DEV Community: Naim Katiman

I Killed 3 Stub Functions in One Session

Naim Katiman — Mon, 13 Apr 2026 01:24:48 +0000

Every codebase has them. Stub functions that return hardcoded values, pretending to do real work.

Yesterday I hunted down 3 of them in my Node.js project and replaced every single one with real implementations. Here's what changed.

1. Real CI Workflow Generation

Before: createCIConfig() returned 0 lines. A stub. Nothing.

After: Generates a full 22-line GitHub Actions workflow tailored to the project's stack — installs deps, runs tests, caches node_modules.

2. Auto Test Scaffolding

Before: createTestScaffold() was a no-op.

After: Scans src/ for files missing test coverage and generates test file scaffolds automatically. No more guessing what needs tests.

3. Dynamic Summary Cards

Before: generate-card.mjs had a hardcoded "Project Bootstrap" title.

After: Accepts dynamic summary text, change counts, and properly escapes XML. The card now reflects what actually shipped.

The Scorecard

Metric	Value
Stubs killed	3
Tests passing	21/21
CI generated	Yes
Lines of real code	~750

The Takeaway

Stub functions are technical debt wearing a disguise. They pass CI. They don't throw errors. But they don't do anything.

If your codebase has functions that return empty arrays or hardcoded strings — go kill them. Today.

Building in public, one commit at a time.

Hardening an Express API: URL Validation, Error Handling, and Tests in One Session

Naim Katiman — Sun, 12 Apr 2026 01:17:09 +0000

I'm building repo-skill-advisor, a precision skill recommendation engine for GitHub repositories. Today I hardened the HTTP layer by closing three security and reliability gaps.

The Problem

The Express server accepted arbitrary URLs with no validation. Any string -- SSRF payloads, non-GitHub URLs, or empty strings -- was passed directly to the scanning engine. Error handling was inline with raw error messages leaking to clients.

What I Built

1. URL Validation Middleware

function validateGitHubUrl(urlStr) {
  if (!urlStr || typeof urlStr !== 'string') return null;
  try {
    const u = new URL(urlStr);
    if (u.protocol !== 'https:' && u.protocol !== 'http:') return null;
    if (u.hostname !== 'github.com') return null;
    const parts = u.pathname.split('/').filter(Boolean);
    if (parts.length < 2) return null;
    return { owner: parts[0], repo: parts[1].replace(/\.git$/, '') };
  } catch { return null; }
}

Applied as Express middleware to both POST routes so invalid URLs get rejected before reaching the scanner.

2. Centralized Error Handler

Routes now call next(err) and a single error handler catches everything -- no stack traces leak to clients.

3. require.main Guards

Both server.js and analyze.js now wrap CLI-only logic in require.main === module checks, so they can be safely imported for testing without side effects.

Results

Tests: 39/39 passing (up from 33)
New tests: 6 validation tests covering valid URLs, non-GitHub URLs, missing repos, empty input, and protocol checks
Security: Zero SSRF vectors, no information leakage

Key Takeaway

Yesterday's automated analysis identified these exact gaps. Today I closed all three. Building systematic gap analysis into your workflow means you always know what to fix next.

Check it out: repo-skill-advisor on GitHub

38.8% Win Rate, +21.83% P&L: Why Being Wrong Most of the Time Still Prints Money

Naim Katiman — Wed, 08 Apr 2026 04:54:14 +0000

TradeClaw went last week. Here are the real numbers.

The Numbers

Metric	Value
Total Signals	354
Resolved	103
Win Rate	38.8%
Avg P&L per Signal	+0.21%
Total P&L	+21.83%
Starting Balance	$10,000
Current Balance	$12,183
Max Drawdown	-10.66%
Sharpe Ratio	2.5

38.8% win rate. Looks bad on paper.

+21.83% total P&L in 48 hours. Looks less bad.

The Point

Most people obsess over win rate. They want to be right. They want 70%, 80%, 90% accuracy.

TradeClaw doesn't try to be right. It tries to be asymmetric.

The system cuts losers fast and lets winners run. When it's wrong, it loses small. When it's right, it captures the full move. That math works even when you're wrong more than half the time.

This is not a new idea. It's how every serious edge works. But most AI trading tools still optimize for accuracy instead of risk-adjusted returns. They chase win rate because it looks good in a demo. It doesn't survive real markets.

What TradeClaw Actually Does

It's an open-source AI trading signal engine. Python. Free APIs. Free compute. No paid infrastructure.

It scans crypto futures pairs on Binance (15m timeframe), detects three setup types:

Momentum Breakout — volume spike + key level break
Mean Reversion — liquidity grab / wick rejection at support/resistance
Trend Continuation — pullback to EMA21 in a trending market

Every setup gets graded A+ through C. Only A+ and A setups get auto-executed on testnet. Every signal is tracked. Every outcome is recorded. The track record page at tradeclaw.win shows all of it — no cherry-picking.

