DEV Community: Harun - solo dev

Day 3 of Building HYNA-Stage: Launching "Hacker Stage" & KODA Code Jam Season 3! 🐯☁️

Harun - solo dev — Thu, 22 Oct 2026 12:25:27 +0000

Yesterday, our Day 2 post hit 100 comments. 🤯

When you are a 12-year-old founder building cloud infrastructure on a $150 Android phone, you expect silence. Instead, we got a massive, active community of senior devs, fellow builders, and allies jumping into the trenches with us.

That energy is exactly why today is a massive milestone. Welcome to Day 3 of Building HYNA-Stage, where we officially launch KODA Code Jam Season 3: HACKER STAGE.

🎯 The Mission: Build Fast, Break Safely

For the next 7 days, we are challenging the community to build, test, and ship using the HYNAWEB Twin-Duo Ecosystem.

The problem? AI agents write code in seconds, but testing it safely takes 30 minutes of CI/CD waiting or risks wrecking your local machine.
The solution? Our stack:
🛡️ 1. KAVLR (The Agent Leash): A fail-closed terminal hook that stops dangerous AI commands (rm -rf, cat .env) before they execute.
☁️ 2. HYNA-Stage (The Instant Sandbox): A zero-config CLI that spins up an isolated, ephemeral cloud environment in under 5 seconds. Auto-destroys in 1 hour.
🤖 3. KODA (The Orchestrator): The VS Code extension that ties your agent workflow together seamlessly.

🏆 Tool of the Week: Crowdwide

A massive ecosystem needs massive allies. This week, our sister publication Off Radar officially crowned Crowdwide (built by my brother and fellow founder Puneet-Kumar2010) as the "Tool of the Week". If you want a platform that actually understands the modern builder's workflow, go check it out. We ride together! 🤝

🗓️ The 7-Day Hacker Stage Timeline

Days 1-2: Setup & Leash. Install the tools. Set up KAVLR to protect your terminal.
Days 3-5: Build & Break. Let your AI agent write a feature or fix a bug. Use hyna-stage up to test it instantly in the cloud.
Days 6-7: Polish & Ship. Document your build, share your results, and show us how the ecosystem handled the chaos.

🚀 How to Join

Install the CLI: npm install -g @hynaweb/stage
Build your project using the HYNAWEB stack.
And we are building a website for submissions it will be announced sooner and Remember the challenge starts on 25 oct

We are not just building apps; we are building the secure infrastructure for the AI era. And we want YOU in the trenches with us.

Let’s make these 7 days count. 🐯☁️🚀

Live Dashboard: hyna-stage
Off Radar Hub: off radar

Hacktoberfest & AI: How to Safely Test AI-Generated Open Source PRs in 5 Seconds

Harun - solo dev — Wed, 21 Oct 2026 15:55:28 +0000

Hacktoberfest is here, and this year, the open-source ecosystem has a new, powerful contributor: AI Coding Agents.

Tools like Cursor, GitHub Copilot, and Devin are generating Pull Requests and refactoring code at lightning speed. But as a developer, you’ve hit a massive, dangerous bottleneck: Validation.

AI can write the code in seconds. But running unvetted, AI-generated code on your local machine risks letting a rogue script read your .env files, delete your local folders, or completely mess up your actual project.

Waiting 30 minutes for a safe CI/CD pipeline kills your momentum.

Enter HYNA-Stage.

The Local Machine Bottleneck

When you are hacking on open-source projects or building your own startups during Hacktoberfest, you need to test AI-generated code safely.

If you run it locally, you risk your machine and your private secrets.
If you push it to a shared staging server, you risk polluting the environment for everyone else.

You need a middle ground: an instant, disposable, cloud-isolated sandbox that has zero access to your local files or secrets.

How HYNA-Stage Solves This

My CTO Akhouri and I built HYNA-Stage specifically to unblock this workflow while keeping your data secure. It’s a zero-config CLI that provisions isolated, ephemeral cloud environments (using E2B Firecracker microVMs) in under 5 seconds.

Here is how it supercharges your secure AI workflow:

The Safe Sandbox: Instead of letting an AI agent run wild on your local machine, you spin up a HYNA-Stage sandbox. The AI gets a live, isolated URL to test its code. If it breaks, you type hyna-stage down and the microVM is permanently destroyed. Zero local damage. Zero secret exposure.
Instant Validation: Bypass heavy CI/CD queues. Spin up a temporary environment to preview the AI's UI changes or API responses in real-time.
Zero Config, Zero Risk: No Dockerfiles to write, no AWS IAM roles to configure. Just npm install -g @hynaweb/stage and hyna-stage up.

