okay so real talk.
last week our AI mentor KODA had its API key sitting in the frontend code.
and the internet did what the internet does: bots found it and drained our credits overnight. 💀
we didn't cry. we didn't quit. we rebuilt the entire infrastructure in 48 hours from a $150 android phone. here's the story, no corporate speak, we promise.
💀 Chapter 1: The Breach
our key was naked in the JavaScript. anyone could right-click → inspect → steal.
and they did. credits: gone. dreams: temporarily paused.
lesson learned the hard way: never trust the client. ever.
🔐 Chapter 2: The Vault
we moved the key into a Cloudflare Worker (basically a tiny server that lives in the cloud and costs $0).
now the flow is:
- KODA sends your prompt to the Worker
- the Worker grabs the secret key from an encrypted vault
- the Worker talks to the AI and sends the answer back
your browser never sees the key again. the bots are officially locked out. cry about it 🤡
bonus flex: if one AI model dies or rate-limits, the Worker automatically hops to the next model in a fallback chain. KODA literally heals itself mid-conversation. self-healing AI on a phone budget. we're so back.
☁️ Chapter 3: The "Wait… My Chats Followed Me?!" Moment
this is the part that broke our brains.
we had two URLs: a temp testing one and the main production one.
we chatted on the temp URL… then opened the main URL…
AND THE EXACT SAME CONVERSATION WAS THERE. 😭
why? because your chats don't live in your browser anymore. they live in a cloud database (Supabase) tied to YOUR account, not to a URL.
- chat on your phone → open your laptop → it's there
- chat on a temp link → open the real site → it's there
- clear your cache → sign back in → STILL THERE
we even watched localStorage get buried next to it. pour one out. 🪦⚰️ (see the tombstone on the cover, we paid our respects)
🛡️ Chapter 4: The Database Guards Itself
"but bro, can't people just read everyone's chats from the database?"
nope. we used Row Level Security (RLS) — think of it as a bouncer built INSIDE the database. every row checks: "does this user own this row?" if not → rejected. even if someone bypasses the whole frontend, postgres itself says nah bro. 🚫
🐯 Chapter 5: The Viral Engine Is Armed
we also built referrals directly into the database with triggers:
- share KODA with your friend (your link carries your name)
- friend signs up
- the database AUTOMATICALLY bumps your referral count
- hit the threshold → you get flagged Ambassador / Champion
no manual work. no spreadsheets. the database runs the growth engine while we sleep. 😴
The Real Lesson
we got breached because we rushed.
we got bulletproof because we refused to stay broken.
every founder will get punched by production eventually. the ones who win are the ones who patch, upgrade, and ship again — faster and stronger.
also yes, all of this was built and deployed from a POCO C55 android phone. constraints breed elegance, bro. 📱
🚪 Pull Up
KODA is live, cloud-synced, and bot-proof:
🔗 https://koda-aicodementor.netlify.app/
- sign up (cloud sync unlocked) or hop in as Guest
- vote in today's Tech Wars on Dojo Feed
- share your referral link and farm Ambassador status
the dojo is open. the vault is locked. the chats follow you forever.
see you on the leaderboard 🥋
Top comments (2)
Looks like multi-language support isn't available yet.