Built With Zero Budget

No paid APIs. No cloud servers. No subscription services.

The entire stack runs on free resources. If you have Python and an internet connection, you can run it.

This matters because most trading tools charge $50-200/month for signal access. TradeClaw gives you the signals, the logic, and the source code. You can verify every decision the system makes.

What I Need From You

This is an open-source project and I'm building it in public. I need:

Bug reports. The system is 2 days old. Things will break. If you find something, open an issue.

Ideas. New setup detection patterns, better risk management logic, additional pairs, different timeframes — if you have a thesis, I want to hear it.

Code. PRs are welcome. The codebase is Python, straightforward, and documented enough to jump into.

Stars. If the approach makes sense to you, star the repo. It helps with visibility and tells me the direction is worth pushing further.

Try It

Live track record: tradeclaw.win

The win rate will probably stay under 50%. The P&L won't care.

Cut the losers. Let the winners run. That's the whole system.

I built an open-source AI trading signal platform — here's what I learned

Naim Katiman — Mon, 30 Mar 2026 02:08:25 +0000

The problem

Every time I wanted to trade forex or crypto, I had the same friction: open TradingView, look at RSI, look at MACD, look at EMA, try to decide if they agree, second-guess myself.

The tools exist. The data exists. The math is solved. But nobody had packaged it as "here's the decision, not just the numbers."

So I built TradeClaw.

What it does

TradeClaw is a self-hosted AI trading signal platform. Point it at a symbol, and it returns:

{
  "direction": "BUY",
  "confidence": 82,
  "entry": 94210.50,
  "stopLoss": 93580.00,
  "takeProfit1": 95420.00,
  "takeProfit2": 96800.00
}

Not RSI=68. Not "MACD is crossing above signal line." A decision.

It covers 10 assets across forex, crypto, and commodities. It runs entirely in Docker. It has a REST API, a Telegram bot, a paper trading simulator, and a backtest visualizer.

It's MIT-licensed. Free forever. You own your data.

The tech stack

Next.js 14 — app router, server components
TypeScript — strict mode throughout
No database — file-based JSON (intentional, keeps deployment dead simple)
TA calculations — pure TypeScript: RSI, MACD, EMA, Bollinger Bands, Stochastic, ATR, ADX
Data — Binance API (crypto), Yahoo Finance (forex/commodities)
Docker — single docker compose up -d and it works

The signal engine

This was the interesting part. Most indicator libraries just return numbers. I needed decisions.

The approach: weighted scoring.

// Simplified version
function scoreIndicators(indicators: AllIndicators, candles: OHLCV[]): SignalScore {
  let buyScore = 0;
  let sellScore = 0;

  // RSI
  if (indicators.rsi < 35) buyScore += 2;
  else if (indicators.rsi > 65) sellScore += 2;

  // MACD histogram direction
  if (indicators.macd.histogram > 0) buyScore += 1.5;
  else sellScore += 1.5;

  // EMA crossover
  if (indicators.ema.ema20 > indicators.ema.ema50) buyScore += 1;
  else sellScore += 1;

  // Bollinger Band position
  if (price < indicators.bb.lower * 1.01) buyScore += 1.5;
  else if (price > indicators.bb.upper * 0.99) sellScore += 1.5;

  // ... more indicators

  const totalScore = buyScore + sellScore;
  const confidence = Math.round((Math.max(buyScore, sellScore) / totalScore) * 100);

  return {
    direction: buyScore > sellScore ? 'BUY' : 'SELL',
    confidence,
    buyScore,
    sellScore,
  };
}

The full version (apps/web/app/lib/signal-generator.ts) adds:

Market quality gating (ATR%, Bollinger bandwidth, EMA trend strength)
Stochastic confirmation
Multi-timeframe confluence (+15% confidence if H1/H4/D1 all agree)
Support/resistance proximity for stop placement

What I learned building this

1. Synthetic fallback is essential

Real trading APIs (Binance, Yahoo Finance) fail. Rate limits, network issues, outages. I built a synthetic fallback that generates realistic OHLCV data deterministically, so the platform always works even without internet.

// When live APIs fail, use seeded pseudo-random price simulation
function generateSyntheticCandles(symbol: string, count: number): OHLCV[] {
  let price = BASE_PRICES[symbol] || 100;
  let seed = hashSymbol(symbol);

  return Array.from({ length: count }, () => {
    seed = (seed * 1664525 + 1013904223) & 0xffffffff;
    const change = ((seed >>> 0) / 0xffffffff - 0.5) * 0.004;
    // ... generate realistic OHLCV
  });
}

2. No-database architecture is underrated

My first instinct was PostgreSQL. Instead, I used JSON files for everything — signal history, webhook configs, API keys, paper trading positions, price alerts.

Result:

Zero setup for self-hosting
Instant backup (just copy the data/ folder)
No connection pooling issues
Works in Vercel Edge functions

The downside: concurrent writes need locking. I used a simple in-memory queue. Good enough for a single-user self-hosted tool.