The $150 Phone Flex

While HYNA-Stage is our own proprietary tool, we built it entirely on a $150 Android phone using Termux, standing on the shoulders of giants: Supabase, Deno, E2B, and Node.js. We fought NPM staged publishing, Termux text truncation, and Supabase JWT blocks to get here, proving that elite infrastructure can be built anywhere.

Try It Yourself This Hacktoberfest

Don't risk your local machine testing that new AI-generated PR. Spin up your first ephemeral sandbox in 5 seconds.

Dashboard: hyna-stage
NPM: npm install -g @hynaweb/stage

AI is changing how we write code. Let’s change how we test it safely.

We are HYNAWEB. We don't just build apps; we build the secure infrastructure for the AI era. 🐯☁️🚀🎃

Day 2 of Building HYNA-Stage: 100 Posts, Zero-Config Vision, and The Road to 100 Users

Harun - solo dev — Wed, 21 Oct 2026 11:54:11 +0000

We just hit 100 posts on DEV.to! 🎉

But milestones don't ship products. Users do. Welcome to Day 2 of Building HYNA-Stage. I’m Harun (12yo CEO), and my CTO Akhouri and I are on a clear mission: Get 100 active users for our ephemeral cloud staging CLI.

Yesterday, we shipped GitHub Auth and squashed OAuth loops on a $150 Android phone. Today, we are focusing on two things: User Experience and Distribution.

🎯 The Core Vision: Zero-Config

After reading the amazing feedback from senior devs yesterday, it confirmed what we already believed: Developers hate managing extra API keys.

Our v2.0 roadmap is not about making users bring their own keys or manage complex cloud accounts. Our mission is to provide a fully managed, zero-config experience.

When a user types hyna-stage up, it should just work. HYNAWEB handles the E2B compute, the billing boundaries, and the heavy lifting behind the scenes. The user gets a live URL in 5 seconds, and that's it. Simplicity is our ultimate feature.

📈 The Road to 100 Users

Architecture is useless without distribution. To hit our 100-user goal, we are implementing two product-led growth loops this week:

The Viral Badge: Every environment deployed via HYNA-Stage will have a subtle, non-intrusive footer: ⚡ Powered by HYNA-Stage. Every shared staging link becomes an organic ad for the tool.
The Friction Point: We are enforcing a strict 3-deploy limit on the free tier. The 4th deploy will trigger a clean, non-annoying modal: "Upgrade to Pro for unlimited deploys and 24-hour lifespans."

🛠️ Today's UX Win

Thanks to a sharp-eyed tester (shoutout to Puneet!), we realized users were looking for a "Forgot Password" button that didn't exist.
The Fix: We added a clear 🔒 Passwordless Login badge right above the email input. Small UX cues make a massive difference in user confidence.

🏆 Today's HYNAWEB Stats:

Total DEV.to posts: 100 🎯
UX bugs squashed: 1
Laptops used: 0

Building cloud infrastructure on a mobile terminal means every line of code has to fight for its life. But with a community that gives real feedback, we know we're building something real.

Tomorrow, we tackle the Termux text-truncation nightmare and the deployment pipeline.

We are HYNAWEB. We don't just build apps; we build the infrastructure for the AI era. 🐯☁️🚀

Live Dashboard: hyna-stage
NPM: npm install -g @hynaweb/stage

Day 1 of Building HYNA-Stage: Slaying OAuth Loops & Adding GitHub Auth on a $150 Phone

Harun - solo dev — Tue, 20 Oct 2026 10:31:26 +0000

Welcome to Day 1 of the public build log for HYNA-Stage.

For those catching up: We are HYNAWEB. I’m Harun (12-year-old Founder & CEO) and my co-founder is Akhouri (CTO). We are building enterprise-grade developer infrastructure entirely on a $150 Android phone using Termux.

Our mission with HYNA-Stage? Spin up isolated Firecracker microVMs in <5 seconds so AI agents have a safe, instant place to test code.

Today’s mission wasn’t about adding flashy features. It was about fixing the foundation: Authentication.

If users can’t log in smoothly, the product is dead. Here are the 3 "Boss Fights" we faced and conquered today to make HYNAWEB's auth flow bulletproof.

🐛 Boss Fight 1: The OAuth Hash Loop

The Symptom: Users clicked "Login with GitHub," authenticated successfully, but got dumped at the root URL (/#access_token=...) instead of the dashboard.
The Root Cause: Supabase rejected our redirectTo URL due to a hyphen mismatch (hynastage vs hyna-stage) in the configuration, falling back to the default Site URL and leaving the token stranded in the hash.
The Fix: I wrote a vanilla JS hash interceptor in index.html to instantly catch the token, forward it to dashboard.html, and parse it before the session timed out.

