so the check follows where every name leads, not only whether the text looks the same.

Checking the checks

One planted bug is an anecdote. So the cleaned code was broken in 230 small ways, one at a time, and the first check noticed all 230.

My checks were not perfect the first time, and I think you should know that. The cleanup deleted a file that a settings file still mentioned. Nothing broke, but the report should have pointed at it and did not. I fixed the check, corrected the report in public, and the report now lists that line for a person to read.

Two open-source maintainers have merged small cleanups that went through the first two of the four checks above. In Calino, a calendar app, one removed 55 duplicated lines from one file, and you can read it here. In relay-ai, a tool its README says was vibe coded, one replaced two identical copies of a function with a single shared copy, and you can read it here. Five of relay-ai's tests need the internet, so they fail in my sandbox, the same way before and after my change. They passed in the maintainer's own run.

What a cleanup does not do

A cleanup that changes nothing also fixes nothing. If your app has a bug or a security hole today, a careful cleanup keeps it, because keeping behaviour the same is the whole point.

Finding security problems, such as open database rules or leaked keys, is a different job, usually called an audit. Many founders need that before launch. Make sure you know which of the two you are buying, because they are often sold under one name.

What you get when you hire me

It always starts with a scan, which costs $95. You get a report on your whole repository that lists the duplicated functions, the look-alikes that are not safe to merge, the files over 1,000 lines and the values that are retyped in many places. It ends with a fixed price for the cleanup, so you know the cost before you commit to anything. If you then hire me for the cleanup, the $95 comes off its price.

Then we agree on what gets cleaned and which parts of the app matter most to you. I do the cleanup in small steps and run the four checks above on your app.

You receive two things. The first is one pull request, which is the cleaned code ready for you to accept. The second is the proof report, which lists every piece of code that was moved, merged or removed, with before and after screenshots of your screens.

If a change in behaviour caused by my cleanup shows up within 30 days, I fix it free.

Your code runs on my machine only inside a sandbox with no internet, after its packages have been checked against a public malware database. I am happy to sign an NDA.

The service covers JavaScript and TypeScript apps, the languages that tools like Lovable and Bolt normally produce for web apps. It does not cover other languages such as Python or Swift.

You can order the scan or a cleanup through my Upwork listing.

Three questions for anyone you hire

Whoever does your cleanup, these are worth asking.

What evidence will I get that compares the old version with the new one?
What can that evidence not see?
Has it ever caught a mistake planted on purpose?

If the only answer is "the tests pass", you now know what that is worth.

Coinbase, Kalshi and Binance app rankings API: the App Store and Google Play finance charts in 30 countries

glitchbound — Fri, 30 Oct 2026 16:39:21 +0000

Coinbase's place in the App Store is a number people watch. On 2026-10-30 it was #37 among free finance apps on the US iPhone, and no crypto exchange was in the overall top 100 of either store in any of the 30 countries read here. Five things to know, read from both stores' top free finance and overall charts on 2026-10-30 between 16:27 and 16:32 UTC, 100 apps a chart in 30 countries, from the United States and Brazil to Japan and Nigeria.

1. Coinbase is outside every overall top 100

Coinbase was in the top 100 free finance apps in 12 of the 30 countries on the iPhone and 8 on Google Play. Its best places were #37 on the iPhone in the United States and #33 on Google Play in Canada (#47 in the US). It was in neither store's overall top 100 anywhere, and neither was any other crypto exchange. The highest any exchange reached in a finance chart was Kraken at #9 on Google Play in Italy; on the iPhone it was Binance at #16 in the United Arab Emirates.

2. Kalshi leads US finance

Kalshi, a prediction market, was #2 among free finance apps on the US iPhone and #1 on Google Play, and #7 and #16 in the overall US charts. It was in no other country's charts. Polymarket was #12 in US finance on the iPhone and #50 on Google Play; Robinhood was #29 and #51.

3. Binance travels, and stock brokers sit higher

Binance's main app was in the iPhone finance top 100 in 23 of the 30 countries, and on Google Play in 12. Bitvavo (#17 in the Netherlands), OKX (#18 in Poland) and Luno (#32 in South Africa) ranked above it on the iPhone, and Kraken led the crypto apps on Google Play in Italy, France, Spain, Germany and Sweden. Stock brokers ranked higher still: XTB #4 in Poland, Trading 212 #5 in the United Kingdom and Trade Republic #6 in Germany and Spain, on the iPhone.

4. One app's place in Apple's finance chart

rank() {  # country, app id: that app's place among the country's top 100 free finance apps
  curl -s "https://itunes.apple.com/$1/rss/topfreeapplications/limit=100/genre=6015/json" \
    | jq -r --arg id "$2" '.feed.entry | to_entries[] | select(.value.id.attributes["im:id"] == $id) | "\(.key + 1) \(.value["im:name"].label)"'
}
rank us 886427730

That printed 37 Coinbase: Buy Crypto & Stocks. The same id is "Coinbase: Buy BTC, ETH, SOL" in Canada and "Coinbase: BTC, ETH, SOL kaufen" in Germany, so match on the id, not the title. No output means outside the top 100: this genre feed returns 100 apps even when asked for 200. 6015 is Finance.

