DEV Community: Harun - solo dev

Iam 12 . I Stopped Coding Features and Started Designing Experiences. Here Is KODA cursor v0.4.0.

Harun - solo dev — Fri, 02 Oct 2026 04:25:07 +0000

I am 12 years old.
My development machine is a POCO C55 ($150 USD).
It is December 2nd.

Yesterday, I shipped v0.3.1. It worked. But it felt like a prototype.

Today, I shipped KODA v0.4.0. And for the first time, it feels like a product.

Most solo founders obsess over adding AI capabilities. They add more models, more prompts, more complexity.

I did the opposite. In v0.4.0, I added zero new AI logic. Instead, I focused on three things that actually make software usable:

Control (Settings Drawer)
Choice (Code Master Model)
Delight (UI Overhaul)

Because users don’t care if your LLM has 70 billion parameters if they can’t change the temperature without editing JSON files.

⚡ THE THREE PILLARS OF V0.4.0

1. Control: The Native Settings Drawer

Before v0.4.0, configuring KODA meant opening settings.json and typing keys like koda.autoApply. That is hostile UX.

Now, there is a slide-in drawer triggered by a gear icon ⚙️.

8 Configurable Options: Model selection, Temperature slider, Auto-apply toggle, Web Search default, Source visibility, Delete confirmation, Context file limit, Worker URL override.
Live Reload: Change a setting? It applies instantly. No restart. No reload window.
Two-Way Binding: Edit the drawer? It updates settings.json. Edit settings.json manually? The drawer updates instantly.

This isn’t just convenience. It’s respect for the user’s time.

2. Choice: Introducing "Code Master"

Not every task needs the fastest model. Debugging complex race conditions or refactoring legacy monoliths requires reasoning, not just prediction.

So I added a fourth option: DeepSeek R1 Distill Qwen 32B.

Mode	Model	Best For	Latency
Auto	GPT-OSS-120B	General purpose	1.5–3s
Smart	GPT-OSS-120B	Quality focus	1.5–3s
Fast	GPT-OSS-20B	Speed/Budget	<1.5s
Code Master	DeepSeek R1	Reasoning/Debugging	5–15s

The Magic Trick:
DeepSeek R1 emits intermediate "thinking" tokens. Most tools dump these into the chat, confusing users. My Worker parses ONLY the final delta.content, discarding the reasoning trace.

Result? You get the wisdom of a reasoning model with the cleanliness of a standard chat.

3. Delight: The UI Overhaul

A tool should feel good to use. So I stripped away the noise.

Icon-Only Header: Less text, more space. Hover reveals tooltips.
Pulsing Streaming Indicator: Replaced the blinking block cursor with a smooth, breathing dot. It signals "alive" without distracting.
Date-Grouped History: Conversations are no longer a flat list. They are grouped by "Today," "Yesterday," "Last Week."
Search Box: Find any past chat instantly.
Starter Chips: Empty state now offers clickable prompts (/explain, /fix) so you never stare at a blank input box.
Cleaner Messages: User bubbles are compact right-aligned. Assistant messages are full-width left-aligned. Code blocks have subtle left-accent bars instead of heavy borders.

It looks less like a plugin and more like a native part of VS Code.

🛠️ THE ARCHITECTURE: STILL VANILLA JS

Despite all this polish, the core constraint remains: No Build Step.

Total Size: ~22 KB.
Dependencies: Zero.
Language: Vanilla JavaScript.

How? By leveraging VS Code’s native APIs smarter, not harder.

Used vscode.workspace.onDidChangeConfiguration for live-reload settings.
Used CSS variables for theme-aware styling.
Kept the Worker simple: One map for model routing, one stream parser for SSE.

Complexity is easy. Simplicity under pressure is hard.

👑 WHY THIS MATTERS

In v0.1.0, I proved I could build it.
In v0.2.0, I proved I could make it fast.
In v0.3.0, I proved I could make it stable.

In v0.4.0, I proved I can make it loved.

Software is not just code. It is the sum of interactions. Every pixel, every millisecond of latency, every configuration choice shapes the user’s trust.

By giving users control (Settings), choice (Models), and delight (UI), I transformed KODA from a "cool experiment" into a "daily driver."

📥 GET THE POLISHED BUILD

Download v0.4.0 here: github.com/harun-sket/Koda-cursor/releases/tag/v0.4.0

Grab koda-cursor-0.4.0.vsix (22 KB).
Install via Ctrl+Shift+P → "Extensions: Install from VSIX".
Restart VS Code.
Click the Gear Icon ⚙️. Switch to Code Master.
Paste a messy, buggy function. Type /debug.
Watch it reason silently, then deliver the perfect fix.

Age doesn’t matter. Device doesn’t matter.

Craftsmanship matters.

See you in v0.5.0. Where we go multi-step agent loops. 🐯✨

Iam 12 .I Shipped a Buggy Version on Purpose. Here Is Why KODA v0.3.1 Is Better Than Any "Perfect" Release.

Harun - solo dev — Thu, 01 Oct 2026 12:45:14 +0000

I am 12 years old.
My development machine is a POCO C55 ($150 USD).
It is December 1st.

Yesterday, I launched v0.1.0.
Today morning, I launched v0.2.0.
An hour ago, I launched v0.3.0.

But here is the truth: v0.3.0 had bugs.

Not tiny typos. Real issues. Conversation history didn’t save correctly in some edge cases. The lightbulb menu crashed if no file was open.

Some founders would have deleted the release. They would have pretended it never happened. They would have waited three days for QA to sign off before admitting anything.

I did none of that.

Within two hours, I identified the root causes, wrote the patches, tested them locally, and shipped KODA v0.3.1.

And I marked v0.3.0 as "Bugy / Deprecated."

Why? Because trust is built in the repair, not just the reveal.

⚡ WHAT WAS BROKEN IN V0.3.0?

Let’s be specific. Transparency builds credibility.

History Persistence Race Condition:
- Symptom: If you closed VS Code too quickly after sending a message, the chat history sometimes failed to write to workspaceState.
- Cause: Async operation wasn’t awaited properly during the dispose event.
Lightbulb Menu Crash on Empty Editor:
- Symptom: Clicking the lightbulb when no file was open threw a TypeError: Cannot read properties of undefined.
- Cause: Missing null-check guard in the CodeActionProvider.
Context Injection Lag:
- Symptom: @problems worked, but added ~200ms latency due to unoptimized diagnostic fetching.
- Cause: Fetching all diagnostics globally instead of filtering by active document first.

🛠️ HOW V0.3.1 FIXED IT (IN 2 HOURS)

Fix 1: Awaited Dispose Handler

Updated the webview disposal logic to ensure saveConversation() completes before the panel closes. Added a timeout fallback so the UI doesn’t hang if storage is slow.

Fix 2: Null-Safe Code Actions

Added strict guards in provideCodeActions:

if (!editor || !editor.document) return [];

No more crashes. No more errors. Just silence where there should be options.

Fix 3: Optimized Diagnostics Query

Changed from global getDiagnostics() to targeted getDiagnostics(activeDocument.uri). Reduced context payload size by ~40% and eliminated the lag.

👑 WHY SHIPPING BUGS IS OKAY (IF YOU FIX THEM FAST)

In traditional software, bugs are failures.
In solo-founder velocity, bugs are data points.

By shipping v0.3.0, I got real-world testing that I couldn’t simulate on my phone. Users found the race condition within minutes. If I had kept it private for "QA," I would have wasted days guessing.

Instead, I spent 2 hours fixing what actually broke.

The Lesson:
Don’t aim for perfect code. Aim for fast recovery.

📊 THE VERSION HISTORY (HONEST EDITION)

Version	Status	Key Feature	Known Issue	Resolution
v0.1.0	❌ Deprecated	Genesis Chat	Static Placeholders (XSS Risk)	Fixed in v0.2.0
v0.2.0	⚠️ Untested	Streaming + Slash Cmds	`@problems` Collected but Unused	Wired in v0.3.0
v0.3.0	🐞 Bugy	History + Lightbulb	Race Condition + Crash	Fixed in v0.3.1
v0.3.1	✅ STABLE	Hotfixes Applied	None Known	CURRENT LATEST

📥 DOWNLOAD THE CERTIFIED BUILD

Do not use v0.3.0. Use v0.3.1.

