Simplify VPS Management with 1Panel

Running Claude Code or Codex locally but stuck at your desk to babysit it? Paseo lets you orchestrate 31+ coding agents from your phone, browser, or CLI. With E2E encrypted relay so your code never leaves your machine. More specs in the next tweet. #DevTools Free & open source. Supports Claude Code, Codex, GitHub Copilot and 31+ more. Git worktrees, MCP servers, Tailscale/Cloudflare Tunnel support. Listing has the full breakdown. https://lnkd.in/gfy8-Dex

"How does login even work?" — here's the short version. Sessions: → Server stores who's logged in → Cookie just holds a session ID, nothing sensitive → Easy to revoke instantly (just delete the session) JWT (JSON Web Tokens): → The token itself carries the user's data → Server stores nothing — fully stateless → Scales easily across servers, but harder to revoke early Most PERN apps start with sessions — they're simple and easy to reason about. JWT shines once you're scaling across multiple servers or building an API for mobile apps too. Save this for your next auth implementation. #Authentication #JWT #SessionAuth #Backend #WebDevelopment #PERN

When something appears to have broken on your web app whilst using it live on a call, and you check the server logs, and see no error... ...and then realise you don't see any log at all since the automated cron job just after midnight. Then you realise that the version you were using whilst on the call was the localhost version and not the deployed one 🤦♂️

A 5-point security gut check for your AI-built app this weekend: 1. Open dev tools and search your bundle for "key" and "secret" 2. Check if your source maps are publicly accessible 3. Confirm your admin routes actually require auth 4. Look at your response headers for CSP and HSTS 5. Make sure error pages do not print stack traces If any of these makes you nervous, run a full scan. Vuln0x checks all of this and more in 60 seconds. #checklist #appsec #developers

One domain. Multiple services. Zero custom code. Introducing Request Routing — define path-based rules and send traffic to exactly where it needs to go. Route /api/* to your app server, /assets/* to S3, /auth/* to your identity provider. Clean, fast, declarative. Available now on all plans → https://lnkd.in/eXTz3ZVp

One domain. Multiple services. Zero custom code. Introducing Request Routing — define path-based rules and send traffic to exactly where it needs to go. Route /api/* to your app server, /assets/* to S3, /auth/* to your identity provider. Clean, fast, declarative. Available now on all plans → https://lnkd.in/ePW4HZke

One domain. Multiple services. Zero custom code. Introducing Request Routing — define path-based rules and send traffic to exactly where it needs to go. Route /api/* to your app server, /assets/* to S3, /auth/* to your identity provider. Clean, fast, declarative. Available now on all plans → https://lnkd.in/ePW4HZke

One domain. Multiple services. Zero custom code. Introducing Request Routing — define path-based rules and send traffic to exactly where it needs to go. Route /api/* to your app server, /assets/* to S3, /auth/* to your identity provider. Clean, fast, declarative. Available now on all plans → https://lnkd.in/gW-Yq6An

One domain. Multiple services. Zero custom code. Introducing Request Routing — define path-based rules and send traffic to exactly where it needs to go. Route /api/* to your app server, /assets/* to S3, /auth/* to your identity provider. Clean, fast, declarative. Available now on all plans → https://lnkd.in/ehJCCQbj

Building Albumio in public — and this week was all about auth. I shipped the full authentication system: email/password login, OTP email verification, forgot password flow, and Google Sign-In. The first three? Smooth. Google Sign-In? That's been a lesson in cross-platform OAuth. Here's what I ran into: → Started with expo-auth-session (browser-based PKCE flow). Google's Web OAuth client rejects custom URI schemes like albumio:// as redirect URIs. Dead end. → Moved to backend code exchange - same redirect URI problem. Still blocked. → Tried platform-specific client IDs - Android's OAuth clients don't support browser-based flows at all. Fundamentally incompatible. → Finally landed on the right approach: @react-native-google-signin/google-signin. The native SDK skips the browser entirely, shows Google's native sign-in sheet, and returns an ID token directly. No redirect URIs needed. Currently debugging a DEVELOPER_ERROR on Android - Google's native SDK validates the SHA-1 fingerprint of your signing certificate against what's registered in Cloud Console. Miss that registration step and it fails silently with a cryptic error. The thing nobody tells you: iOS and Android have completely different OAuth models. What works on one platform can be architecturally incompatible with the other. You can't just abstract over it. Still shipping. Stay tuned! #buildinpublic