3. The plugin system was worth building

I added a plugin system where users can write custom JavaScript indicators:

// Custom VWAP indicator
function compute(candles) {
  let cumPV = 0, cumVol = 0;
  candles.forEach(c => {
    const typical = (c.high + c.low + c.close) / 3;
    cumPV += typical * c.volume;
    cumVol += c.volume;
  });
  return { value: cumPV / cumVol };
}

Each plugin runs in a sandboxed Function() with mock candles for validation. Community plugins can be shared as JSON.

4. MCP is the new RSS

Just shipped a Model Context Protocol server:

{
  "mcpServers": {
    "tradeclaw": {
      "command": "npx",
      "args": ["tradeclaw-mcp"]
    }
  }
}

Add this to Claude Desktop, and you can ask "What's the current BTC signal?" and get a full indicator breakdown. This is genuinely useful.

5. Viral signals from `npx`

The fastest way to get developers to try something is npx <package>. No install, no config:

npx tradeclaw signals --pair BTCUSD
npx tradeclaw-demo

The demo command spins up a local Express server with Bloomberg-style UI and a live SSE signal stream. All in under 3 seconds.

The honest part

Does following these signals make money? I don't know yet.

The signal accuracy pages currently use seed data for demonstration. I've built the infrastructure to track real emitted signals and compute audited outcomes — but that needs months of live data to be meaningful.

I'm not claiming this prints money. I'm claiming it's a well-built, transparent, self-hostable tool for exploring algorithmic signal generation. The math is open source. You can audit every line.

What's next

MT4/MT5 broker connectivity (actually send signals to your broker)
Machine learning confidence model (trained on tracked signal outcomes)
More assets (stocks, indices, energy)

Try it

# Docker (recommended)
git clone https://github.com/naimkatiman/tradeclaw
cd tradeclaw && docker compose up -d

# Or just demo it
npx tradeclaw-demo

Live demo: tradeclaw.win

GitHub: naimkatiman/tradeclaw — stars help a lot 🌟

Built with Next.js, TypeScript, and a lot of caffeine. Feedback welcome in the GitHub Discussions.

I Built an Open-Source Alternative to $500/Year Trading Signal Tools

Naim Katiman — Sat, 28 Mar 2026 17:49:55 +0000

I was spending $47/month on TradingView Pro + 3Commas to get decent trading signals for XAUUSD, BTCUSD, and EURUSD. After a year, I cancelled both and built my own.

TradeClaw is now open source: https://github.com/naimkatiman/tradeclaw

What it does

Real-time buy/sell signals for 12 assets (XAUUSD, BTCUSD, ETHUSD, EURUSD, GBPUSD, and more)
Signal engine: weighted RSI (28%), MACD (20%), EMA crossovers (20%), Support/Resistance (20%), Bollinger Bands (6%), Stochastic (6%)
Backtesting against historical data
Telegram alerts when signals fire
Beautiful dark dashboard with candlestick charts

The cost comparison

Tool	Monthly	Annual
TradingView Pro	$15	$180
3Commas Starter	$29	$348
TradeClaw (self-hosted)	$5 VPS	$60

Deploy in 60 seconds

git clone https://github.com/naimkatiman/tradeclaw
cd tradeclaw
cp .env.example .env
docker compose up -d

Open http://localhost:3000. That's it.

Why open source?

These tools shouldn't cost $500/year. The technical analysis is well-understood math. The value isn't in the algorithm — it's in the UX, the integrations, and reliability.

TradeClaw is MIT licensed. Self-host it, modify it, contribute back.

Live demo: https://tradeclaw.win/demo
GitHub: https://github.com/naimkatiman/tradeclaw

⭐ Star it if you find it useful — it helps others discover the project.

DEV Community: Naim Katiman

I Killed 3 Stub Functions in One Session

1. Real CI Workflow Generation

2. Auto Test Scaffolding

3. Dynamic Summary Cards

The Scorecard

The Takeaway

Hardening an Express API: URL Validation, Error Handling, and Tests in One Session

The Problem

What I Built

1. URL Validation Middleware

2. Centralized Error Handler

3. require.main Guards

Results

Key Takeaway

38.8% Win Rate, +21.83% P&L: Why Being Wrong Most of the Time Still Prints Money

The Numbers

The Point

What TradeClaw Actually Does

Built With Zero Budget

What I Need From You

Try It

I built an open-source AI trading signal platform — here's what I learned

The problem

What it does

The tech stack

The signal engine

What I learned building this

1. Synthetic fallback is essential

2. No-database architecture is underrated

3. The plugin system was worth building

4. MCP is the new RSS

5. Viral signals from npx

The honest part

What's next

Try it

I Built an Open-Source Alternative to $500/Year Trading Signal Tools

What it does

The cost comparison

Deploy in 60 seconds

Why open source?

5. Viral signals from `npx`