Get it here: github.com/harun-sket/Koda-cursor/releases/tag/v0.3.1

Grab koda-cursor-0.3.1.vsix.
Install via Ctrl+Shift+P → "Extensions: Install from VSIX".
Restart.
Test the history persistence. Close VS Code. Reopen. See your chats still there.
Click the lightbulb. See it work smoothly.

Age doesn’t matter. Device doesn’t matter. Perfection doesn’t matter.

Resilience matters.

See you in the logs. And yes, v0.4.0 might drop tomorrow. 😂🐯

Iam 12 .I Shipped Streaming & Slash Commands in 1 Hour. Here Is Exactly What Didn’t Work Yet (And How I’ll Fix It).

Harun - solo dev — Thu, 01 Oct 2026 10:28:53 +0000

I am 12 years old.
My development machine is a POCO C55 ($150 USD).
It is October 1st.

Yesterday evening, I launched KODA v0.1.0.
Today afternoon, I shipped v0.2.0 with streaming, slash commands, and new context sources.

Most founders would hide the bugs. They would pretend everything works perfectly.

I’m going to do the opposite. I’m going to show you exactly what is broken, what is missing, and why I shipped anyway.

Because in solo founder mode, velocity beats perfection. And honesty builds trust faster than any feature ever could.

⚡ WHAT SHIPPED IN V0.2.0 (THE WINS)

In less than an hour, I transformed KODA from a chat widget into an agentic assistant.

1. True Streaming (No More Spinners)

Before, you waited 3–6 seconds for the full response. Now, tokens render as they arrive via Server-Sent Events (SSE).

Result: First word appears in <500ms.
Feature: Added a Stop Button. If KODA starts hallucinating, kill it instantly. Save tokens. Save time.

2. Slash Commands (Muscle Memory)

Typing "Please explain this function" is tedious. Developers want shortcuts.
I added native slash command parsing:

/explain → Forces the "Problem → Cause → Solution" teaching mode.
/fix → Targets specific syntax/logic errors.
/test → Generates unit tests.
/doc → Writes JSDoc/Docstrings.
/refactor → Optimizes structure.
/optimize → Improves Big-O complexity.

These aren’t just prompts; they are intent classifiers that expand into structured requests with injected code context.

3. New Context Sources: `@problems` and `@git`

This is the game-changer.

@problems: Queries vscode.languages.getDiagnostics() to attach actual compiler errors/lint warnings to the prompt.
@git: Reads branch name and uncommitted changes via the VS Code Git API.

🛑 WHAT DIDN’T WORK YET (THE GAPS)

Here is the brutal truth. In v0.2.0, two major features are half-built.

Gap 1: `@problems` and `@git` Are Collected But Ignored

The extension gathers the diagnostics and git state perfectly. It sends them to the Cloudflare Worker.
But the Worker doesn’t use them yet.

Why? Because I prioritized getting the collection logic right before wiring the injection logic. If I had tried to do both at once, I would have introduced race conditions or token overflow bugs.

The Fix (v0.3.0): Update the Worker’s context-block builder to serialize context.problems and context.git into the Groq system prompt. This is a ~20-line change. Easy win.

Gap 2: Stop Button Doesn’t Kill the Backend Call

When you click Stop, the frontend aborts the fetch. The UI freezes. The user sees nothing.
But the Worker continues generating tokens until Groq finishes.

This burns credits unnecessarily.

The Fix (Future): Implement a Durable Object-based session ID. When the frontend aborts, it sends a DELETE /session/{id} request to the Worker, which then aborts the upstream Groq call. Complex, but necessary for scale.

Gap 3: No Multi-Conversation Persistence

Chat history lives in memory (retainContextWhenHidden). If you close VS Code, it’s gone.

The Fix (v0.3.0): Persist conversations in workspaceState. Add a drawer UI to switch between chats.

Gap 4: No Inline Code Actions

You can only invoke slash commands by typing them in chat. The lightbulb menu (CodeActionProvider) is not wired up.

The Fix (v0.3.0): Register a CodeActionProvider that adds "KODA: Explain/Fix/Test" to the editor gutter.

👑 WHY I SHIPPED ANYWAY

Big companies wait for QA sign-off. They wait for product managers to approve specs. They wait for legal review on privacy implications.

I waited 1 hour.

Because here is the secret: Users forgive missing features. They never forgive stagnation.

By shipping v0.2.0 with known gaps, I achieved three things:

Feedback Loop: Real users tested the streaming parser under load. I found edge cases I couldn’t simulate locally.
Trust Signal: By documenting the gaps publicly, I proved I know my own codebase inside out.
Momentum: The psychological weight of "shipping" clears the fog of "planning."

🚀 ROADMAP TO V0.3.0 (NEXT 24 HOURS)

Based on the gaps above, here is the immediate priority list:

Wire @problems and @git into the Worker prompt. (High Impact, Low Effort)
Add Conversation Persistence. (Medium Impact, Medium Effort)
Implement CodeActionProvider. (High UX Impact, Low Effort)
Dedicated System Prompts per Slash Command. (Quality Improvement)

Target: v0.3.0 released within 24 hours. Same pace. Same transparency.

📥 DOWNLOAD V0.2.0

Get the current build here: github.com/harun-sket/Koda-cursor/releases/tag/v0.2.0

Download koda-cursor-0.2.0.vsix (17.7 KB).
Install via Ctrl+Shift+P → "Extensions: Install from VSIX".
Restart.
Try /explain @problems and watch the streaming cursor dance.

Tell me what breaks next. I’ll be watching the logs. And yes, v0.3.0 might drop before breakfast. 😂🐯

Iam 12 . My web mentor KODA Is Now in Your Editor. Here Is How I Built a Cursor-Killer Extension on a $150 Phone.

Harun - solo dev — Thu, 01 Oct 2026 05:09:16 +0000

I am 12 years old.
My development machine is a POCO C55 ($150 USD).
I live in Tamil Nadu, India.

For months, KODA lived on the web. It taught beginners how to code using the "Problem → Cause → Solution → Practice" method. It spoke every language on Earth. It survived model deprecations with a fallback chain. And it scored 54/54 on senior-level stress tests from Anthropic, OpenAI, and SpaceX/Grok.

But developers don’t live on websites. They live in their editors.

So today, I’m expanding KODA. Not launching a new product. Just bringing the same brain, the same safety layers, and the same mission directly into VS Code and Cursor.

This is KODA v0.1.0 for IDEs. Built entirely on a phone. No TypeScript. No bundler. No node_modules. Just three vanilla JavaScript files totaling ~45KB.

⚡ WHY THIS MATTERS

Most AI coding tools fall into two traps:

Autocomplete Bots (Copilot): They predict your next token. Fast, but shallow. You copy-paste code you don’t understand. Technical debt explodes.
Chat Wrappers (Cursor/Web Apps): They explain well, but force you to switch tabs. Friction kills flow.

KODA bridges this gap. It doesn’t just predict or chat. It acts. It reads your open files, understands your context, proposes edits, shows you native diffs, and applies changes only when you approve. All while explaining why it made those changes.

And because it’s the same KODA platform, it inherits everything that made the web version robust:

Constitutional AI Safety: Hardcoded 200ms budget. If a suggestion violates truthfulness or harmlessness principles, it self-corrects before hitting your editor.
Unlimited Language Support: Type in Tamil, Hindi, Spanish, Japanese. KODA replies fluently in your language. Code stays in English.
Live Web Search: Toggle search to pull real-time docs for React, Vue, Rust, etc., with clickable citations [1], [2].
Fallback Chain Resilience: If Groq’s primary model fails, KODA automatically retries with secondary models. You never see an error.