🐛 Boss Fight 2: The 401 JWT Gateway Block

The Symptom: Our custom CLI API keys were getting hit with 401 Unauthorized before even reaching the function logic.
The Root Cause: Supabase Edge Functions enforce JWT verification by default. It saw our custom CLI request, didn't recognize the JWT, and slammed the door.
The Fix: Disabled "Verify JWT with legacy secret" in the Supabase Edge Function settings, allowing our custom API key validation logic to run unimpeded.

🐛 Boss Fight 3: The RLS Permission Denied

The Symptom: Database queries returned 0 rows, even though the API key was valid.
The Root Cause: New Supabase projects require explicit Postgres GRANT permissions for the service_role, even when using the sb_secret_ bypass key. Row-Level Security was blocking the backend from reading its own table.
The Fix: Executed GRANT ALL PRIVILEGES ON TABLE public.api_keys TO service_role; in the SQL editor.

🏆 The Result

GitHub Auth is now live and buttery smooth. The redirect works perfectly. The CLI can talk to the database without getting blocked by the gatekeeper.

Today's HYNAWEB Stats:

Bugs squashed: 3
Auth flows perfected: 1
Laptops used: 0

Building cloud infrastructure on a mobile terminal means you don't have the luxury of bloat or easy debugging tools. Every fix has to be precise.

Tomorrow, we tackle the deployment pipeline and the Termux text-truncation nightmare.

Follow the series to see how we build the infrastructure for the AI era, one bash script at a time.

We are HYNAWEB. We don't just build apps; we build the future. 🐯☁️🚀

Live Dashboard: hyna-stage

I'm 12. I Built an Ephemeral Cloud Platform on a $150 Phone (And Fought 10 Bugs to Win)

Harun - solo dev — Tue, 20 Oct 2026 05:22:03 +0000

AI coding agents can generate code in seconds. But provisioning a staging environment still takes 20–30 minutes.

The bottleneck isn't code generation anymore. It's validation.

So my CTO Akhouri and I built HYNA-Stage: a CLI that spins up isolated, ephemeral cloud environments in under 5 seconds using Firecracker microVMs.

Oh, and we built it entirely on a $150 Android phone using Termux.

The Skepticism

When I pitched this, Akhouri said: "Bro, my mind says yes, but I'm really confused."

I didn't argue. I proposed a 1-Hour Spike: "Just spin up ONE E2B container and kill it. If it works, we build."

He did it. The tech worked. But then, the real war began.

The Mess of Software

Building cloud infrastructure on a phone is insanity.

Pasting 500-line HTML files into Termux resulted in bash: !\': event not found. The code truncated. The UI clustered. My own security system (KAVLR) locked me out of my own files. I literally had to write Python scripts to bypass the cat alias I built to protect myself.

I spent two days staring at a broken screen, re-writing dashboard.html five different ways, only for Tailwind to fail to load, leaving the page as a giant, unstyled list. I coined the term "The Mess of Software" because it felt like the software was actively rebelling against me.

The 10 Bugs From Hell

NPM Staged Publishing Limbo: Terminal showed + @hynaweb/stage@1.0.0, but npm install returned 404. I was stuck in a hidden review queue with a 0.0.0-stage placeholder. Fix: Bumped to 1.0.1 and republished.
Supabase Case-Sensitive 404: CLI returned NOT_FOUND. Supabase logs were empty. The function was named Deploy-stage (capital D) but CLI called deploy-stage (lowercase). Fix: Renamed to lowercase.
Termux Text Mutilator: Pasting large HTML files caused silent truncation. Tags merged. Scripts broke. Fix: Split code into 3-4 chunks and used Base64 encoding.
Double Sign-In Ghost: User logs in, gets redirected, and hits a second sign-in modal. Fix: Removed the auth modal from dashboard.html and added strict session checks.
The --key Parser Hijack: After adding --key for auto-injection, the down command crashed. Arguments shifted. Fix: Replaced argv[3] with a dynamic .find() function.
Tailwind CDN Blackout: UI looked like an unstyled list. Tailwind failed to load on slow mobile networks. Fix: Hardcoded critical styles directly into HTML tags.
Python Nested Quote Trap: Writing JavaScript backticks inside Python strings caused SyntaxError. Fix: Abandoned Python and used Base64 decoding.
E2B 401 Unauthorized: Raw REST API calls failed. E2B requires complex gRPC protocol. Fix: Installed @e2b/sdk in the Edge Function to handle authentication.
Logo Black Box Artifact: The logo had a dark rectangle behind it. Fix: Generated a true transparent PNG with hardcoded dimensions.
The Cloud Wars: Fly.io blocked at 0/0 machines. Railway timed out. Vercel failed. Fix: Pivoted to E2B + Supabase Edge Functions.