5. The #1 finance app is usually a bank or a wallet

Lloyds led both stores in the United Kingdom, ING in Australia, Mercado Pago in Mexico and ShopeePay in Malaysia and Thailand; on Google Play, PhonePe led in India, PayPay in Japan and GCash in the Philippines. The same app led both stores in 10 of the 30 countries. Google Wallet led Google Play in Canada, Israel and the Netherlands, and was in the overall Google Play top 100 in 13 countries, more than any other finance app. In the United States, Capital One led the iPhone and Kalshi led Google Play.

Hosted

App Store Top Charts Scraper and Google Play Top Charts Scraper on Apify take a list of countries, charts and categories (finance on both) and return every app with its id, rank, developer and price, and how far it moved since your previous run, so a daily run turns Coinbase's place into a series. The 30 countries above, finance and overall, were one run of each: under six minutes for the iPhone, 72 seconds for Google Play.

O'Reilly Auto Parts, Dollar Tree and Trane jobs API: the same jobs on two careers sites, and the id that joins them

glitchbound — Fri, 30 Oct 2026 16:24:39 +0000

O'Reilly Auto Parts (careers.oreillyauto.com), Dollar Tree (careers.dollartree.com) and Trane Technologies (careers.tranetechnologies.com) show their jobs on a Phenom careers site, and the same jobs sit in the Workday site behind it. Read both and you hold every job twice. Five things to know, measured on 2026-10-29 with a few seconds between requests.

1. Two sites, one list

The two sides report nearly the same count: O'Reilly 19,120 jobs on Phenom and 19,104 on Workday, Dollar Tree 15,537 and 15,573, Trane 1,751 and 1,746. They are not two pools of jobs, they are two views of one, refreshed at slightly different moments.

2. The requisition id joins them

req=$(curl -s -X POST https://careers.oreillyauto.com/widgets -H "Content-Type: application/json" \
  -d '{"ddoKey":"refineSearch","jobs":true,"from":0,"size":1,"sort":{"order":"desc","field":"dateCreated"}}' \
  | jq -r '.refineSearch.data.jobs[0] | "\(.reqId) \(.title)"')
echo "Phenom: $req"
curl -s -X POST https://oreillyauto.wd1.myworkdayjobs.com/wday/cxs/oreillyauto/oreilly/jobs \
  -H "Content-Type: application/json" -d "{\"limit\":5,\"offset\":0,\"searchText\":\"${req%% *}\",\"appliedFacets\":{}}" \
  | jq -c '{total, jobs: [.jobPostings[] | {title, id: .bulletFields[0]}]}'

That printed Phenom: R209433 Parts Specialist, then {"total":1,"jobs":[{"title":"Parts Specialist","id":"R209433"}]}. Phenom's reqId is Workday's requisition id, the one in bulletFields and at the end of the job's externalPath. The same held for Dollar Tree (R-363425) and Trane (JR-19071).

3. Same jobs, different order

O'Reilly's first 100 jobs on each side shared 52: the same openings, sorted differently. So comparing first pages, or titles and cities, says little. Collect both lists and join them on the employer plus the requisition id.

4. How many

In a nightly harvest of 2.77 million jobs from 52,000 boards on 2026-10-29, 45,024 rows were a second copy of a job read on another system: 19,080 at O'Reilly, 15,525 at Dollar Tree, 1,731 at Trane, then Northrop Grumman (1,360), Applied Materials (1,126) and Morgan Stanley (1,013), each with Eightfold over Workday, and Mayo Clinic (1,035) with Eightfold over Oracle. By system, 37,725 were Phenom over Workday, 5,256 Eightfold over Workday and 2,043 Eightfold over Oracle.

5. Keep the system's copy, keep the front end's extras

Key the join on the employer's name, not on each board's own label: Workday names O'Reilly by its tenant, oreillyauto, and Phenom says "O'Reilly Auto Parts", so a join on the raw labels finds nothing. Keep the Workday or Oracle copy, which is read whole, but take what only the front end has before dropping it: Dollar Tree's Phenom records carry a salaryRange that its Workday list does not, on 5,244 of its 15,526 jobs that night.

Hosted

Job Listings API on Apify searches that nightly index and returns each of these jobs once, with the pay the front end carried. The Company Career Page Jobs Scraper takes O'Reilly Auto Parts or Dollar Tree by name, reads both sites, and keeps one row per requisition. Every other system's public endpoint, with a tested curl, is in job-board-apis.

Temu, Shopee and Amazon shopping app rankings API: the App Store and Google Play shopping charts in 30 countries

glitchbound — Fri, 30 Oct 2026 00:07:32 +0000

Temu is in the top 100 free shopping apps on the iPhone and on Google Play in all 30 countries read here, and #1 on both stores in six. Most of the other #1s are local. Five things to know, read from both stores' top free shopping charts on 2026-10-29 between 23:51 and 23:54 UTC, 100 apps a chart in 30 countries, from the United States and Brazil to Japan and Nigeria.

1. Temu is in the top 100 everywhere

Temu was #1 on both stores in the United Arab Emirates, Egypt, Israel, Nigeria, Singapore and South Africa, and in the top 10 in 21 of the 30 countries on the iPhone and 23 on Google Play. Its lowest places were #61 on the iPhone in Turkey and #57 on Google Play in Indonesia. In the United States, Vinted was #1 on both stores; Temu was #2 on the iPhone and #3 on Google Play.

2. The #1 is local almost everywhere else

14 brands were #1 on the iPhone across the 30 countries, and 15 on Google Play. Mercado Libre led the iPhone in Argentina, Brazil and Mexico, and Google Play in Mexico. Meesho led both stores in India, Naver's store in Korea and A101 in Turkey. Shopify's Shop app was #1 on the iPhone in France, Italy, the Netherlands and Sweden. On Google Play, AliExpress was #1 in Australia and Brazil, and Shein in Saudi Arabia.