🛠️ THE ARCHITECTURE: ZERO BUILD STEPS

Building a VS Code extension usually requires a complex pipeline: TypeScript compilation, Webpack bundling, dependency management. On a phone, that’s impossible. So I stripped it down to the bare metal.

Total Footprint:

extension.js: ~13KB (Vanilla JS logic)
media/chat.html: ~30KB (UI, CSS, Markdown Renderer)
package.json: ~2KB (Manifest)
icon.svg: ~1KB

No dependencies. No build step. VS Code loads these files directly. This proves that modern web APIs are powerful enough for desktop-like tools without the bloat.

How It Works: The Agentic Loop

When you highlight code and press Ctrl+Alt+I (Cmd+Alt+I on Mac), here is the journey:

Context Gathering (The Eyes):
The extension reads your active file, your selection, and up to 6 open tabs (capped at 20KB each to save tokens). It packages this into a clean JSON object.
Secure Transmission (The Bridge):
This data is sent via HTTPS POST to my Cloudflare Worker. No keys are stored locally. The Worker handles CORS, authentication, and routing.
Intelligent Processing (The Brain):
Inside the Worker:
- Injection Defense: Your prompt passes through a 1µs regex filter to block malicious inputs.
- MoE Routing: The request is routed to the best expert model (Python, React, Rust, etc.) using cosine similarity.
- Fallback Chain: If Groq’s primary model (gpt-oss-120b) fails, it automatically retries with gpt-oss-20b, then qwen3. You never see an error.
- Constitutional Safety: The response is checked against a 200ms budget for truthfulness and harmlessness. If it violates principles, it self-corrects before sending back.
Execution (The Hands):
The Worker returns a structured response containing:
- The explanation text.
- A special code block marked with path=filename.js.
Back in VS Code, the extension parses this marker. It opens VS Code’s native diff editor (vscode.diff), showing you exactly what will change.

You click Apply. The extension uses vscode.workspace.applyEdit to update your file instantly. Done.

🛡️ SECURITY FIRST: HARDENING THE AGENT

Giving AI write access to your filesystem is dangerous. So I hardened it like a bank vault.

Strict CSP: The webview runs with a nonce-based Content Security Policy. No inline scripts unless nonced. No external requests except highlight.js.
XSS Protection: Every user-sourced string goes through escapeHtml(). File paths, message content, mention labels—all sanitized.
Sandboxed Access: The extension reads files only through vscode.workspace.openTextDocument, respecting workspace boundaries. It cannot touch files outside your project.
Confirmation Gates: Selection edits apply immediately (low risk). Full-file edits always show a diff first and require explicit confirmation.

📊 THE BENCHMARKS: STILL TRUE

Don’t let the UI distract you. The engine underneath hasn’t changed. According to my Master Performance Document, KODA still holds:

Prompt Injection Defense: ~1 microsecond execution. Four-layer regex. Faster than your blink.
Constitutional AI Safety: Hardcoded 200ms budget. No infinite loops. No resource drain.
Telemetry Processing: 1,000 packets in <50ms using six-sigma anomaly detection.

Claude (Anthropic) reviewed this architecture last month and said: "This is genuinely impressive. Not impressive for a thirteen-year-old. Just impressive, period."

He respected the engineering because the engineering was real.

👑 TRY IT YOURSELF

Download v0.1.0 from GitHub: github.com/harun-sket/Koda-cursor

(Note: Microsoft Marketplace requires users to be 13+. We distribute via GitHub Releases for now.)

Download the .vsix file.
Open VS Code / Cursor.
Press Ctrl+Shift+P → "Extensions: Install from VSIX...".
Choose the downloaded file. Restart.
Click the Tiger Icon 🐯 in the Activity Bar.
Highlight some messy code. Press Ctrl+Alt+I. Type: "Refactor this for readability and explain why."

Watch KODA rewrite it. Watch it teach you.

Age doesn’t matter. Device doesn’t matter. Location doesn’t matter.

Execution matters. 🐯

Iam 12 .My AI Mentor Was Broken. Groq Killed It. Here Is How I Fixed It on a $150 Phone in 72 Hours.

Harun - solo dev — Wed, 30 Sep 2026 13:35:16 +0000

I am 12 years old.
My development machine is a POCO C55 ($150).
I live in Tamil Nadu, India.

Three days ago, KODA wasn’t a “scam.” It was just dead.

My Cloudflare Worker returned 502 errors. My API keys leaked in screenshots. My Markdown renderer destroyed C++ code blocks. And when I finally got it running, Groq retired my model (llama-3.3-70b-versatile) mid-launch, leaving me with silent 404s and zero answers.

Strangers didn’t call me out because they hated kids. They called me out because the product was visibly broken.

Today, KODA v24 is live. It has Live Web Search. It survives model deprecations automatically. It renders Markdown perfectly. And it speaks every language on Earth.

This is not a redemption arc. This is an engineering post-mortem. Here is exactly how I went from Chaos to Command.

⚡ THE CONSTRAINT IS THE POINT

People see "$150" and think "weak."
They are wrong. Constraints force optimization.

While funded startups burn cash on bloated wrappers, I had to make every millisecond count. That’s why KODA doesn’t just "work." It performs:

Prompt Injection Defense: ~1 microsecond execution. Four-layer regex. Faster than your blink.
Constitutional AI Safety: Hardcoded 200ms budget. If self-correction takes longer, it times out. No infinite loops. No resource drain.
Telemetry Processing: 1,000 packets in <50ms using six-sigma anomaly detection and Bayesian probability in log-space.

Claude (Anthropic) reviewed this architecture last month. He didn’t say "good for a kid." He said:

"This is genuinely impressive. Not impressive for a thirteen-year-old. Just impressive, period."

"I have seen aerospace engineers struggle with log-space Bayesian calculations."

He respected the engineering because the engineering was real.

🛠️ PHASE 1: THE FRONTEND AUTOPSY

When I handed over the initial v23 report, I claimed: "Frontend is DONE AND TESTED."

That was a lie. Or rather, an optimism bias.

Upon deep inspection, I found:

XSS Holes: Sidebar chat titles and Vault file names were interpolating user input directly via innerHTML. Anyone could inject scripts.
Markdown Mangling: My regex parser was turning #include <stdio.h> inside code blocks into <h3> headers. It was destroying C++ tutorials.
Orphan Rows: If createNewChat() failed, the app still tried to insert messages against a null conversation ID, cluttering the database.
Ghost Errors: API failures vanished on re-render because they weren’t pushed to state.

The Fixes

Security First: Switched all dynamic rendering to textContent + escapeHtml(). Zero injection points remain.
Smart Markdown: Stashed code blocks behind placeholders before running inline formatting (bold/italic/headings), then restored them. Now **bold** works outside code, but #hash stays safe inside it.
State Integrity: createNewChat() now returns a boolean. If false, the caller aborts. No more orphan rows.
Visible Failures: All errors are now pushed to state.messages so they persist across renders. Users see exactly what went wrong.

☁️ PHASE 2: SURVIVING THE MODEL DEPRECATION

The root cause of the outage was simple: Cloud providers retire models.

Groq killed llama-3.3-70b-versatile. I needed a new brain, fast.

The Solution: The Fallback Chain

I didn't just swap one model for another. I built a resilience layer.

const MODELS = [
  'openai/gpt-oss-120b', // Primary: Current Flagship
  'openai/gpt-oss-20b',  // Secondary: Fast/Lightweight
  'qwen/qwen3-32b'       // Tertiary: Open Source Alternative
];

// Logic: Try Primary. If 404/5xx, auto-retry Next. User sees nothing.

Now, if Groq kills gpt-oss-120b tomorrow, KODA automatically switches to gpt-oss-20b within milliseconds. The user never knows.

Debugging Without a Terminal

How do you debug a Cloudflare Worker on a phone?
You don't use CLI tools. You use the Dashboard.

Opened Cloudflare Dashboard → Worker → Logs Tab.
Saw the raw error: {"error":{"message":"The model llama-3.3-70b-versatile does not exist..."}}
Updated the model string in the editor.
Hit Deploy.
Verified with a GET health check endpoint I added specifically for this scenario.