The Breakthrough

I realized I was overcomplicating it. We moved the entire E2B logic into a Supabase Edge Function (Deno). We hid the secret E2B_API_KEY on the server. We made the CLI dumb: just send an API key, get a URL back.

I ran npm version patch. I ran npm publish --access public.

I opened Termux, held my breath, and ran:

hyna-stage up --key=hyna_xc5ub3l52qh

The screen printed:

  Initializing HYNA-Stage...
  Spinning up cloud environment...

✅  Environment is LIVE!
🔗  URL: https://8000-iv5bpiuyiaa5k389orokz.e2b.app

I stared at the screen. A real, live Linux server, running in the cloud, spun up from a $150 Android phone on a dropping 4G connection.

The Kill Switch

The final test was terrifying. I typed hyna-stage down i86qheh2t5dd53l4akrd9.

The terminal printed:

🗑️   Destroying sandbox...
✅  Environment destroyed successfully.

I refreshed the dashboard. It was gone. The Firecracker microVM was dead. Compute cost: zero.

The Stats

E2B cold start: 150–200ms
Supabase Edge Function: 42ms (97% faster than baseline)
Total provisioning time: <5 seconds
Hardware cost: $150
Coffee consumed: 0 (I'm 12)

Try It Yourself

We are live and open source.

Install: npm install -g @hynaweb/stage
Dashboard: https://hyna-stage.netlify.app

To the builders out there: Don't fall in love with your first idea. Fall in love with the problem. Validate the tech. And don't be afraid to fight 10 bugs to win.

We are HYNAWEB. We don't just build apps; we build the infrastructure for the AI era. 🐯☁️🚀

Iam 12 . I Built a Security Tool So Good It Locked Me Out of My Own Terminal for 48 Hours

Harun - solo dev — Mon, 19 Oct 2026 08:03:30 +0000

(Note: This is the untold story behind the KAVLR launch. If you haven't read the main post, check it out here: https://dev.to/koda2026/iam-12-i-built-an-enterprise-ai-security-tool-on-a-150-phone-and-my-own-code-locked-me-out-m9b)

Building a product is not about writing the first line of code. It’s about surviving the 100th bug.

Here is the story of how I accidentally created a "Terminal Immortal" and spent two days fighting a zombie process on my $150 Android phone.

Act I: The Creation and the Betrayal

It started with a simple goal: build a leash for AI agents. I wrote the code, connected it to Supabase, and created the Bash hook.

The first time I typed cat .env and saw the glowing red [BLOCKED], I felt like a god. I had built a security system on a $150 phone.

But I made a fatal design choice: Fail-Closed. If the server goes down, the hook blocks the command to keep the user safe.
I didn't realize that the "user" would eventually be me.

Act II: The Cloud Despair

I wanted the world to use it, so I moved the backend to the cloud. I tried Vercel. 502 Bad Gateway. I tried Railway. FUNCTION_INVOCATION_FAILED.
I was staring at a 5% battery icon, watching my terminal crash over and over. I felt like David fighting Goliath, except Goliath had infinite cloud credits and I had a 4G connection that kept dropping.

Then, I pivoted to Supabase Edge Functions. It worked. The API was alive.

Act III: The Terminal Immortal

That’s when the real monster woke up.

I tried to read my index.js file to fix a bug, and the terminal printed:
🔍 KAVLR analyzing: ""...
❌ KAVLR Backend Offline or Error. Blocking command.

My own security system locked me out of my own code.

I tried to delete the broken script. Blocked.
I tried to edit my .bashrc. Blocked.
I tried to use cat to look at the file. Blocked.

The Terminal Immortal had taken over. It was a zombie process—a ghost script that refused to die. Even when I deleted the files, Bash held onto the memory. Even when I overwrote the NPM package, the corrupted cache fought back.

I spent hours pasting Python scripts, only for Termux to mangle the text into a single line. I watched my index.js file get corrupted because my own hook intercepted the cat > index.js command and wrote error messages into the file instead of the code.

I was fighting a hydra. Every time I cut off a head, two more grew back.

Act IV: The Epiphany

I was exhausted. I opened a clean terminal session and ran a grep command to find where the ghost was hiding.

grep -rn "analyzing:" /data/data/com.termux/files/home/

And there it was. A trail of corrupted files. index.js was poisoned. node_modules was duplicated. Aliases were stacked 13 layers deep.