3. Apple's shopping chart is the same feed with a genre

top() {  # country, genre id: the App Store's top 10 free apps in that genre
  curl -s "https://itunes.apple.com/$1/rss/topfreeapplications/limit=10/genre=$2/json" \
    | jq -r '.feed.entry | to_entries[] | "\(.key + 1) \(.value["im:name"].label)"'
}
top us 6024

That printed Vinted, Temu, Walmart, Shop and Amazon Shopping as the first five. 6024 is the Shopping genre (6014 is Games); limit goes up to 100, and the position in entry is the rank.

4. One brand, many apps

Shopee's main app is a separate app in each of the nine countries where it charted, on both stores. On the iPhone it is 959841443 in Indonesia, 959841449 in Vietnam and 959841453 in Thailand, under eight developer names, from "SHOPEE THAILAND COMPANY LIMITED" to "SHPS I Private Limited" in Brazil; on Google Play it is com.shopee.id, com.shopee.vn, com.shopee.th and so on. Counted as one brand, Shopee was #1 on the iPhone in three countries and on Google Play in six. Amazon is six iPhone apps across the 30: 297606951 in 20 countries including the United States, 335187483 in the United Kingdom, Spain, Italy, the Netherlands, Poland and Sweden, and one each for Germany, France, India and Japan. On Google Play it is one package, com.amazon.mShop.android.shopping, in 28 countries, and a separate one in India. Keep a table that maps app ids to a brand: a developer name won't hold, and a title carries the current sale ("Shopee 11.11 Big Sale").

5. The two stores pick different winners

The same brand led both stores in 18 of the 30 countries. In the other 12 they split: in the United Kingdom, Amazon was #1 on the iPhone and GoWish, a wishlist app, on Google Play; in Japan, MUJI's app led the iPhone and Amazon led Google Play; in Canada it was Old Navy and DealSeek, in France Shop and Action. Shein shows the same gap: #1 on Google Play in Saudi Arabia, and #2 at best on the iPhone (Israel and South Africa).

Hosted

App Store Top Charts Scraper and Google Play Top Charts Scraper on Apify take a list of countries, charts and categories (shopping on both) and return every app with its id, rank, developer and price, and how far it moved since your previous run. The 30 countries above were one run of each: under three minutes for the iPhone, 30 seconds for Google Play.

Roblox, Royal Match and Candy Crush rankings API: the top grossing mobile games in 30 countries on both stores

glitchbound — Thu, 29 Oct 2026 23:31:03 +0000

The top grossing chart is each store's list of the games taking the most money that day. Five things to know about it, read from both stores' top grossing and top free game charts on 2026-10-29 (23:22 UTC for Google Play, 23:24 UTC for the iPhone), 100 games a chart in 30 countries, from the United States and Brazil to Japan and Nigeria.

1. Five games are in the top 10 grossing almost everywhere

Gossip Harbor was in the top 10 grossing in 27 of the 30 countries on the iPhone and 28 on Google Play. Roblox was in 25 on each, Royal Match in 25 and 21, Candy Crush Saga in 22 and 24, and Kingshot in 23 and 21.

2. The #1 is often a different game in each store

In the United States, Gossip Harbor was #1 on the iPhone and Monopoly Go #2; on Google Play, Monopoly Go was #1 and Gossip Harbor #4. eFootball was #1 on the iPhone in eight countries (Brazil, India, Indonesia, Japan, Malaysia, Nigeria, Thailand and Turkey); on Google Play it was #2 to #8 in seven of them and #35 in Japan. Coin Master was #1 on Google Play in eight (the United Kingdom, Germany, France, Spain, Italy, Poland, Israel and Vietnam), and on the iPhone #1 in four of those and #2 or #3 in the rest. Mobile Legends led Google Play in Malaysia, the Philippines and Singapore.

3. Apple's games chart is the same feed with a genre

top() {  # country, chart: the App Store's top 10 games there
  curl -s "https://itunes.apple.com/$1/rss/$2/limit=10/genre=6014/json" \
    | jq -r '.feed.entry | to_entries[] | "\(.key + 1) \(.value["im:name"].label)"'
}
top us topgrossingapplications

That printed Gossip Harbor, Monopoly Go, Royal Match, Pokémon TCG Pocket and Roblox as the first five. 6014 is the Games genre; topfreeapplications and toppaidapplications work the same way, up to 100 rows, and the position in entry is the rank.

4. Match on the app id: the titles are translated

Pokémon TCG Pocket was #1 on the iPhone in France and Italy, as "Le JCC Pokémon Pocket" and "GCC Pokémon Pocket"; in Spain, Argentina and Mexico it is "JCC Pokémon Pocket". Roblox is "Roblox (ロブロックス)" in Japan and "로블록스(Roblox)" in Korea. Of the iPhone's top grossing games, 58 appeared under three or more titles across the 30 countries; on Google Play, 6 did. Group by the app's id (431946152 and com.roblox.client for Roblox), never by its name.

5. Free and grossing are different charts

The top free chart is led by puzzles: Block Out! was #1 on the iPhone in nine countries and Meowdoku #1 on Google Play in twelve. Roblox is the game that sits high on both: in the top 10 free in 19 countries on the iPhone and 23 on Google Play, and #1 free on Google Play in Mexico, Malaysia, Saudi Arabia and Thailand.