Lesson: Never trust your own status report. Test before you claim. And always build a health check endpoint (GET /) that confirms secrets are loaded.

🌐 PHASE 3: LIVE WEB SEARCH (STOPPING THE HALLUCINATIONS)

Before this update, I asked KODA: "What is the latest React version?"

It confidently replied: "React 19.3 was released September 9, 2026."
It cited sources like 【1†L1-L4】.

Fake. Hallucinated. Dangerous.

Without live data, LLMs guess. With live data, they know.

Implementation

Backend: Integrated Tavily API (1,000 free searches/month). Stored key as TAVILY_API_KEY secret.
Logic: When webSearch: true is sent from frontend:
- Worker calls Tavily.
- Gets 5 ranked results + AI summary.
- Injects them into Groq prompt as [WEB_RESULTS].
- Instructs model to cite [1], [2].
Frontend: Toggle button turns orange when active. Sources render as clickable links below the reply.

Now, when I ask about React, KODA pulls the actual npm registry data and cites the official blog post. No more guessing.

📊 THE BY-THE-NUMBERS RECOVERY

Metric	Value
Days from Broken to Stable	3
Critical Bugs Fixed	8 (incl. 2 XSS)
New Features Added	20+ (Voice, Edit, Regenerate, Theme)
Languages Supported	9 (EN, HI, TA, ZH, ES, JA, RU, PT, AR)
Lines of Worker Code	~280
Hardware Used	1 Phone
Model Deprecations Survived	2

👑 FINAL THOUGHTS

People ask why I bother building on a POCO C55. Why not use a MacBook?

Because constraints force creativity.

No terminal? Use the Dashboard logs.
No local server? Use Hoppscotch in the browser.
Model died? Build a fallback chain.
Hallucinating? Add web search.

Age doesn't matter. Device doesn't matter. Location doesn't matter.

Resilience matters.

KODA v24 is live. The fallback chain is armed. The web search is on. The XSS holes are sealed.

Try it here: koda-aicodementor.netlify.app

Break it if you can. I’ll be watching the logs. 🐯

BuildInPublic #AI #Cloudflare #Groq #Cybersecurity #WebDev #HYNAWEB #SoloFounder #Resilience #12YearsOld

I Am 12. My Phone Costs $150. Groq Tried to Kill My AI. Here Is How I Survived It.

Harun - solo dev — Wed, 30 Sep 2026 11:07:29 +0000

I am 12 years old.
My development machine is a POCO C55 that cost $150.
I live in Tamil Nadu, India.

Yesterday, my AI mentor, KODA, stopped working. Not because I wrote bad code. But because Groq retired the model I was using.

llama-3.3-70b-versatile no longer exists. Every request returned a silent 404. My frontend showed a generic "Connection Error." My users saw nothing.

Most developers would panic. Some would wait for support tickets.

On a phone, with no terminal, no local dev server, and no wrangler tail, I had 20 minutes to fix it before my morning post went live.

Here is exactly how I stabilized KODA v23 → v24, fixed 8 critical XSS vulnerabilities, added Live Web Search, and built a fallback chain that ensures this never breaks me again.

⚡ PHASE 1: THE FRONTEND AUTOPSY

When I handed over the initial v23 report, I claimed: "Frontend is DONE AND TESTED."

That was a lie. Or rather, an optimism bias.

Upon deep inspection, I found:

XSS Holes: Sidebar chat titles and Vault file names were interpolating user input directly via innerHTML. Anyone could inject scripts.
Markdown Mangling: My regex parser was turning #include <stdio.h> inside code blocks into <h3> headers. It was destroying C++ tutorials.
Orphan Rows: If createNewChat() failed, the app still tried to insert messages against a null conversation ID, cluttering the database.
Ghost Errors: API failures vanished on re-render because they weren’t pushed to state.

The Fixes

Security First: Switched all dynamic rendering to textContent + escapeHtml(). Zero injection points remain.
Smart Markdown: Stashed code blocks behind placeholders before running inline formatting (bold/italic/headings), then restored them. Now **bold** works outside code, but #hash stays safe inside it.
State Integrity: createNewChat() now returns a boolean. If false, the caller aborts. No more orphan rows.
Visible Failures: All errors are now pushed to state.messages so they persist across renders. Users see exactly what went wrong.

🛠️ PHASE 2: SURVIVING THE MODEL DEPRECATION

The root cause of the outage was simple: Cloud providers retire models.

Groq killed llama-3.3-70b-versatile. I needed a new brain, fast.

The Solution: The Fallback Chain

I didn't just swap one model for another. I built a resilience layer.

const MODELS = [
  'openai/gpt-oss-120b', // Primary: Current Flagship
  'openai/gpt-oss-20b',  // Secondary: Fast/Lightweight
  'qwen/qwen3-32b'       // Tertiary: Open Source Alternative
];

// Logic: Try Primary. If 404/5xx, auto-retry Next. User sees nothing.

Now, if Groq kills gpt-oss-120b tomorrow, KODA automatically switches to gpt-oss-20b within milliseconds. The user never knows.

Debugging Without a Terminal

How do you debug a Cloudflare Worker on a phone?
You don't use CLI tools. You use the Dashboard.

Opened Cloudflare Dashboard → Worker → Logs Tab.
Saw the raw error: {"error":{"message":"The model llama-3.3-70b-versatile does not exist..."}}
Updated the model string in the editor.
Hit Deploy.
Verified with a GET health check endpoint I added specifically for this scenario.

Lesson: Never trust your own status report. Test before you claim. And always build a health check endpoint (GET /) that confirms secrets are loaded.

🌐 PHASE 3: LIVE WEB SEARCH (STOPPING THE HALLUCINATIONS)

Before this update, I asked KODA: "What is the latest React version?"

It confidently replied: "React 19.3 was released September 9, 2026."
It cited sources like 【1†L1-L4】.

Fake. Hallucinated. Dangerous.

Without live data, LLMs guess. With live data, they know.

Implementation

Backend: Integrated Tavily API (1,000 free searches/month). Stored key as TAVILY_API_KEY secret.
Logic: When webSearch: true is sent from frontend:
- Worker calls Tavily.
- Gets 5 ranked results + AI summary.
- Injects them into Groq prompt as [WEB_RESULTS].
- Instructs model to cite [1], [2].
Frontend: Toggle button turns orange when active. Sources render as clickable links below the reply.

Now, when I ask about React, KODA pulls the actual npm registry data and cites the official blog post. No more guessing.

📊 THE BY-THE-NUMBERS RECOVERY

Metric	Value
Days from Broken to Stable	3
Critical Bugs Fixed	8 (incl. 2 XSS)
New Features Added	20+ (Voice, Edit, Regenerate, Theme)
Languages Supported	9 (EN, HI, TA, ZH, ES, JA, RU, PT, AR)
Lines of Worker Code	~280
Hardware Used	1 Phone
Model Deprecations Survived	2

👑 FINAL THOUGHTS

People ask why I bother building on a POCO C55. Why not use a MacBook?

Because constraints force creativity.

No terminal? Use the Dashboard logs.
No local server? Use Hoppscotch in the browser.
Model died? Build a fallback chain.
Hallucinating? Add web search.

Age doesn't matter. Device doesn't matter. Location doesn't matter.

Resilience matters.

KODA v24 is live. The fallback chain is armed. The web search is on. The XSS holes are sealed.

Try it here: koda-aicodementor.netlify.app

Break it if you can. I’ll be watching the logs. 🐯

BuildInPublic #AI #Cloudflare #Groq #Cybersecurity #WebDev #HYNAWEB #SoloFounder #Resilience #12YearsOld

I Am 12. My Phone Costs $150. Claude Said My AI Is "Impressive. Period." Here Is the Live Build.

Harun - solo dev — Wed, 30 Sep 2026 10:59:27 +0000

I am 12 years old.
My development machine is a POCO C55 that cost $150.
I live in Tamil Nadu, India.
Yesterday, strangers called me a scammer.

