I was tired of laggy, ad-bloated web tools, so I built a zero-latency AI toolkit that runs 100% in the browser.

Hey r/SideProject,

Like many of you, I spend half my day switching between LLMs, tweaking prompts, and handling AI-generated assets. But every time I needed a simple task done—like estimating API costs, cleaning up weird Markdown artifacts, or splitting a Midjourney 2x2 grid—I had to rely on sketchy, ad-riddled websites that felt sluggish and kept uploading my data to who-knows-where.

I figured: None of these simple operations actually require a server.

So over the past few weeks, I built RunAIToolkit—a set of ultra-fast, privacy-first micro-tools that execute entirely on the client side.

---

💡 What I built so far:

• AI Token & API Cost Estimator: Calculates exact token usage and estimates API costs across top LLMs (GPT-4o, Claude 3.5, DeepSeek R1). No more surprise cloud bills after running long prompts.
• Prompt & Markdown Cleaner: Strips system artifacts, invisible unicode characters, and unwanted formatting from LLM outputs instantly.
• Midjourney / Flux Grid Splitter: Uses local HTML5 Canvas to slice 2x2 image grids into high-res individual files with zero compression loss and zero upload delay.

---

🛠️ Key Technical Choices & Takeaways:

1. Static Export + Cloudflare Pages: Built with Next.js (App Router) and exported as pure static files to Cloudflare’s Anycast CDN. TTFB is under 50ms globally.
2. Zero Backend Cost: Since all logic runs in Web Workers and local JS, server maintenance cost is literally $0/month.
3. Data Privacy by Design: User prompts, text, and images never leave the browser. Perfect for developers handling NDA-sensitive data.

Comments

[Amit Feldman]

Congrats on shipping — 100% in-browser with zero latency is a strong position.

Quick public check of runaitoolkit.com (headers + public config only):

1. HSTS is missing — first-visit and downgrade protection aren't active; one Strict-Transport-Security: max-age=31536000; includeSubDomains header fixes it.
2. Your CSP is otherwise genuinely strong (frame-ancestors, object-src 'none', base-uri 'self' — most launches skip all of it), but script-src allows 'unsafe-inline', which neuters most of the XSS protection. Moving inline scripts to files or adding nonces tightens it without breaking anything.

Everything else checked out: TLS 1.3, nosniff, referrer and permissions policies, robots + sitemap all live. Happy to re-run the scan free after the HSTS lands. Good luck with the launch!

[sir lu]

Thanks for the deep dive and thoughtful security feedback, Amit! Really appreciate you taking the time to audit the public headers.

Good catch on HSTS — just enabled Strict-Transport-Security via Cloudflare with max-age=31536000; includeSubDomains active now.

Regarding the CSP unsafe-inline, that's a fair point. Since this is built with Next.js static export, I'll look into tightening script nonces/hashes in the upcoming build to solidify XSS defense even further.

Awesome to hear that TLS 1.3, nosniff, and the rest of the security setup passed your checks. Thanks again for the support! 🚀

[Amit Feldman]

Small correction on the offer above: I quoted the wrong prices. The Launch-Ready Audit is $49 (not $99) and the Deep Dive is $99 (not $149) — same links, and the Gumroad checkout shows the correct amounts. Apologies for the mix-up; the CSP static-export guidance and everything else above stands as written.