Hosted

App Store Top Charts Scraper (category games) and Google Play Top Charts Scraper (all-games, or one of 17 game genres) on Apify take a list of countries and charts and return every game with its rank, developer and price, and how far it moved since your previous run. Both charts in the 30 countries above took under three minutes a chart on the iPhone and 67 seconds together on Google Play.

CommonSpirit Health, Crunch Fitness and The Joint jobs API: the pay in a job page's schema.org markup

glitchbound — Thu, 29 Oct 2026 17:22:37 +0000

Crunch Fitness (crunchfitness), The Joint Chiropractic (thejointchiropractic) and Ethos Veterinary Health (ethosveterinaryhealth) hire through JazzHR, and CommonSpirit Health through Radancy. Both put a schema.org JobPosting on each job's page, the markup Google for Jobs reads, and it has a field for the pay: baseSalary. Five things to know about it, measured on 2026-10-29 on the eight newest jobs of five JazzHR boards and the ten newest of four Radancy sites, a few seconds between requests.

1. JazzHR's list has no posting; the job page has a JobPosting

A JazzHR board's /apply page lists each opening's title, place and department, and nothing else. The posting, the date and the pay are on the job's own page, in a JobPosting: on 7 of the 8 newest at Crunch Fitness, 7 at Bath Concepts, 6 at CentiMark, 5 at Ethos and 2 at The Joint. A page without one still shows the posting in its #job-description block, but no date.

2. One request per job page

jp() {  # a JazzHR job page: its schema.org JobPosting's title, date and pay
  curl -s "$1" | perl -0ne 'print "$1\n" while /<script type="application\/ld\+json">(.*?)<\/script>/sg' \
    | jq -c 'select(."@type" == "JobPosting") | {title, datePosted, baseSalary}'
}
jp https://centimark.applytojob.com/apply/Oyh2N2Nl4F/Assistant-Roofing-Foreman

That printed {"title":"Assistant Roofing Foreman","datePosted":"2026-10-08","baseSalary":{"@type":"MonetaryAmount","currency":"USD","value":{"@type":"QuantitativeValue","unitText":"HOUR","minValue":27,"maxValue":33}}}. That page carries two ld+json blocks, the employer's Organization first, so the command keeps the one whose @type is JobPosting.

3. baseSalary is there when the employer fills it in

On those eight jobs a board, baseSalary had numbers on 5 at Ethos, 3 at CentiMark, 2 at The Joint, 1 at Crunch Fitness (an Operations Manager, 31,200 to 41,360 a year) and none at Bath Concepts. A band is minValue and maxValue; a single rate is value, as The Joint wrote it for a Chiropractic Manager in Colorado: {"@type":"QuantitativeValue","unitText":"YEAR","value":110000}.

4. The unit can be wrong

Ethos marks four of its five bands "unitText":"YEAR": 28 to 32, 28 to 35 and 30 to 35 for licensed veterinary technicians, 12 to 27 for a veterinary assistant. Nobody is paid $28 a year; those are hourly rates, and the fifth, 28 to 35 for another technician, says HOUR. Check the numbers against the unit before trusting either.

5. Radancy sends the field on every job, often empty

CommonSpirit Health filled baseSalary on all ten of its newest jobs, 61.81 to 105.18 an hour for a Nursing House Supervisor. UnitedHealth Group, Kaiser Permanente and Comcast, on the same system, sent it on all ten too, every time as {"@type":"MonetaryAmount","currency":"","value":{"@type":"QuantitativeValue","unitText":""}}. At UnitedHealth the pay is in the posting's text instead: 7 of its 8 newest postings state it, 73,188 to 109,782 a year for a Clinical Manager.

Hosted

Company Career Page Jobs Scraper on Apify takes CommonSpirit Health or The Joint Chiropractic by name, and JazzHR boards as jazzhr:crunchfitness. It returns the pay as salaryMin, salaryMax, salaryCurrency and salaryPeriod: from a filled baseSalary (CommonSpirit's on every run), from each JazzHR job page with includeDescription, and from the posting's text where the field is empty or its unit cannot be true. Every other system's public endpoint, with a tested curl, is in job-board-apis.

ChatGPT, Claude and Gemini app rankings API: the App Store and Google Play top charts in 30 countries

glitchbound — Thu, 29 Oct 2026 17:21:30 +0000

ChatGPT, Claude and Gemini are in the top free 100 on the iPhone in at least 29 of 30 countries, and in the Google Play top 100 in at least 28. Where they rank in each is a different story. Five things to know, read from both stores' top free charts on 2026-10-29 (16:46 UTC for the iPhone, 16:49 UTC for Google Play) in 30 countries, from the United States and Germany to Nigeria and Vietnam.

1. Claude is #1 on the iPhone in Germany, Spain and France

On the iPhone top free chart, Claude was #1 in Germany, Spain and France, and in the top 5 in 14 of the 30 countries. ChatGPT was #1 in India and Nigeria and in the top 5 in 16. Gemini's best was #2, in Egypt, Spain and Poland. On Google Play, ChatGPT was #1 in 8 countries (Australia, Germany, Spain, France, the United Kingdom, India, the Netherlands and Poland), Claude's best was #5 (France, the Netherlands) and Gemini's #9 (Italy).