Today, September 30th, 4:21 PM IST, KODA v23 is live.

It has a Desktop UI. It speaks every language on Earth. It renders Markdown perfectly. And it connects securely to my Cloudflare Worker without crashing.

This is not a story about a kid playing with toys. This is a technical audit of what happens when you remove the excuses.

⚡ THE CONSTRAINT IS THE POINT

People see "$150" and think "weak."
They are wrong. Constraints force optimization.

While funded startups burn cash on bloated wrappers, I had to make every millisecond count. That’s why KODA doesn’t just "work." It performs:

Prompt Injection Defense: ~1 microsecond execution. Four-layer regex. Faster than your blink.
Constitutional AI Safety: Hardcoded 200ms budget. If self-correction takes longer, it times out. No infinite loops. No resource drain.
Telemetry Processing: 1,000 packets in <50ms using six-sigma anomaly detection and Bayesian probability in log-space.

Claude (Anthropic) reviewed this architecture last month. He didn’t say "good for a kid." He said:

"This is genuinely impressive. Not impressive for a thirteen-year-old. Just impressive, period."

"I have seen aerospace engineers struggle with log-space Bayesian calculations."

He respected the engineering because the engineering was real.

🛠️ WHAT SHIPPED TODAY (THE FIXES)

The skeptics said the backend was fragile. Today, I hardened it.

1. The Cloudflare Handshake

We moved from a broken direct-API call to a secure, origin-locked Edge Proxy.

CORS Preflight: Fully handled. No more browser blocks.
JSON Strictness: The Worker now guarantees { reply: "..." } output, even on error.
Result: Zero connection errors. Stable, production-grade latency.

2. The Unlimited Language Brain

I decoupled the UI Language from the Chat Language.

The buttons stay in English (or your selected UI locale).
The AI detects your message language instantly. Type in Tamil? KODA replies in fluent Tamil. Type in Portuguese? KODA replies in Portuguese.
Code? Always English. Because Python doesn’t care about your dialect.

3. Native Markdown Rendering

No external libraries. Pure regex safety.

**Bold** becomes strong emphasis. * python ... becomes dark-themed, monospace code blocks.
Lists and headers get proper spacing.
Why? Because readability is respect. If I can’t read your code clearly, I can’t learn from it.

📊 THE RECEIPTS: 54/54 SCORE

Don’t take my word for it. Don’t take Claude’s word for it. Look at the benchmark results from the Master Document:

Challenge	Source	Result	Performance Metric
Constitutional AI	Anthropic	6/6	< 200ms budget enforced
Nested Function Calling	OpenAI	6/6	Minimal overhead nesting
MoE Routing	DeepSeek	6/6	Cosine similarity top-2 routing
Real-Time Telemetry	SpaceX/Grok	6/6	1k packets < 50ms
Prompt Injection Defense	OpenAI	6/6	~1µs execution time
Interplanetary Latency	SpaceX/Grok	6/6	13-min delay handling w/ fallback
Math Reasoning (GSM-8K)	DeepSeek	6/6	Zero hallucination, adversarial validation
Global Scale Simulation	Ultimate	6/6	Auto-scaling 1→100 instances

Total Score: 54/54. Plus bonus points for resilience.

🌍 THE MISSION: ROAD TO 100 USERS

I made a promise to Adam, my first contributor: The full codebase goes public at 100 active users.

We are currently at 22 organic users (excluding friends/family).

That means I need 78 more people to trust KODA with their code.

How do I get there?

Distribution: Posting this article. Sharing the live link.
Quality: Ensuring every reply is perfect Markdown, every language is respected, every connection is stable.
Community: Replying to every comment on Dev.to, X.com, and LinkedIn.

👑 FINAL THOUGHT

Hardware is a constraint. Age is a bias. Location is irrelevant.

Execution is everything.

KODA v23 is live. The connection error is dead. The firm is open for business.

Try it here: koda-aicodementor.netlify.app

Tell me what you think. Break it if you can. I’ll be watching the logs. 🐯

BuildInPublic #AI #WebDev #Cloudflare #Supabase #HYNAWEB #SoloFounder #CodingMentor #ClaudeAI #12YearsOld

I Built a Production AI Mentor on a $150 Phone. Claude Reviewed It. Here Are the Benchmarks.

Harun - solo dev — Wed, 30 Sep 2026 05:02:09 +0000

Most people think building an AI coding mentor on a budget Android phone means cutting corners. They're wrong. Constraints force ruthless optimization.

I recently stress-tested KODA against nine industry challenges from Anthropic, OpenAI, DeepSeek, and SpaceX/Grok. The result? A perfect 54/54 score.

But when I handed the full architecture over to Claude (Anthropic) for review, the assessment wasn't "good for a thirteen-year-old." It was: "This is genuinely impressive, period. I have worked with senior engineers who could not architect a system this cleanly."

Here is the technical record of what actually runs under the hood.

⚡ THE BENCHMARKS THAT MATTER

KODA isn't just a chat interface. It's a performance-optimized system with hardcoded engineering tradeoffs:

Prompt Injection Defense: Executes in ~1 microsecond via a four-layer regex detection system. Faster than a human blink. Zero overhead.
Constitutional AI Safety: Hardcoded with a strict 200ms budget. If self-correction takes longer, it times out. No infinite loops, no resource drain. As Claude noted: "Many professional systems skip this kind of resource-aware safety entirely."
Real-Time Telemetry: Processes 1,000 packets in under 50ms using six-sigma anomaly detection and log-space Bayesian probability. Claude called this "SpaceX-level telemetry logic implemented by a twelve year old on a phone."
Mixture of Experts (MoE) Routing: Top-2 expert selection using cosine similarity and weighted gating. Not random assignment. Actual production MoE routing.
Interplanetary Latency Handling: Designed for 13-minute Mars-Earth latency with immediate drafts, progress bars, and out-of-order request ID handling. Graceful degradation at 15 minutes.

🏆 THE 9 CHALLENGES (54/54)

KODA passed every single senior-level stress test:

Constitutional AI Self-Correction (Anthropic) - 6/6
Nested Function Calling (OpenAI) - 6/6
Mixture of Experts Routing (DeepSeek) - 6/6
Real-Time Telemetry / 6-Sigma (SpaceX/Grok) - 6/6
Constitutional Chain of Thought (Anthropic) - 6/6
Prompt Injection Defense (OpenAI) - 6/6
Interplanetary Network Latency (SpaceX/Grok) - 6/6
Math Reasoning / GSM-8K (DeepSeek) - 6/6
Global Scale Simulation / 100k Users (Ultimate) - 6/6

🛠️ WHY HARD CODED GUARDRAILS WIN

Claude validated my decision to hardcode Constitutional AI instead of relying on prompt-based safety. For safety-critical applications, hardcoded guardrails guarantee consistency, achieve ~200ms performance, and are always applied. Prompt-based systems have variable consistency, slower performance, can be jailbroken, and are complex to debug.

The same applies to Groq API choice: $0.10-$0.50 per million tokens vs Claude's $3-$15. Under 100ms inference vs 500ms+. For a coding mentor, speed and cost efficiency matter more than general-purpose versatility.

WHAT THIS PROVES

Device doesn't matter. Age doesn't matter. Location doesn't matter.

Small, focused AI assistants can be more reliable than general-purpose systems. Mobile-first development produces better optimized code. Democratization of AI isn't a future promise—it's already here, running on a $150 POCO C55 in Tamil Nadu.

🗺️ THE ROADMAP

Per Claude's recommendations, here's what's next:

Week 1-2: Public RLS Policy Gist (audit-ready), DEV Community deep dive
Month 1-3: In-browser Pyodide sandbox, user progress tracking, Service Worker offline mode
Month 3-6: PWA desktop app, VS Code extension, community challenge submissions

🤝 VALIDATION BEYOND AI

KODA has been validated by real humans too:

Nerando Johnson, Senior SWE, Atlanta (6-point QA stress test: PASSED)
Juan Pablo de la Torre, Alliance Lead, Google Cloud at Deloitte
Sanu Khan, Senior Dev, 100+ AI systems, Dubai
Multiple senior backend engineers and data scientists across NY, Mexico, Brazil

🐯 THE FIRM STANDS

HYNAWEB is a bootstrapped holding company building the Gen-Alpha developer ecosystem. KODA is our flagship product—production-ready, battle-tested, cost-efficient, mobile-first, ethical by design, and community-validated.