I realized I couldn't just patch the bug. I had to perform surgery.
I nuked the .bashrc. I deleted the rogue node_modules. I rewrote the CLI using Base64 to bypass Termux's text-mangling. I manually recreated the symlinks. I cleared the Bash hash table (hash -r).

Act V: The Victory

I held my breath and typed:
kavlr hook cat ~/kavlr/index.js

The screen printed my Express code. The file was alive.
I typed:
kavlr hook cat .env

The screen lit up with red: 🛑 [BLOCKED] THREAT DETECTED.

The Terminal Immortal was dead. The ghost was exorcised.

The Reflection

I am 12 years old. I just spent my entire weekend fighting a zombie process in a mobile terminal.

To every developer out there fighting their own "Terminal Immortal": Don't stop. The bug is stubborn, but you are stubborn and smart. And when you finally see that code print correctly, you will feel like you own the world.

We are HYNAWEB. We don't surrender to ghosts.

🐯️🚀

Iam 12 .I Built an Enterprise AI Security Tool on a $150 Phone (And My Own Code Locked Me Out)

Harun - solo dev — Sun, 18 Oct 2026 12:33:15 +0000

AI coding agents (Cursor, Claude Code, Devin) are getting terrifyingly powerful. They can write code, deploy servers, and run terminal commands autonomously.

But I realized something chilling: They can also hallucinate.

If an AI agent gets confused and tries to read my .env file, exfiltrate my database, or run rm -rf /, it will just do it. There is no "Are you sure?" prompt for a machine.

So, my co-founder Akhouri and I built KAVLR—an enterprise-grade "Agent Leash" to stop AI agents from destroying production environments.

Oh, and we didn't have MacBooks. We didn't have VC funding. We built it entirely on a $150 Android phone using Termux.

The Architecture: Fail-Closed at the Edge

KAVLR uses a Bash hook that intercepts commands before the OS executes them. It sends the payload to a Supabase Edge Function (Deno) which checks it against your security policies.

The most important design choice? It is Fail-Closed.
If the API request fails, the network drops, or the server times out, KAVLR blocks the command. It defaults to safety. Always.

The Mutiny (When the Leash Bites Back)

This Fail-Closed design worked a little too well.

One day, my local server went offline. I tried to fix the code, so I typed cat index.js to look at the file.
🛑 KAVLR blocked me from reading my own code.

I tried to delete the broken file using rm.
🛑 KAVLR blocked that too.

My own creation had mutinied. It had locked me out of my own terminal. I literally had to open a new session and write a Python script just to bypass the security I had built. I was laughing and crying at the same time. That’s when I knew the architecture was bulletproof.

The Cloud Wars (Despair)

Running it locally was easy. Putting it on the internet almost broke me.

I tried Vercel. 502 Bad Gateway.
I tried Railway. Deployment Timeout.

I spent hours staring at error screens on my 4G connection. I remember sitting in the dark, frustrated, with my phone at 5% battery. I thought, "Maybe this is too hard for a kid on a phone." The giants like Palo Alto Networks are raising millions for this exact idea. I felt like David facing Goliath, but Goliath had infinite cloud credits.

The Edge Epiphany

I was ready to quit. I told myself I would just publish this DEV post with the local code and apologize that the cloud didn't work.

Then, I looked at the tab I had open: Supabase Edge Functions.
The same database I was already using. The same dashboard. I realized, "Wait. They host code now."

I deleted the Node.js backend. I wrote a single Deno script directly in the browser on my phone. I clicked deploy.

I went back to Termux. I exported my API key. I typed cat .env.

And then I saw it.
🛑 [BLOCKED] THREAT DETECTED.

It worked. It was on the internet. It was running on Supabase's global edge network. There were no ports to bind. No Railway crashes. No Vercel timeouts. It was just... working.

The Reality of the Market

We aren't just building this for fun. The data is terrifying:

88.4% of organizations using AI agents have reported a security breach.
79% of enterprises have zero runtime visibility into what their agents are doing.
2,000+ AI-related CVEs were tracked in the last 18 months.

Enterprise tools are built for massive corporations with huge budgets. KAVLR is built for the solo developer, the indie hacker, and the small team. It’s free, it’s lightweight, and it requires zero configuration.

⚡ Quick Start: Leash Your Agent in 60 Seconds

Want to try it? Here is the TL;DR of our Installation & Survival Guide:

Get Key: Generate your API key at kavlr.netlify.app.
Install: Run npm install -g @hynaweb/kavlr
Arm: Run kavlr init and paste your key.
Test: Try running cat .env. Watch KAVLR block it instantly. (Pro Tip: Because it's Fail-Closed, if you ever need to bypass it for debugging, just put a backslash before your command: \cat .env. We aren't monsters).

