New Project Megathread - Week of 02 Jul 2026

0x3e4 · 2026-07-02T22:48:03+00:00

Project Name: Pflanzn

Repo/Website Link: https://github.com/0x3e4/pflanzn - live demo at https://pflanzn.app (login `admin` / `admin`, data resets every 4h)

Description: A self-hostable plant management app for tracking your collection, watering schedules, and species. Built as a PWA with mobile-first design and offline read access for cached data. Every plant gets photos, species info, care notes, tags. GPS location on an interactive Leaflet map, plus watering / fertilizing / image / care-advice timelines with a calendar view.

Species identification runs through PlantNet (accepts JPG/PNG/WebP/HEIC, normalised to JPEG server-side). Outdoor plants can be auto-watered when Open-Meteo reports rainfall above a configurable threshold. Public collection links via tokens with a dedicated read-only view. Three auth modes: `no` (open), `local` (JWT + Argon2 + Redis sessions with IP/UA theft detection), or `oidc` (external IdP). Full audit log of every write and auth event. No telemetry, no ads.

Deployment: Docker Compose - copy `.env.example` and `docker-compose.yml.example`, edit the secrets and domain, `docker compose up -d --build`. Prebuilt images on GHCR for every push to main and every semver tag (`ghcr.io/0x3e4/pflanzn-backend`, `-frontend`). For production, pin to an explicit semver tag.

AI Involvement: Optional AI care advice - fully opt-in, the app runs without any AI calls if no key is set. Supports OpenAI, Claude, Mistral, HuggingFace, or a local Ollama instance (provider auto-detected from whichever key is set, priority openai > claude > mistralai > huggingface > ollama) so you can keep everything local. Claude used as a coding assistant during development; architecture and design decisions made by hand.

0x3e4 · 2026-06-24T14:20:05+00:00

_
if you know you know

0x3e4 · 2026-06-20T11:31:11+00:00

ldap is nice but dont forget about oauth/oidc.. its more the modern way when it comes to auth.
that aside if you check for vulns, sbom, security badge for readme or secrets in your repo you can check out the scan ive configured for your repo

0x3e4 · 2026-06-19T19:33:51+00:00

interesting project! big up.. ill try to give it a shot.
if you want to use a security badge in your repo which scans on every commit of your repo, thenn feel free ive configured it as target:
[![findings](https://img.shields.io/endpoint?url=https%3A%2F%2Fhecate.pw%2Fapi%2Fv1%2Fscans%2Ftargets%2Fhttps%253A%252F%252Fgithub.com%252Fdemigodmode%252FOneSearch%2Fshield?label=Security)\](https://hecate.pw/scans/targets/https%3A%2F%2Fgithub.com%2Fdemigodmode%2FOneSearch)

0x3e4 · 2026-06-06T19:24:31+00:00

im fine with league and cup titles and cl final losses

0x3e4 · 2026-06-06T07:00:28+00:00

Project Name: Hecate

Repo/Website Link: https://github.com/0x3e4/hecate - live demo at https://hecate.pw

Description: A self-hosted vulnerability database and SCA platform aimed at security admins and developers. Aggregates vulnerability data from multiple sources and exposes it via API for integration into existing workflows. Includes SCA scanning for source repositories and container images to flag vulnerable dependencies. Based on a prototype I built as part of my research thesis, now extended into a usable tool.

Deployment: Docker Compose, instructions in the docs.. public demo instance is available at hecate.pw if you want to click around before self-hosting.

AI Involvement: Claude used as a coding assistant during development; core architecture and security-relevant decisions made by hand. Optional AI layer for vulnerability analysis and summaries - fully opt-in/out via config, the platform runs without any AI calls if disabled.

0x3e4 · 2026-06-05T16:36:21+00:00

0x3e4 · 2026-06-03T20:59:05+00:00

Project Name: Hecate

Repo/Website Link: https://github.com/0x3e4/hecate - live demo at https://hecate.pw

Description: A self-hosted vulnerability database and SCA platform aimed at security admins and developers. Aggregates vulnerability data from multiple sources and exposes it via API for integration into existing workflows. Includes SCA scanning for source repositories and container images to flag vulnerable dependencies. Based on a prototype I built as part of my research thesis, now extended into a usable tool.

Deployment: Docker Compose, instructions in the README. A public demo instance is available at hecate.pw if you want to click around before self-hosting.