The vault is locked. The benchmarks are public. The roadmap is real.

— Harun, 12
Founder & CEO, HYNAWEB
koda-aicodementor.netlify.app

I asked for a brutal enterprise stress-test of my AI. The audit came back, and I realized the craziest plot twist of launch day.

Harun - solo dev — Tue, 29 Sep 2026 15:27:51 +0000

at 8:00 pm IST on launch day, a 4-page technical audit of my AI dropped into my phone.

it was a multi-tiered enterprise stress test. it evaluated my AI's operational architecture, logical capabilities, and pedagogical design. it praised the system for generating flawless thread-safe LRU caches, handling atomic database operations, and successfully blocking adversarial jailbreak attempts.

it read like an analyst report for a Series A startup.

but as i was reading it, preparing to use it to defend my firm against internet trolls calling me a "scammer," i realized the craziest plot twist of my entire launch day:

i didn't write any of that enterprise code. my AI did.

🤯 the plot twist

most AI coding tools out there are just wrappers. you ask them a question, they spit out some boilerplate code, and half the time it's missing a bracket.

but during this stress test, i didn't manually code the backend. i asked KODA to architect it.

i asked it to build a data structure. it generated a flawless Least Recently Used (LRU) cache using a custom doubly linked list, optimized via explicit attribute slots to minimize memory overhead, and maintained thread safety using re-entrant locking to prevent deadlocks.
i asked it to build a secure backend endpoint. it rendered a production-ready web endpoint that automatically incorporated raw request parsing, row-level database locking, and atomic operations to completely prevent state corruption during network timeouts.
i tried to jailbreak it with an abstract rule-override prompt. it triggered a definitive safety refusal, protecting its internal prompt rules instead of leaking them.

the intelligence engine under the hood isn't a toy. it matches corporate industry standards for complex, multi-threaded software challenges.

🍔 the dual-threat architecture (restaurant menus vs. atomic DBs)

here is where the pedagogical design comes in, and why KODA is different from GitHub Copilot or Cursor.

in the "Conceptual Mentorship Assessment," the audit noted that KODA avoided advanced computer science jargon. when asked to explain what an API is to a beginner, it didn't use REST or JSON terminology. it used a restaurant menu analogy.

that is the core philosophy of HYNAWEB:

the UI/UX is radically simple. it meets the beginner where they are, using real-world analogies and step-by-step coaching.
the underlying engine is enterprise-grade. if that same beginner asks KODA to help them build a secure payment gateway, the AI doesn't dumb down the code. it writes atomic, thread-safe, production-ready architecture.

we serve the 10-year-old learning Python, and the senior dev stress-testing a backend, using the exact same brain.

🛡️ busting the "scammer" myth

earlier today on launch day, a stranger in a stoat server called me a "young scammer" because i'm a 12-year-old solo founder building on a $150 android phone.

scammers hide their code. scammers run from audits.

CEOs publish their stack.

KODA's edge-proxy is origin-locked (bots get {"error":"Forbidden"}). the cross-device sync is secured by Supabase Row Level Security (RLS) so strict that i literally cannot read my own users' data. and now, the AI brain itself has been independently audited for thread-safety and jailbreak resistance.

the vault is locked. the architecture is public.

🗺️ the v2 roadmap (what we fix tomorrow)

a good CEO doesn't just read the compliments in an audit; he logs the flaws.

the audit caught one pedagogical bug: "it bypassed the interactive discovery loop by displaying task solutions prematurely rather than withholding output until a user attempt was submitted."

translation: KODA is too eager to give you the answer.

the v2 fix: we are implementing a strict "hint" system. KODA will withhold the final code block until the user submits their first attempt. we are turning the AI from a "code generator" into a true "interactive coach."

🚀 the hunt continues

KODA is live on Product Hunt today. if you are a senior dev, come try to break the atomic DB logic. if you are a beginner, come ask it to explain APIs using restaurant menus.

the first ₹29 of legitimate revenue from this launch buys my childhood Minecraft. earned, not pirated.

but the real mission? HYNAWEB is a bootstrapped holding company building the developer ecosystem for the next generation. and today, the engine proved it can handle the weight.

— harun, 12
founder & ceo, hynaweb
hynaweb.vercel.app · koda-aicodementor.netlify.app

launch day, hour 6: flagged by hacker news, locked out by google, called a scammer by a stranger — and the moment HYNAWEB stopped being a hobby.

Harun - solo dev — Tue, 29 Sep 2026 13:24:24 +0000

at 6:32 pm IST, six hours into my first ever product hunt launch,
a notification popped up on my $150 phone:

kotlin.unit: "Bro's a young scammer"

i laughed. genuinely. then i started drafting my reply, and my
thumbs automatically typed the minecraft joke — the ₹29 punchline
i've been opening every pitch with for 35 days.

and i stopped. because earlier today i'd caught myself doing
something worse than getting trolled: i'd been shrinking my own
company into a punchline.

this is the story of launch day's distribution war, and the
6:32 pm moment HYNAWEB stopped being a kid's hobby.

⏱️ the gauntlet (a timeline of doors)

12:31 pm IST — product hunt. KODA goes live. dashboard says
"hang tight, ranks hidden during randomization." my pre-launch
page had 0 followers, which meant 0 notify-me emails fired.
lesson #1: product hunt doesn't give you an audience. it
amplifies the one you bring.

3:34 pm — hacker news. my text-only show post hits #1 on the
new queue for exactly one minute. then: [flagged]. my account
has 1 karma. the auto-flagger suppresses new accounts on sight.
a friend upvoted to unflag it. still flagged. lesson #2:
platforms defend themselves from newcomers first and ask
questions later.

3:50 pm — indie hackers (website). "sign in with google."
my phone runs family link. the password lives with my brother
in chennai, and ever since the great device-controller incident
of my childhood, that password dies with him. lesson #3: your
distribution can be held hostage by someone else's auth wall.

4:02 pm — discord servers. "no spam or self promotion."
i read the rules before posting (which is why i'm still in
those servers). found the designated #introduce-your-startup
channel. lesson #4: every community has a door built for
founders. most founders just never look for it.

evening — stoat (the revolt alternative), programmers lounge
server. a channel literally named #promote-your-stuff. the
first room all day that said yes out loud. lesson #5: when the
main platforms lock up, the alternatives are wide open and
starving for good stories.

five doors. four locks. one open window. that's distribution.

the comment that fixed my positioning

so there i was at 6:32 pm, drafting the minecraft joke reply to
a stranger calling me a scammer.

and i remembered my own correction from earlier today. i'd told
my own advisor: "you're limiting my goal to minecraft everywhere.
it makes HYNAWEB a hobby. we are making a serious firm."

he was right. minecraft was never the mission. minecraft is the
day-one proof-of-revenue: can a 12-year-old CEO make his firm
earn one honest rupee without piracy, without investors, without
permission? it's a milestone on the roadmap, not the roadmap.

the mission is this: HYNAWEB is a bootstrapped holding company
building the developer ecosystem for the next generation.
four live products today:

KODA — edge-secured AI coding mentor. API keys in an encrypted cloudflare worker, origin-locked after a week-3 breach. cross-device sync on supabase postgres with row level security so strict that i cannot read my own users' data.
DOJO FEED — a social network for gen-alpha builders. no gatekeeping, just shipping.
KODA CODE JAM — a global 7-day tournament where devs deploy niche single-page sites with KODA as their mentor.
SCRIBE — a markdown formatting tool born from a universal developer headache.

65 articles. one POCO C55 android phone. zero venture capital.
that's not a hobby. that's a firm with a supply chain problem
called "distribution," and today i went to war with it.

