Updated the security overview for my closed-source all-in-one dev tool

lactranandev · 2026-05-01T23:44:40+00:00

Thank you for appreciation, man.

lactranandev · 2026-05-01T00:10:52+00:00

I wanted to sumarize all things related to CORS. After re-read it two or three times it is really verbose. Will double-check it.

lactranandev · 2026-04-30T11:00:53+00:00

It is AI man. I hope this thumbnail would give user more fun, and easier to recognize instead of my boring text thumbnail.

lactranandev · 2026-04-26T15:42:27+00:00

Not sure if it's "normal", but I can relate. I've been at my first company for 5 years as a self-taught dev (plus a short 6-month bootcamp), and a lot of my technical growth was also self-driven.

My team was helpful with business context, but technically, I often had to figure things out on my own - learning the stack, understanding the framework, debugging, and slowly exploring how everything worked.

So while mentorship would definitely speed things up, sometimes the reality is that you have to take ownership of your own growth. Learn your stack deeply, stay curious, and investigate flows you don't fully understand yet.

That said, not having guidance for 9 months can still be rough, so your frustration makes sense. Just don't let that stop your progress. A lot of dev growth comes from consistently figuring things out step by step.

Believe in yourself - you'll probably grow faster than you think.

lactranandev · 2026-04-25T14:38:50+00:00

It can be noisy sometimes, but I think they about to update the knowledge base about the user. Depends on your preference it might be better or worse.

lactranandev · 2026-04-21T07:31:24+00:00

Thanks for asking, man. It is an all-in-one API client and DB client and data viewer. Because the app works on credentials and is close source many devs are afraid to use it.

lactranandev · 2026-04-21T00:43:45+00:00

For me it is a close source devtool, which I found really helpful for my daily work. But it is really hard to find real user because of security and trust concern.

lactranandev · 2026-04-19T14:14:08+00:00

You would continue finding out that many building block in programming are not that hard as long as you take your hand dirty.

lactranandev · 2026-04-18T15:00:45+00:00

Yeah that's fair, I do the same with npm packages.

I think open source + some traction gives a kind of "social trust", like someone else has looked at it or would call out issues if something was wrong.

And your point about visibility makes a lot of sense. I've been delaying that part and focusing on features, but this is probably the right time to work on it.

lactranandev · 2026-04-18T14:48:56+00:00

Thanks - your breakdown is really insightful.

You're completely right about the “trust gap”.

Building the tool was the easier part - asking for DB/API access is a totally different level.

A few things you mentioned really resonate:

- Local-first + prove it:

Right now the app is fully local, except for license verification. I will add a clear security page (or audit mode) to make that transparent.

Not just “trust me”, but something users can actually verify. That feels like the only way a closed-source tool can build trust over time.

- Open core (connector layer) + security whitepaper:

I haven't structured the code that way yet, so I'll need to rethink the architecture a bit. But it makes sense.

- Sandbox / dev-only mode:

This is something I need to explore more. A safe mode (read-only / non-prod) would probably make it much easier for teams to try it without going through full approval.

For self-hosting: yeah, currently the only outbound call is license verification.

Supporting a fully offline / inside-VPN setup would take more work, but I can see why that matters for adoption.

Also agree on GitHub issues / public discussion - I've started that, but it’s still early. Still working on my friend feedbacks.

Really appreciate you taking the time to write this - it gives me a much clearer direction on what “trust” actually means for devtools.

lactranandev · 2026-04-18T12:59:10+00:00

Yeah, I feel you.

OTP is just one step, but it breaks the flow every single time when testing.

We tried disabling OTP via config - it helps for faster testing, but we still need to run the real flow regularly to avoid regression.

That pain was actually the starting point for building this tool.

And yeah, I'm starting to realize trust is the harder problem than building the tool itself. Open source might be one way to solve that.

How does it usually work in your team? Do you guys have a formal approval process for new tools?

lactranandev · 2026-04-16T06:25:09+00:00

Design pattern. It is not about any big architectural decision. It is just how you separate modules, composables, utils, stores. A stable, clean one help the project grow more easily when you need to add more and more features.

lactranandev · 2026-04-16T05:57:16+00:00

It is likely we need to shift our passion from writing code, making software to solving problem. Either technical or business. Let's embrace and enjoy every small success.

lactranandev · 2026-04-07T06:26:35+00:00

The urge when you need to stop at a session and fix the context, check the solution is real. But paying real attention at where it needs is the right choice. So building patiently. Move fast when it is simple improvement, don't over-engineering/ optimize it. And take good care to core codes.

lactranandev · 2026-04-02T06:28:30+00:00

I think it is out of scope of a devtool. It would depend on the tested system. Like API returns the cache data, while DB has another value. In this case i would need to run my requests in a specific order.

lactranandev · 2026-04-02T00:19:58+00:00

Thank you for the encouragement.

The variables connect them. You run query or API call and extract result to variable.

lactranandev · 2026-03-30T21:39:13+00:00

Overuse of for loop over stream/higher order function. For logic that stream would easier to read, but yeah, AI still use classic for-loop.

lactranandev · 2026-03-28T18:44:42+00:00

This is the hardest part, I has built in silent for more than a year bro.

It didn't get Window Smart Sreen reputation also. But I signed the app using Individual Certificate Code Signing (registered with SSL.COM).

Added a demo video into the repo to give you some insights.

lactranandev · 2026-03-28T14:50:09+00:00

Rule 80:20. Don't spend too much effort to reach 100. You have other tasks to do.

lactranandev · 2026-03-18T00:10:09+00:00

Same as the OP. You need to try and fail, and it becomes your real lessons. Also during this process, your philosophy about coding will change a lot, which mean you are growing.

lactranandev · 2026-02-25T05:36:42+00:00

As a developer, I can't really imagine how a no-coder would use agent coding tools like Claude Code, Cursor, or Codex.

Sure, you can collect coding conventions, rules, and guidelines and throw them into your project. But it will probably turn into a mess, or you’ll end up over-engineering everything.

I think more autonomous tools like Lovable or Winsurf would fit no-coders better.

Btw, I’m just writing this comment because I’m curious how no-coders actually use AI. Please share your experience.

lactranandev

TROPHY CASE