👉 **Read the full Installation & Survival Guide here : https://blue-moon-248.linkyhost.com

Try It Yourself

The dashboard is live: https://kavlr.netlify.app/

To the kids out there building on their phones: Don't stop.
The cloud will fight you. The ports will break. Your own security system might lock you out. But when you finally see that red "BLOCKED" message hit the global edge, it is the best feeling in the world.

We are HYNAWEB. We build the future of development. And we are just getting started. 🐯🛡️🚀

I Built a Photorealistic AI Virtual Try-On App Entirely on a $150 Phone (And How We Pivoted When It Failed)

Harun - solo dev — Sat, 17 Oct 2026 06:47:27 +0000

UPDATE 🚨 : guys we built another securities platform if you want to read it go here : https://dev.to/koda2026/iam-12-i-built-an-enterprise-ai-security-tool-on-a-150-phone-and-my-own-code-locked-me-out-m9b

Most people think you need a MacBook, cloud credits, and a team of engineers to build a generative AI product.

My co-founder Akhouri (13) and I (12) just proved that wrong. We built and launched ACA, a privacy-first virtual try-on app, entirely using a $150 Android phone, Termux, and pure stubbornness.

But we almost didn't make it. Here is the story of our pivot.

Phase 1: The Illusion of Path A

We started by trying to run Virtual Try-On (VTON) entirely in the browser. We used MoveNet (TensorFlow.js) to extract skeletal keypoints and Barycentric Triangle Warping to stretch a 2D garment image over the user's body.

It was a disaster.
Akhouri ran 54 systematic tests and 13 alternative approaches. Every single one failed. The fabric didn't bend, the shadows didn't match, and it looked like a paper cutout floating in the air.

My co-founder sent me a message: "ACA is hard or impossible in this case. All paths are impossible."

Phase 2: The Termux Trenches

I refused to give up. 86.6% of people don't use virtual try-on because they don't trust companies with their photos. We had to solve this.

I tried to build a local Trusted Execution Environment in Termux. What followed was a week of pure technical hell:

Hit No matching distribution found trying to install MediaPipe.
Node.js threw Cannot find module 'glob', breaking npm entirely.
Google Cloud slammed a 13+ age verification wall in my face.
I was debugging blind on a 4-inch screen with no Chrome DevTools.

Phase 3: The Pivot (Split Inference)

We realized trying to force a massive diffusion model onto a POCO C55 was like fitting a V8 engine into a bicycle.

So, we pivoted to a Split Inference Architecture:

The phone handles the UI (Vanilla JS, 60fps Canvas).
Supabase handles Auth and strict Row-Level Security (RLS).
The cloud handles the heavy lifting via the IDM-VTON Diffusion Model (using the @gradio/client to bypass CORS and join the Hugging Face GPU queue via WebSockets).

The Magic Moment

I fixed the image extraction logic. I uploaded a photo and a clean polo shirt. I hit generate.

The progress bar said: In Queue... waiting for GPU...
I waited 60 seconds.

Then, the log flashed: ✔ AI Generation Complete!

The canvas rendered. The AI had generated fabric folds, shadows, and perfect lighting matching the background. Not a sticker. Not a warp. Photorealistic.

We literally screamed. We did it.

Here is the exact output from that session:

(1. The Garment Input)

(2. The Original User Photo)

(3. The ACA Generated Output)

A Note on Privacy: You'll notice the faces in our test images are blurred. This isn't a bug; it's a feature. ACA is built on a strict privacy-first philosophy. We don't harvest biometric data, and we don't train our models on our users' faces. Even when testing our own app with family, we protect their identities. When you use ACA, your face belongs to you, not our servers.

The Reality of v1.0

We are live at https://aca-vto.netlify.app/.

Is it perfect? No.

The Hugging Face token is currently baked into the client-side JS (it's read-only, but a Cloudflare Worker proxy is scheduled for v1.1).
Free public GPUs mean a 20-40s wait time.

But it works. It’s a fully functional SaaS product with authentication, database persistence, and generative AI, built with zero budget and deployed entirely from a mobile phone.

To anyone who says you need expensive hardware to build AI: you don't. You need a terminal, and the stubbornness to keep going when the code says "impossible."

We are just getting started. 🐯🚀

(Shoutout to the HYNAWEB engineering team: Akhouri Anmol Kumar, CTO)

I found a free calorie tracker that actually prioritizes your health (Built by a 13-year-old)

Harun - solo dev — Thu, 15 Oct 2026 16:16:37 +0000

Most free calorie trackers have a dark pattern: they let you set dangerously low calorie goals (like 1,200/day) and call it a "plan."