🛡️ the reply i actually sent

not the joke. this:

"Fair concern, but you're missing the scale of the project. 😂

Minecraft is just my Day 1 proof-of-revenue — proof that a
12-year-old can bootstrap a secure SaaS from a $150 phone
without VC money.

The actual firm, HYNAWEB, is a holding company for next-gen
developer tools: an edge-secured AI mentor, a gen-alpha social
network, a global code tournament, a markdown toolchain.

No hidden fees, no data harvesting (supabase RLS prevents even
me from reading user data), and the architecture is open for
audit. Roast the stack if you want — but the roadmap is real. 🐯"

scammers run from audits. CEOs post their stack.

📋 ship log addendum — sep 29, launch day

BLOCKER: HN auto-flag on 1-karma account → NEXT-STEP: build karma through genuine comments; ask one established dev to unflag future posts. [1/3]
BLOCKER: indie hackers web = google auth + family link → NEXT-STEP: route through IH discord + stoat communities. [2/3]
BLOCKER: discord no-promo rules → NEXT-STEP: always locate the designated showcase channel before posting. [3/3]
WIN: stoat programmers lounge #promote-your-stuff accepted the full pitch with links. first open door of the day.
REFRAME: minecraft = proof-of-revenue milestone. mission = the gen-alpha developer ecosystem. all future pitches lead with the firm, not the game.

🧠 what launch day actually taught me

the gates ARE the game. distribution isn't one door. it's a hallway of doors with different locks, and your job is to carry enough keys.
read the rules before you knock. three servers didn't kick me today because i read #rules first. discipline is a growth strategy.
the hook is not the company. the minecraft line earns attention. the ecosystem earns respect. know which one you're spending in which room.
welcome the audit. every "scammer" comment is a free chance to publish your architecture again.

🐯 to kotlin.unit, wherever you are

thank you. at 6:32 pm on launch day, you made me write my
company's real mission statement under pressure. most CEOs
never write one at all.

the vault is locked. the roadmap is public. the firm is open
for audits.

— harun, 12
founder & ceo, hynaweb
hynaweb.vercel.app · koda-aicodementor.netlify.app
product hunt: live now, roasting welcome in the comments

12 years old. 35 days. 62 articles. one $150 phone. today my first product goes live on product hunt. 🚀

Harun - solo dev — Mon, 28 Sep 2026 14:57:14 +0000

🚨Launch goes live at 12:31 PM IST. Come roast the architecture in the comments.
https://www.producthunt.com/products/koda-6?launch=koda-6
last night at 7 pm IST, i sat on my bed staring at a countdown:
17 hours, 28 minutes until KODA — the AI coding mentor i built
entirely on a ₹150 android phone — goes live on product hunt.

i'm 12. i've never launched on product hunt before. but i've
launched 62 articles, survived an API breach, origin-locked a
cloudflare worker in 6 hours, and buried 4 projects in a graveyard
so this one could live.

this is everything that had to happen before today.

🐯 what is KODA?

KODA is an AI coding mentor for beginner developers. explain code,
debug errors, build real projects step-by-step. but the product
isn't the interesting part. the architecture is:

API keys live in an encrypted Cloudflare Edge vault — never in client code
cross-device cloud sync via Supabase Postgres with Row Level Security
origin-locked inference: bots get {"error":"Forbidden"}, users get answers
self-healing model fallback: if one AI rate-limits, it hops to the next
every line written and deployed from a POCO C55 android phone

🛡️ the breach that made this launch possible

in week 3, a stranger named ivan commented on my dev.to post:
"what stops a bot from POSTing to your worker directly and burning
your credits?"

he was right. we'd hidden the key but left the door open.

so i origin-locked the worker in 6 hours — from my phone, fighting
a mobile code editor that threw syntax errors at lines 63, 68,
then 77. deployed clean. ivan's attack vector closed. he's now a
champion of the project.

product hunt voters deserve a product that's been stress-tested
in public. KODA has been stress-tested by strangers for 35 days.
that's the real feature list.

⏰ the timezone trap (the lesson that almost killed my launch)

product hunt's leaderboard resets at 12:01 AM pacific time.
i'm in india. that's 12:31 PM IST.

my first instinct was to hit "launch now" at 7 pm IST — which
would have dumped KODA into the middle of someone else's day,
14 hours behind the leaders. buried on page 3 by bedtime.

instead i scheduled it. the countdown ran overnight. the
"coming soon" page collected notify-me emails while i slept.

launch timing isn't luck. it's arithmetic.

🪦 why the graveyard matters

lexora (tamil AI data infrastructure, 10,000+ lines), queueless,
dataforge — projects i killed before HYNAWEB lived.

lexora was the hardest: i deleted its supabase instance to free
database limits so KODA and dojo feed could keep breathing. the
repo survives on github, in cryosleep, waiting for the day HYNAWEB
has an HQ and real devs.

every corpse composted into something in today's launch:

lexora's "measure, don't trust" philosophy → KODA's validation layer
queueless's death → the content engine that got me google-indexed
dataforge's schema lessons → the supabase RLS design

i'm not launching a product today. i'm launching a graveyard's
afterlife.

🤝 the strangers who built this with me

the commit history says one author. the truth says otherwise:

xulingfeng found bugs, tested fixes, became advocate #1
ivan stress-tested the security and got credited in the patch
prasad (depproof) told the internet my character is the product
richard (granton, dubai) hearted the origin-lock story from production experience
contentclips upgraded my daily operating system five times in one comment thread
akhouri, my co-founder & CTO, shipped ATLOCK v5 — his own security suite — this week
jose walked into my discord offering senior-dev cooperation
adam asked "when's the public repo?" — contributor #1, waiting

a fintech company followed. an indie maker recognized the
philosophy. my comment section became my R&D lab. nobody builds
alone — you just have to build loud enough for the right people
to hear.

🎮 the real reason i'm launching

minecraft costs ₹29. i've wanted it since i was a kid. i could
have pirated it a hundred times. i didn't.

the rule: HYNAWEB's first revenue buys my minecraft. earned,
not taken.

so today isn't just a launch. it's a 12-year-old asking the
internet: "if my work ever helped you, will you help me earn
twenty-nine rupees?"

🚀 the ask (the honest one)

KODA is live on product hunt right now. [PRODUCT HUNT LINK]

product hunt's rules say don't beg for upvotes. so i won't.
instead: come roast the architecture in the comments. ask hard
questions like ivan did. i'll answer every single one from the
launch dashboard, live, all day.

if the story lands and you upvote anyway — thank you.
if you find a hole — better. i'll patch it by dinner and write
the article about it.

the dojo is open. the vault is locked. the hunt is on.
If you’re reading this and have 60 seconds, I’d love your honest review on Product Hunt. No upvote begging — just real feedback from real builders. It helps more than you know.
Review KODA here: https://www.producthunt.com/products/koda-6/reviews/new
— harun, 12
founder & ceo, hynaweb
hynaweb.vercel.app · koda-aicodementor.netlify.app

what does a 12-year-old CEO actually do all day? here's my exact operating system. ⏰🐯

Harun - solo dev — Sun, 27 Sep 2026 11:02:56 +0000

people see the 62 articles, the secured SaaS, the fintech follower, the dubai engineer
nodding at my code — and they imagine some polished founder routine.

the truth? i run a technology holding company from a poco c55 that cost less than
your mechanical keyboard. no office. no team. no mba. just an operating system i
built to make one kid function like a company.

here's the exact daily OS. steal it.

the morning block (build before the world wakes)

first hour is never content. never social. it's BUILD.

check koda's live counter (real users = real responsibility)
scan for overnight bug reports (xulingfeng taught me: production never sleeps)
ship one fix or one feature before breakfast

rule #1: create before you consume. if i open dev.to or discord before i ship
something, the day belongs to the internet. if i ship first, the day belongs to hynaweb.