2. Apple's chart is one public feed

rank() {  # country, app id: the app's place in that country's iPhone top free 100
  curl -s "https://itunes.apple.com/$1/rss/topfreeapplications/limit=100/json" \
    | jq -r --arg id "$2" '.feed.entry | to_entries[] | select(.value.id.attributes["im:id"] == $id) | "\(.key + 1) \(.value["im:name"].label)"'
}
for c in de es fr us in; do echo "$c $(rank $c 6473753684)"; sleep 2; done   # Claude

That printed de 1, es 1, fr 1, us 6 and in 12, each followed by "Claude by Anthropic". The feed has no rank field: the position in entry is the rank, so the command counts it. topfreeapplications is the iPhone chart; toppaidapplications and topgrossingapplications sit beside it.

3. The iPhone and Android charts are different charts

Claude ranked higher on the iPhone than on Google Play in all 28 countries where it charted on both: a median of #6 against #29. Gemini did the same in 28 of 29, #6 against #30. ChatGPT is the one that does better on Android: a median of #3 on Google Play against #4.5 on the iPhone, higher on Play in 17 countries and level in 4. A rank in one store says little about the other.

4. Match on the app id, not the name

"Gemini" in the title matched two iPhone apps in the same charts: Google Gemini (6477489729) and Gemini Notebook (6737527615), a second Google app. On Android, Google's Gemini is still com.google.android.apps.bard. ChatGPT is published by "OpenAI OpCo, LLC" on the iPhone and "OpenAI" on Google Play, so a developer-name match fails too. And a chart can be led by an app that is nowhere else: Muse from Meta was #1 on both stores in Canada, Japan and Singapore, #1 on Google Play and #2 on the iPhone in the United States, and in neither top 100 in the other 26 countries.

5. Google Play has no feed

Google Play publishes no chart feed. Its web app reads the charts through its own RPC, which the Google Play top charts write-up walks through. The Play numbers above came from that, 100 apps a chart a country.

Hosted

App Store Top Charts Scraper and Google Play Top Charts Scraper on Apify take a list of countries and a chart, and return every app with its rank, developer and price, and how far it moved since your previous run. Google Play rows carry the rating and installs; iPhone rows get the rating with includeDetails. The 30 countries above were one run of each: 3 minutes for the iPhone, 29 seconds for Google Play.

Rippling, Carbon Health and Barry's jobs API: the pay in each job's own record, one location at a time

glitchbound — Thu, 29 Oct 2026 16:30:52 +0000

Rippling (rippling), Carbon Health (carbon-health) and Barry's (barrys-careers) post their jobs on Rippling's own job boards, and Rippling serves every board as JSON with no key. Five things to know about getting the pay out of it, measured on 2026-10-29 with a few seconds between requests.

1. The list has five fields, and a job once per place

/platform/api/ats/v1/board/<token>/jobs answers with uuid, name, url, department and workLocation. No posting, no date, no pay. And a job with five places is five entries: Rippling's own board had 686 entries for 381 jobs, one of them listed in 20 places; Barry's 348 for 225; Carbon Health 320 for 233. Count by uuid, not by entry.

2. Each job's own record has the rest

rp() {  # a Rippling board: entries and jobs in the list, then the first job's own record
  B=https://api.rippling.com/platform/api/ats/v1/board/$1/jobs
  curl -s "$B" > list.json
  jq -c '{entries: length, jobs: (map(.uuid) | unique | length)}' list.json
  curl -s "$B/$(jq -r '.[0].uuid' list.json)" | jq -c '{name, createdOn, payRangeDetails}'
}
rp barrys-careers

That printed {"entries":348,"jobs":225}, then an Assistant General Manager created on 2026-09-23 with payRangeDetails of [{"location":"Washington, DC","currency":"USD","frequency":"YEAR","rangeStart":68000.0,"rangeEnd":70000.0,"isRemote":false}]. The record also carries description in two parts, company and role, and every place in workLocations. One request per job.

3. Barry's fills the pay field, one entry per location

Barry's opens a separate job for each studio, so the field is a pay map. Its 16 Client Facilities Lead jobs run from $19.50 an hour in Southlake to $22.00 in Scottsdale and $22.50 to $23.00 in Los Angeles; Boston is $20 to $21, New York $20 to $22. frequency is HOUR or YEAR, and rangeStart equal to rangeEnd is one rate, not a range. All 12 Barry's records in the sample had the field filled.

4. Rippling and Carbon Health leave it empty and write it in the text

On all 12 Rippling records and 11 of 12 Carbon Health records, payRangeDetails was []. The pay is in description.role:

Rippling writes tiers by office: "$205,000 /year OTE uncapped (Remote) $210,000 ... (Office based: Seattle & Chicago) $215,000 ... (Office based: New York & San Francisco)", then "60/40 commission split for base/variable pay". That is on-target earnings, base plus commission, and the base is 60% of it. Every posting's company part also says Rippling "has raised $1.2B", which is not anybody's pay.
Carbon Health writes two roles into one posting: "Physician Salary: $ 235,000 - $310,000 NP/PA Salary: $170,000 - $240,000", on a job titled "Area Medical Director (Physician Assistant / Nurse Practitioner)". The text does not say which band is this job's; the title does.
A Carbon Health internship in Bogotá offers a "Connectivity stipend of $150,000 COP per month": a dollar sign in pesos, on a stipend.