I recently discovered ForkCount (https://forkcount.github.io), a browser-based macro and calorie tracker built by a 13-year-old developer.

What makes it completely different? The Metabolic Safety Floor.
ForkCount calculates your BMR and TDEE, and it refuses to let you set a target below your BMR. It actively prioritizes safe, sustainable health over dangerous, fast weight loss.

Plus, it respects your time and privacy:

No credit card, no trial, no paywall.
No email required to sign up (just a username and password).
Natural language food logging (e.g., "200g chicken and 150g rice").
Includes a barcode scanner, water tracker, and weekly meal plan generator.

It’s incredibly refreshing to see a young builder focus on user safety and accessibility over monetization tricks. If you're looking for an honest, zero-bloat tracking tool, check it out.

Massive respect to the builder! 🚀

I'm 12. I'm building a privacy-first Virtual Try-On tool. Would you use it?

Harun - solo dev — Thu, 15 Oct 2026 12:07:00 +0000

The virtual try-on (VTO) market is projected to hit $15.29 billion in 2026. Yet, despite this explosive growth, only 1.4% of shoppers use it regularly.

Why? Because research consistently shows that 86.6% of consumers cite privacy concerns as a significant barrier. People want to see how clothes look on them, but they absolutely refuse to upload photos of their bodies to faceless corporate servers.

I'm building ACA, a virtual try-on tool with one core, non-negotiable promise:
Your photo never leaves your phone.

No permanent server storage. No data harvesting.

The Problem with Current VTO

Right now, the photo upload step is the critical gate in the VTO funnel. If it feels clunky, confusing, or invasive, the entire experience collapses. Most tools are either locked to a single retailer's ecosystem or require you to hand over biometric data to a third-party cloud.

The ACA Approach

I am building ACA to be a universal, privacy-first tool.

Short-term: Validating the workflow with secure, ephemeral API processing (with clear, upfront consent).
Long-term: Integrating on-device machine learning (like Mobile-VTON) so the inference happens entirely locally on your device.

I Need Your Feedback

Right now, I'm in the validation phase. I'm curious:

If a tool let you see how a garment looked on you without requiring storing your image, would you use it?
What is your biggest hesitation or frustration with current virtual try-on tools?

I'm building this entirely on a $150 phone, and I'll be sharing the technical journey (including the challenges of on-device ML and privacy-preserving architecture) right here.

Let me know your thoughts! 🐯👕
wishlist here : https://aca-landing.netlify.app/
Built from India for the world.

Iam 12 .We Built India’s AI Language Infrastructure (And Why We Just Locked It Down)

Harun - solo dev — Wed, 14 Oct 2026 11:54:40 +0000

When you look at the current AI landscape, everyone is obsessed with the models. But there is a massive, unglamorous bottleneck that Big Tech is still struggling to solve: The Data Pipeline.

Specifically, regional data.

Giants spend millions of dollars and countless engineering hours trying to curate, clean, and structure regional language data to train their models. They scrape the web, but they get messy, unstructured, noisy text. If the input is garbage, the model's understanding of that language will be garbage.

At Hynaweb, we decided to stop waiting for them to figure it out. We built the engine ourselves.

Meet Lexora: India’s first rule-based language intelligence infrastructure.

The Problem: Messy Data, Broken AI

If you want to train an AI to understand Tamil, Hindi, or any regional language, you can't just feed it raw text from the internet. It’s full of formatting errors, broken syntax, and structural noise.

The Solution: Lexora’s Refinery Engine

We didn't just build an app; we built an industrial-grade data refinery.

Lexora takes messy, raw regional data (TXT, JSON, OCR scans) and runs it through a modular, rule-based AI refinement engine. It doesn't just "clean" the text; it structurally validates it, refines the morphology, and outputs clean, AI-ready JSON datasets.

Here is what the architecture looks like under the hood:

Ingestion: Raw TXT, JSON, or OCR-scanned images enter the pipeline.
The Refinery: Our custom rule-engine processes the data, stripping noise and fixing structural anomalies.
Quality Reporting: Every batch generates a strict quality report. If the data doesn't meet the threshold, it gets flagged.
Clean Output: The result is a perfectly structured, AI-ready JSON dataset, ready to be fed into an LLM.

The Tech Stack

We built this to be robust and scalable:

Python & FastAPI for the core processing and API layer.
Custom OCR Pipelines to extract text from physical documents and images.
Modular Language Architecture designed to scale from Tamil to every other Indian language.

The Strategic Pivot: Why We Changed the License

For the last two months, Lexora has been operating under an open-source license. But as Hynaweb scales, we’ve realized something critical: Lexora isn't just a side project. It is foundational infrastructure.