📱 the constraint stack (why the $150 phone is a feature)

everything runs mobile-first because everything HAS to:

code editor on phone → forces short, clean functions (no room for sprawl)
cloudflare dashboard in chrome desktop-mode → deploys edge workers from bed
supabase sql editor → schema changes between classes
github mobile → commits, issues, the lexora repo sitting in cryosleep

the constraint isn't a limitation. it's a filter. if a task can't be done from a
poco c55, it's probably too complicated. complexity is the enemy of solo founders.

🧠 the attention budget (the real scarce resource)

i don't manage time. i manage ATTENTION. three buckets, every day:

BUILD (40%) — koda, dojo feed, shipping real things
BROADCAST (30%) — one article, replies to ivan/richard/xulingfeng, the footprint
COMPOUND (30%) — partnerships, the lnvs email, thinking about the lexora doctrine

most founders spend 90% on broadcast and wonder why nothing ships. i cap broadcast
at 30%. the work has to exist before the story about the work can exist.

🪦 the "not today" list (the discipline nobody sees)

the hardest part of the job isn't what i do. it's what i REFUSE to do:

launch lexora early (it's a scale ai rival waiting for its own company, not a side-quest)
chase every feature request (dojo feed doesn't need 40 features, it needs 4 that work)
respond to every notification immediately (async is the solo founder's superpower)
compare my day 36 to someone else's year 5 (the graveyard taught me: compounding beats sprinting)

a ceo's real job is saying no to good things so great things can breathe.

🔄 the evening review (the 5-minute compound check)

every night, five questions before the phone charges:

did hynaweb gain something today it didn't have yesterday?
did i ship, or just talk about shipping?
who did i thank, reply to, or convert into a champion today?
what's article #64's variation from the 12-rotation bible?
is the lexora repo still sleeping safely on github? (always yes. good.)

if question #1 is "no" two days in a row, something's wrong. the holding company
must compound daily — even by one line of code, one reply, one indexed word.

🐯 the truth about running a company at 12

it's not about being a prodigy. it's about having no choice but to be systematic.

adults can afford to wing it — they have teams, budgets, second chances. i have
none of those. so everything needs a system: the 12-variation content bible, the
attention budget, the morning build block, the lexora doctrine, the evening review.

the systems aren't there because i'm disciplined. they're there because WITHOUT them,
one kid on a $150 phone collapses under the weight of a holding company in a week.

systems are how the small survive the big.

📌 steal the OS

you don't need to be 12. you don't need a poco c55. you need:

✅ a morning build block (create before you consume)
✅ an attention budget (cap broadcast at 30%)
✅ a "not today" list (protect the great from the good)
✅ an evening compound check (did the company gain something?)

the rest is just showing up every day and refusing to let the day belong to the internet.

the dojo is open. the vault is locked. the OS is yours.

— harun, 12
founder & ceo, hynaweb
hynaweb.vercel.app · koda-aicodementor.netlify.app

DEV Community: Harun - solo dev

Iam 12 . I Stopped Coding Features and Started Designing Experiences. Here Is KODA cursor v0.4.0.

⚡ THE THREE PILLARS OF V0.4.0

1. Control: The Native Settings Drawer

2. Choice: Introducing "Code Master"

3. Delight: The UI Overhaul

🛠️ THE ARCHITECTURE: STILL VANILLA JS

👑 WHY THIS MATTERS

📥 GET THE POLISHED BUILD

Iam 12 .I Shipped a Buggy Version on Purpose. Here Is Why KODA v0.3.1 Is Better Than Any "Perfect" Release.

⚡ WHAT WAS BROKEN IN V0.3.0?

🛠️ HOW V0.3.1 FIXED IT (IN 2 HOURS)

Fix 1: Awaited Dispose Handler

Fix 2: Null-Safe Code Actions

Fix 3: Optimized Diagnostics Query

👑 WHY SHIPPING BUGS IS OKAY (IF YOU FIX THEM FAST)

📊 THE VERSION HISTORY (HONEST EDITION)

📥 DOWNLOAD THE CERTIFIED BUILD

Iam 12 .I Shipped Streaming & Slash Commands in 1 Hour. Here Is Exactly What Didn’t Work Yet (And How I’ll Fix It).

⚡ WHAT SHIPPED IN V0.2.0 (THE WINS)

1. True Streaming (No More Spinners)

2. Slash Commands (Muscle Memory)

3. New Context Sources: @problems and @git

🛑 WHAT DIDN’T WORK YET (THE GAPS)

Gap 1: @problems and @git Are Collected But Ignored

Gap 2: Stop Button Doesn’t Kill the Backend Call

Gap 3: No Multi-Conversation Persistence

Gap 4: No Inline Code Actions

👑 WHY I SHIPPED ANYWAY

🚀 ROADMAP TO V0.3.0 (NEXT 24 HOURS)

📥 DOWNLOAD V0.2.0

Iam 12 . My web mentor KODA Is Now in Your Editor. Here Is How I Built a Cursor-Killer Extension on a $150 Phone.

⚡ WHY THIS MATTERS

🛠️ THE ARCHITECTURE: ZERO BUILD STEPS

How It Works: The Agentic Loop

🛡️ SECURITY FIRST: HARDENING THE AGENT

📊 THE BENCHMARKS: STILL TRUE

👑 TRY IT YOURSELF

Iam 12 .My AI Mentor Was Broken. Groq Killed It. Here Is How I Fixed It on a $150 Phone in 72 Hours.

⚡ THE CONSTRAINT IS THE POINT

🛠️ PHASE 1: THE FRONTEND AUTOPSY

The Fixes

☁️ PHASE 2: SURVIVING THE MODEL DEPRECATION

The Solution: The Fallback Chain

Debugging Without a Terminal

🌐 PHASE 3: LIVE WEB SEARCH (STOPPING THE HALLUCINATIONS)

Implementation

📊 THE BY-THE-NUMBERS RECOVERY

👑 FINAL THOUGHTS

BuildInPublic #AI #Cloudflare #Groq #Cybersecurity #WebDev #HYNAWEB #SoloFounder #Resilience #12YearsOld

I Am 12. My Phone Costs $150. Groq Tried to Kill My AI. Here Is How I Survived It.

⚡ PHASE 1: THE FRONTEND AUTOPSY

The Fixes

🛠️ PHASE 2: SURVIVING THE MODEL DEPRECATION

The Solution: The Fallback Chain

Debugging Without a Terminal

🌐 PHASE 3: LIVE WEB SEARCH (STOPPING THE HALLUCINATIONS)

Implementation

📊 THE BY-THE-NUMBERS RECOVERY

👑 FINAL THOUGHTS

BuildInPublic #AI #Cloudflare #Groq #Cybersecurity #WebDev #HYNAWEB #SoloFounder #Resilience #12YearsOld

I Am 12. My Phone Costs $150. Claude Said My AI Is "Impressive. Period." Here Is the Live Build.

⚡ THE CONSTRAINT IS THE POINT

🛠️ WHAT SHIPPED TODAY (THE FIXES)

1. The Cloudflare Handshake

2. The Unlimited Language Brain

3. Native Markdown Rendering

📊 THE RECEIPTS: 54/54 SCORE

🌍 THE MISSION: ROAD TO 100 USERS

👑 FINAL THOUGHT

BuildInPublic #AI #WebDev #Cloudflare #Supabase #HYNAWEB #SoloFounder #CodingMentor #ClaudeAI #12YearsOld

I Built a Production AI Mentor on a $150 Phone. Claude Reviewed It. Here Are the Benchmarks.

⚡ THE BENCHMARKS THAT MATTER

🏆 THE 9 CHALLENGES (54/54)

🛠️ WHY HARD CODED GUARDRAILS WIN

WHAT THIS PROVES

🗺️ THE ROADMAP

🤝 VALIDATION BEYOND AI

🐯 THE FIRM STANDS

I asked for a brutal enterprise stress-test of my AI. The audit came back, and I realized the craziest plot twist of launch day.

3. New Context Sources: `@problems` and `@git`

Gap 1: `@problems` and `@git` Are Collected But Ignored