5. BambooHR keeps it in one free-text line

BambooHR's list (https://<board>.bamboohr.com/careers/list) has ten fields and no description or date. Each job's record has both, and compensation, typed by the employer:

bh() {  # a BambooHR board: the list's fields, then the first six jobs' own records
  H=https://$1.bamboohr.com/careers
  curl -s "$H/list" > bh.json
  jq -c '{jobs: (.result | length), fields: (.result[0] | keys)}' bh.json
  jq -r '.result[:6][].id' bh.json | while read ID; do sleep 2
    curl -s "$H/$ID/detail" | jq -c '.result.jobOpening | {jobOpeningName, compensation, datePosted}'
  done
}
bh eggharborcafe

Egg Harbor Cafe answered "$21-$27 (hourly plus tips)" for a server and "$15-$21 (hourly plus tips)" for food runners, on jobs posted in 2023 and still open. Elsewhere, on the first six jobs of eight large boards: Journey Nursing Services "$21-24 (up to $26 with differentials)", where $26 is a ceiling; Food People "$50,000-$60,000" for a manager and "14-18" for a line cook, no unit at all; Fessler & Bowman "DOE" on five of six. Four of the eight boards left it empty on all six.

Hosted

Rippling Jobs Scraper on Apify takes barrys-careers, carbon-health or rippling and returns each job once, with its other places in offices. With includeDescription it reads each job's record for the posting and the date, and returns the pay as salaryMin, salaryMax, salaryCurrency and salaryPeriod: from the field for the row's own location, or from the band the text states. Rippling's tiers come back as one band, 205,000 to 215,000 USD a year. The Company Career Page Jobs Scraper does the same for BambooHR boards (bamboohr:eggharborcafe). Every other system's public endpoint, with a tested curl, is in job-board-apis.

Publix, General Atomics and Hobby Lobby jobs API: BrassRing job details and the pay questions each employer names

glitchbound — Thu, 29 Oct 2026 15:57:00 +0000

Publix (partnerid=26173&siteid=5197), General Atomics (25539/5313) and Hobby Lobby (25879/5295) take applications through BrassRing. Its search, one host for every employer, is covered in the Home Depot, Walgreens and Best Buy write-up. The search answers with titles and places. Five things to know about the rest, measured on 2026-10-29 with a few seconds between requests.

1. The search is not the posting

Publix's search results carry no description at all: none on its ten newest jobs, and none on the ten newest at ten other employers. The job's details, the request the site makes when you open a job, carry 3,991 to 7,218 characters on the same ten Publix jobs, and the pay. At Walgreens they give the posting, the qualifications and "Salary Range: Pharmacist - $60.90/hr-$82.30/hr".

2. The details are one POST, with the same cookie and token

br() {  # partner id, site id: a session, then the newest job's pay questions
  B=https://sjobs.brassring.com
  curl -s -c jar "$B/TGnewUI/Search/Home/Home?partnerid=$1&siteid=$2" \
    | grep -o '__RequestVerificationToken" type="hidden" value="[^"]*' | cut -d'"' -f5 > rft
  ID=$(curl -s -b jar -X POST -H "RFT: $(cat rft)" -H "Content-Type: application/json" \
    -d "{\"PartnerId\":\"$1\",\"SiteId\":\"$2\",\"Keyword\":\"\",\"Location\":\"\",\"KeywordCustomSolrFields\":\"JobTitle\",\"LocationCustomSolrFields\":\"Location\"}" \
    "$B/TgNewUI/Search/Ajax/MatchedJobs" | jq -r '.Jobs.Job[0].Questions[] | select(.QuestionName == "reqid") | .Value')
  curl -s -b jar -X POST -H "RFT: $(cat rft)" -H "Content-Type: application/json" \
    -d "{\"partnerId\":\"$1\",\"siteId\":\"$2\",\"jobid\":\"$ID\",\"configMode\":\"\",\"jobSiteId\":\"$2\",\"turnOffHttps\":false}" \
    "$B/TgNewUI/Search/Ajax/JobDetails" \
    | jq -c '[.ServiceResponse.Jobdetails.JobDetailQuestions[] | select(.QuestionName | test("Pay|Salary|Rate")) | {(.QuestionName): .AnswerValue}]'
}
br 26173 5197    # Publix

That printed [{"Frequency of Pay":"Weekly "},{"Minimum Base Pay":"18.60"},{"Maximum Base Pay":"25.65"},{"Potential Annual Base Pay":"38,688 - 53,352"}]. Each answer is one JobDetailQuestions entry: a QuestionName, an AnswerValue, and the field it came from (formtext84 and the like).

3. Every employer names its pay questions itself

br 25539 5313 answered General Atomics' {"Pay Range Low":"69,500"},{"Pay Range High":"116,375"}. Walgreens asks "Start Rate" and "Max Rate" beside "Pay Type: Hourly"; Best Buy "Minimum Pay" and "Maximum Pay"; the Army and Air Force Exchange Service "Salary Minimum" "$20.32" and "Salary Maximum" "$23.70"; Home Depot one "Pay Range" with one figure, "$20.50". ADM wraps its names in HTML comments, , so match on the words inside. On the ten newest jobs at each, Walgreens, General Atomics, Best Buy, ADM and the Exchange had pay on all ten.

4. Read the question, not only the number

Publix's "Frequency of Pay: Weekly" is how often it pays, not what the rate is per: 18.60 to 25.65 an hour, and its own "Potential Annual Base Pay" of 38,688 to 53,352 is those rates times 2,080 hours. Performance Food Group's "Compensation" says "Earning potential up to $37 per hour", which is a ceiling, not a rate. Edward Jones' "Salary Information" is a sentence about benefits with no figure in it.