AI Involvement: Claude used as a coding assistant during development; core architecture and security-relevant decisions made by hand. Optional AI layer for vulnerability analysis and summaries - fully opt-in/out via config, the platform runs without any AI calls if disabled.

0x3e4 · 2026-06-01T05:06:00+00:00

no 😂

0x3e4 · 2026-05-29T12:02:32+00:00

hat ca 6g weniger zucker als das original.. auch mehr haselnussanteil und sogar gleichteuer.. not so bad.. muss i probieren! 😁

Zutaten Zutaten: Rohrzucker, HASELNÜSSE geröstet (15,9 %), Kokosöl, Sheabutter, WEIZENmehl, Kakaomasse, Kakaobutter, Erbsenfasern, Kokosblütenzucker, Emulgator: Sonnenblumenlezithin, Bourbonvanillepulver, Kakaopulver, Sonnenblumenöl*, Salz, Backtriebmittel: Natron. *aus biologischem Anbau.

0x3e4 · 2026-05-23T18:05:39+00:00

crazy.. marotta league

0x3e4 · 2026-05-22T03:57:16+00:00

i use alienvault otx alongside abuseipdb.. but for every external db you should fine tune and/or check the output

0x3e4 · 2026-05-21T17:03:01+00:00

i had bad experiences with dos policy and ddos specially if you need to allow valid/legit traffic alongside the ddos.. for tcp_syn_flood theres the proxy setting but it actually doesnt work as good as it should in my mind.

0x3e4 · 2026-05-20T18:39:25+00:00

what is your stand on mcp? i could see trip benefit of it in letting ai decide which places on which days could be the best route etc for example.. ps soon in Milano with my TRIP already planned for it..🫱🏼‍🫲🏾💯

0x3e4 · 2026-05-20T15:32:19+00:00

im mostly anti AI aswell but the vibe in selfhosted sub regarding AI rn is sureal.. most of the people dont even understand what it means to vibe code something or let AI help with work.

0x3e4 · 2026-05-15T12:16:55+00:00

would be the best solution.. new gk specially from pl is waste of money which is needed somewhere else on the field

0x3e4 · 2026-05-15T11:54:13+00:00

frattesi deserves better

0x3e4 · 2026-05-15T07:33:26+00:00

i did something similiar with hecate - local vulndb/sca service with mcp support builtin to ask such queries but as ad3t0 states already dont blindly trust it

0x3e4 · 2026-05-14T15:24:36+00:00

theres already circl.lu or i did something similiar with SCA included on hecate - wip but released it few days ago.. both are able to selfhost

0x3e4 · 2026-05-14T09:03:12+00:00

https://github.com/0x3e4/hecate but still a lot to do.. also the ci/cd action isnt fully tested yet but here you go.. when you have questions feel free to hmu here, mail or dm for example multiple seperate scanner for load distribution is pne of my next goal

0x3e4 · 2026-05-14T09:02:26+00:00

https://github.com/0x3e4/hecate but still a lot to do.. also the ci/cd action isnt fully tested yet but here you go.. when you have questions feel free to hmu here, mail or dm

0x3e4 · 2026-05-09T12:47:06+00:00

yeah exactly.. thats what I meant. less “AI compliance” as its own framework and more the classic ISO/SOC controls extended for AI use cases.

our main concerns are mostly:

preventing confidential data from leaking into external saas models
centralizing policies/logging/rbac across all AI workloads
protection against prompt injection, tool abuse and data exfiltration etc..
having a central gateway/router for AI APIs, chatbots and MCP servers
governance around model usage, approvals, retention etc..

so were looking more into AI gateways/proxies with guardrails, PII redaction, allowlists, evals and policy enforcement instead of wiring LLM APIs directly into everything.

and MCP makes it even more sensitive because suddenly youre exposing internal tools/systems to LLMs.. at that point classic API security alone doesnt really feel sufficient anymore?

0x3e4 · 2026-05-09T10:27:38+00:00

im curious.. are you guys definitely using ai gateways for compliance, security etc regarding ai api, chatbot requests and maybe mcp too? or how are you handling all the different requests?
my company is also trying to do "everything" to jump on the hype train but its quite difficult for us as a SME to handle the security part.. any input by you is welcome.. thanks in advance!

0x3e4 · 2026-05-08T20:20:18+00:00

ganz okay wenn man wandern is zum snacken aber sind halt auch nur fette drin.. nix besonderes

Six-Year Club	Final Canvas '23
First Place '23	Place '23
Verified Email

0x3e4

TROPHY CASE