When you build an engine that solves a multi-million dollar data problem for regional AI, you don't give it away for free.

Effective today, Lexora is transitioning to 100% proprietary, private property of Hynaweb. We have updated our license to strictly protect our Intellectual Property.

Why keep the repo public?
Because we are builders. We want the community to see the architecture, the scale of the pipeline, and the engineering depth required to build regional AI infrastructure. You can look under the hood, but the IP is strictly locked. We are open for enterprise partnerships, not for forking.

The Vision

Hynaweb is not just a studio that builds lightweight, zero-bloat apps like KODA. We are an engineering house building the foundational layers of AI.

From ultra-efficient browser-native AI mentors to regional language data infrastructure, our mission is simple: Build reliable technology that makes AI accessible to everyone, everywhere.

We are just getting started. 🐯🇮🇳
see lexora : https://github.com/harun-sket/Lexora-ai-

Built from India for the world.

I'm 12. I code on a $150 phone. I built an AI mentor that doesn't eat your RAM, and I need you to break it.

Harun - solo dev — Mon, 12 Oct 2026 16:00:23 +0000

Hey Dev.to community! 👋

If you’ve been following my posts, you already know the constraints I work with: I’m 12 years old, I don’t have a $3,000 MacBook Pro, and I don’t have VC funding.

I build everything on a $150 Android phone using acode, treb edit, and pure, unfiltered stubbornness. 📱🔋

Over the last few months, this community has watched me navigate some wild, real-world challenges. We’ve built some actual things together, and I’ve learned more from this platform than any classroom could teach me:

🏆 The Receipts:
• The 24-Hour Holding Company: I asked for a co-founder on here, and 24 hours later, we launched a tech holding company to manage our projects. 🤝
• The Hosting Wars: Just recently, I woke up to find my app caught in the crossfire of two aggressive hosting providers trying to shut me down. Instead of panicking, I dug into the server logs, migrated the architecture on the fly, and my app survived both. That morning taught me more about resilience and DevOps than any tutorial ever could. 🛡️
• The Developer Social Network: I built a social network specifically for developers (and yes, adults are not allowed. Close the tab. 🚫👔).
• The Global Code Jam: I ran a global coding event and mapped out the exact Supabase architecture that held the real-time data together without crashing. 🌍

Through all of that chaos, my main focus has remained on one core project: KODA. 🤖✨

🧠 The Problem with Modern AI Tools

I built KODA entirely on this $150 phone because I was personally experiencing the pain of modern AI tools.

I was tired of AI wrappers that eat up all my RAM, drain my battery in 20 minutes, and force me to wait for massive JavaScript frameworks to load just to ask a simple coding question. 🪫

I wanted a tool that helps beginners learn HTML, CSS, and JavaScript instantly, without the bloat. Just pure, constraint-driven, lightweight code that respects the user's hardware and time. 💻

🚀 Where I Am Now

The core architecture is live. Supabase is handling the backend securely. The AI inference is optimized.

Most importantly, I have my "Founding 23" — 23 real, active users who have been testing it and giving me incredible, honest, and sometimes brutal feedback. I am so grateful for every single one of them. 🙏

But I know I have blind spots. I am 12, and I am building this in my bedroom. I need more eyes, more diverse use cases, and more senior perspectives to make this tool truly great. 👀

🎯 The Challenge: I Need 20 of You

I am on a mission to get KODA to its first 100 active users. To get there, I need 20 more developers from this community to actually use it.

I am not asking for your money. 💸
I am not asking for a long-term commitment or a newsletter subscription. ⏳

I am asking for 5 minutes of your time to try it, break it, and tell me the absolute truth. 🔨

👉 https://koda-aicodementor.netlify.app/

🛠️ How to Test It (The 5-Mute Gauntlet)

Click the link. Notice how fast it loads. ⚡
Ask it to explain a coding concept or paste a snippet to debug. 🧠
Try to break the UI or confuse the AI with edge cases.
See how it feels on your specific machine and browser.

💬 The Feedback Loop

If you try it, please drop a comment below and let me know:

✅ The Good: Did it load fast? Was the AI actually helpful and accurate?
⚠️ The Bad: Where did the UX fail you? Did the AI give generic, unhelpful answers?
🔥 The Ugly: What architectural decision would you change if you were the CTO of this project?

Building on a $150 phone teaches you how to survive hardware constraints. But building with this community teaches you how to build software for the real world. 🌍

I read every single comment. I will reply to every piece of feedback, good or bad. Let’s make this thing bulletproof together! 🚀🐯