5. No pay question, then the posting

Hobby Lobby asks none, and writes it into the posting instead, with no label in front of it: "Starting part-time range - $16.50 - $17.50 per hour", on each of its ten newest jobs. American Greetings writes that "starting pay is $15.30 per hour with two increases during the first year", and Performance Food Group "Pay: $17/base + $2/ premium = $19/hour", where the base is $17.

Hosted

Company Career Page Jobs Scraper on Apify takes Publix, General Atomics or Hobby Lobby by name. With includeDescription it reads each job's details for the whole posting and returns the band its pay questions or its text state as salaryMin, salaryMax, salaryCurrency and salaryPeriod. Every other system's public endpoint, with a tested curl, is in job-board-apis.

BAE Systems, Honda and Dollar Tree jobs API: the Phenom job page and the pay fields each employer names

glitchbound — Thu, 29 Oct 2026 09:04:19 +0000

BAE Systems (jobs.baesystems.com), Honda (careers.honda.com) and Dollar Tree (careers.dollartree.com) run their careers sites on Phenom. The site's own search is one POST to /widgets, covered in the RTX, UPS and CVS Health write-up. That search returns a list. Five things to know about what the list leaves out, measured on 2026-10-28 and 29 with a few seconds between requests.

1. The list's description is a teaser, and not the posting's words

Each job in the list has descriptionTeaser: 307 to 413 characters on Honda's ten newest jobs, against 3,438 to 8,375 for the postings themselves. It is not the start of the posting either. Honda's newest teaser begins "We are looking for a SAP PP / QM Functional Analyst II", and the posting begins "What Makes a Honda, is Who makes a Honda". Of the newest 100 teasers at Honda, BAE Systems and Dollar Tree, none has a dollar figure.

2. The posting is on the job's own page

Each job page embeds the site's data as phApp.ddo, and jobDetail.data.job in it is the whole record. The page's path comes from the job's locale ("en_US" is /us/en/, "en_GLOBAL" is /global/en/):

page() {  # a Phenom host: the newest job's record, from the job's own page
  P=$(curl -s -X POST "https://$1/widgets" -H "Content-Type: application/json" \
    -d '{"ddoKey":"refineSearch","jobs":true,"from":0,"size":1,"sort":{"order":"desc","field":"dateCreated"}}' \
    | jq -r '.refineSearch.data.jobs[0] | (.locale | split("_") | "/\(.[1] | ascii_downcase)/\(.[0])") + "/job/" + .jobSeqNo')
  curl -s "https://$1$P" | grep -o 'phApp.ddo = {.*}; phApp.experimentData' \
    | sed 's/^phApp.ddo = //; s/; phApp.experimentData$//' | jq '.jobDetail.data.job'
}
page jobs.baesystems.com | jq -c '{salaryMin, salaryMax, payRange, chars: (.description | length)}'

That printed {"salaryMin":"136000","salaryMax":"231200","payRange":"231200 - 136000 USD per year","chars":9980}. robots.txt on these sites disallows */apply, */jobcart and */chatbot, not the job pages.

3. Every employer names its pay fields itself

page careers.dollartree.com | jq -c '{minSalary, maxSalary}'
page careers.honda.com | jq -c '{salary, salaryRange}'

Dollar Tree answered minSalary "$15.50" and maxSalary "$16.00"; Honda salary and salaryRange, both "$80,900.00 - $101,100.00". Some of it is in the list already: Honda's salary is filled on 280 of its 310 jobs, UPS's openingPayRate ("$21.00/hour") on 241 of its newest 500, Dollar Tree's salaryRange ("$20.50-$21.25") on 116 of its newest 500. BAE Systems keeps its numbers for the job page only.

4. Read the fields, then read them again

BAE's payRange writes the maximum first, so take the numbers from salaryMin and salaryMax. RTX has a compensationGrade ("P4"), which is a grade, not an amount; its pay is in the description ("The salary range for this role is 107,500 USD - 204,500 USD"). STERIS fills salaryMin and salaryMax with 60,500 and 101,000 on a job whose posting says "Pay range for this opportunity is $68,637.50 - $88,825.00", a narrower band than its own fields: decide which one you mean. Bechtel's salaryRange holds two quote characters and nothing else.

5. Without a field, the posting says it its own way

CoreCivic opens its postings with the pay and no label: "$86,635.00 / year".
Trane writes "Annual Base Salary Range or Hourly Base Pay Range: $56,300.00 - $101,394.99", a label that names two periods; the numbers say which.
Ecolab writes "42,000.00 - 52,500.00 - 63,000.00 USD Annual", a minimum, a midpoint and a maximum. The band is the outer two.

Hosted

Company Career Page Jobs Scraper on Apify takes BAE Systems, Honda or Dollar Tree by name. The list's own pay fields come with every run (Honda, UPS); with includeDescription it reads each job's page for the whole posting and returns the band its fields or its text state as salaryMin, salaryMax, salaryCurrency and salaryPeriod. BAE's newest row came back with "136,000 - 231,200 USD (year)". Every other system's public endpoint, with a tested curl, is in job-board-apis.

