Index / Work / BuiltBy — Developer Social Platform
BuiltBy — Developer Social Platform
Solo — product, design, frontend, backend, security model, deployment
A social platform for developers where the post is the product. Instead of a screenshot or a recorded demo, builders upload a bundle or import a public GitHub repo and it runs live inside the feed — sandboxed, and actually usable by anyone scrolling past. Built and shipped solo, from the execution sandbox to the Android build.
- Client
- Self-initiated product
- Industry
- Developer tools / Social
- Role
- Solo — product, design, frontend, backend, security model, deployment
- Platform
- Web
- Stack
- Next.js 15 · React 19 · TypeScript · Tailwind CSS · Firebase · Firestore · Cloud Run · Docker · PWA / TWA
- Dated
- 2026-08-10
- Upload a bundle or import a GitHub repo — it runs live in the feed, no deploy step
- Demos execute at an opaque origin: sandboxed iframe, CSP sandbox, nosniff
- In-browser preview via service worker + Cache API, before anything is uploaded
- Publish-time static scan — blocks phishing and obfuscation patterns, flags the rest
- Verified-only posting: developers via GitHub OAuth, companies via business email
- Build Score from real usage — returning visitors, session depth, comments, likes
- Social layer: profiles, follows, likes, comments, notifications, DMs with message requests
- Collab posts — co-builders invited by the owner, shown publicly only once they accept
- Jobs board with one-tap interest that opens a chat with the company
- Community UI-component library with a moderation queue and copy counts
- Server-rendered product pages — every project is its own shareable landing page
- Installable PWA with an Android (TWA) build
① Challenge
Proof of skill is hard to verify. GitHub shows code only engineers can read, portfolios show screenshots, and a link to a live site dies the moment hosting lapses. The obvious fix — letting people run each other’s code on your own domain — is also the dangerous one: arbitrary untrusted JavaScript executing under your origin can reach the sessions of every user on the platform.
② Solution
Every demo runs in an iframe sandboxed without allow-same-origin, which gives the served code an opaque origin, reinforced by a CSP sandbox directive and nosniff on every file. Demo HTML is only served for a project that has actually been published, closing the upload-but-never-publish bypass. Before anything reaches storage, a service worker and the Cache API run the project locally in the builder’s own browser so they can verify it, and a dependency-free static pass triages the bundle at publish time — blocking unambiguous phishing and obfuscation patterns outright, flagging the borderline ones for human review.
③ Result
Live at builtby.in on Google Cloud Run, with an installable PWA and an Android build wrapping it. Around 18,000 lines of TypeScript covering the live-demo runtime, a full social layer, a jobs board, a community component library, games with leaderboards, and an admin console. Ranking runs on a transparent Build Score derived from real usage rather than vanity counts — returning users weighted highest, session engagement capped so the number resists farming, and every component of the score shown to the user.