Vail Resorts, Compass Group and Guitar Center jobs API: the pay is in the posting, not in a field

glitchbound — Wed, 28 Oct 2026 20:26:08 +0000

Vail Resorts (jobs.vailresortscareers.com) and Compass Group (jobs.compassgroupcareers.com) publish their jobs on SAP SuccessFactors under their own domains, and Guitar Center (guitarcenterexternal) on ADP. Neither system's public job list carries a pay amount, and all three employers state pay anyway, in the text of the posting. Five things to know about finding it, measured on 2026-10-28 with a few seconds between requests.

1. Vail Resorts: the search page lists, the job page pays

The site's own search is a table that states its total, and each row links to a job page:

H=https://jobs.vailresortscareers.com
P=$(curl -s "$H/search/?q=&sortColumn=referencedate&sortDirection=desc&startrow=0" \
  | grep -o 'href="/job/[^"]*"' | head -1 | cut -d'"' -f2)
curl -s "$H$P" | sed 's/<[^>]*>/ /g' | grep -o 'Starting Wage: [^A-Z]*'

That printed "Starting Wage: $20.00/hr - $23.00/hr". The search page said "Results 1 to 25 of 1275", 25 a page with startrow as the offset. Each of the newest ten jobs stated a starting wage the same way, under "Job Specifications".

2. Compass Group: same system, other paths, four wordings

Compass Group runs the same software and the same command finds nothing: its job links start with the country (/United_States/job/...), so match /job/ anywhere in the path:

H=https://jobs.compassgroupcareers.com
curl -s "$H/search/?q=&sortColumn=referencedate&sortDirection=desc&startrow=0" \
  | grep -o 'jobTitle-link[^>]*href="[^"]*"' | grep -o '/[^"]*/job/[^"]*' | awk '!s[$0]++' | head -8 \
  | while read P; do sleep 3; curl -s "$H$P" | sed 's/<[^>]*>/ /g' | tr -s ' \n' ' ' \
      | grep -o '\(Pay Range\|Salary\|Pay Rate\) *: *\$[^A-Z]*' | head -1; done

Four of the eight newest jobs stated pay, and no two the same way: "Salary: $60,000 - $72,000", "Pay Rate: $25.00/hr", "Pay Range: $14.00 per hour to $15.00 per hour." and "Pay Range : $18.98 to $18.98". The first has no period at all; nobody is paid $60,000 an hour, so it is a year. The last is one rate written as a range.

3. Guitar Center: ADP returns the description with the list

ADP's public job list answers only with the organisation id from the site's own record, and returns every job's description in the same response:

A=https://myjobs.adp.com/public/staffing/v1
ORG=$(curl -s "$A/career-site/guitarcenterexternal" | jq -r .orgoid)
curl -s -H "orgoid: $ORG" "$A/job-requisitions?careerSiteDomain=guitarcenterexternal&\$top=100&\$skip=0&\$select=jobDescription" \
  | jq -r '.count, .jobRequisitions[].jobDescription' | sed 's/<[^>]*>/ /g; s/&nbsp;/ /g' | tr -s ' ' \
  | grep -o '^[0-9]*$\|Pay Rate: \$[0-9./hr $-]*' | head -5

That printed 1763, Guitar Center's open jobs, then "Pay Rate: $15.92/hr - $23.88/hr" and three more. Of the first 100 descriptions, 31 state a pay rate: 30 after "Pay Rate:", one after "Hourly Rate:", and one of the 30 writes it "$16.94phr".

4. Lever has a pay field, and Palantir writes it in the closing section

Lever's public API returns a whole board in one GET, and it does have a pay field: salaryRange, with min, max, currency and an interval such as "per-hour-wage". Of the 60 largest US Lever boards, 54 fill it in on some or all of their jobs. Palantir is not one of them. The posting comes in parts, descriptionPlain, the requirement lists, and additional, the closing section:

curl -s "https://api.lever.co/v0/postings/palantir?mode=json" \
  | jq 'length, ([.[] | select(.additionalPlain // "" | test("\\$[0-9]"))] | length), ([.[] | select(.descriptionPlain // "" | test("\\$[0-9]"))] | length)'

That printed 303, 232 and 0: Palantir states a salary on 232 of its 303 postings ("The estimated salary range for this position is estimated to be $60,000 - $97,000/year"), and on every one of them it is in additional. Read salaryRange and descriptionPlain alone, as ours did until this week, and Palantir's pay is on none.

5. The words around a figure decide whether it is the pay

A dollar figure next to "pay" is not always the job's pay, and these were all in the same day's postings:

Guitar Center's Music & Arts: "Pay Rate: $12.77/hr Non-Teaching Rate + $11-30/hr Teaching Rate". The band after the "+" is an addition; the pay is $12.77.
Spectrum: "Earn $18.00/hour base pay, with the potential to earn $22.50/hour through commission". $22.50 is a ceiling, not the rate.
A staffing board on Workable: "Pay Rate: $90.00 - $300.00 per case". A rate per case is not a wage, and with no period it cannot be turned into one.
Guitar Center again: "$15.00/hr - $17.05/hr Non-Teaching Rate and up to $23.60/hr Total Teaching Rate". Take the first band, not the largest number.

Hosted

Company Career Page Jobs Scraper on Apify takes Vail Resorts, Compass Group or Guitar Center by name, and Palantir on the Lever Jobs Scraper. With includeDescription they read each posting and return the band as salaryMin, salaryMax, salaryCurrency and salaryPeriod, and none where the posting states none. Lever sends the whole posting and salaryRange with every job, so Palantir's rows carry pay without it. Every other system's public endpoint, with a tested curl, is in job-board-apis.