OpenGrok is a production-grade source code search and cross-reference engine, written primarily in Java with supporting Python tooling. It indexes source code repositories from multiple version control systems (Git, Mercurial, Subversion, Perforce, CVS, RCS, SCCS, BitKeeper, etc.) and provides a web-based interface and REST API for searching, browsing, and annotating code. The system is architected as a Lucene-backed indexer (opengrok-indexer) that analyzes source files using language-specific JFlex lexers and ctags for symbol extraction, a web application (opengrok-web) built on Jersey and Jakarta Servlets, a suggester module for autocomplete, and a plugin-based authorization framework supporting LDAP and header-based authentication. Key entry points include the Indexer CLI, the web application's REST controllers (e.g., SearchController, FileController, HistoryController), and Python administration scripts (opengrok-indexer, opengrok-mirror, opengrok-sync). External dependencies include Apache Lucene, JFlex, Universal Ctags, and various VCS binaries. The codebase demonstrates strong engineering practices with extensive unit and integration tests, Docker deployment, and a modular analyzer hierarchy covering over 30 programming languages.
elFinder is a mature, full-featured web-based file manager with a client-server architecture. The client is built on jQuery and jQuery UI, providing a rich interface for file operations (browse, upload, download, copy, move, rename, delete, search, preview, edit, archive, etc.) with extensive internationalization and plugin support. The server-side is a PHP connector that abstracts storage backends via a volume driver pattern, supporting local filesystem, FTP, SFTP, MySQL, Dropbox, Google Drive, OneDrive, Box, and more. The codebase demonstrates strong engineering practices: a command pattern for file operations, a plugin system for both client and server, a session abstraction, and a UI widget factory. However, it carries legacy dependencies (jQuery UI, PHP 5.2+) and some cloud drivers have incomplete implementations or API drift. Overall, it is a well-crafted, production-ready application with several reusable patterns.
Glyphr Studio 2 is a fully functional, web-based font editor that runs entirely in the browser. It provides a complete workflow for designing typefaces: creating and editing glyphs via a canvas with Bézier path tools, managing kerning pairs and ligatures, building reusable component instances, and importing/exporting fonts in OTF, TTF, WOFF, WOFF2, and SVG font formats. The application is built as a single-page application using vanilla JavaScript (ES modules) with Vite as the build tool, and it relies on several external libraries: font-flux-js for binary font I/O, bezier-boolean for boolean path operations, and svg-to-bezier for SVG outline parsing. The architecture separates project data (a hierarchical model of glyphs, paths, points, components, and settings) from the UI layer, which is composed of custom web components (e.g., FancyButton, EditCanvas, DisplayCanvas) and a publish-subscribe event system for decoupled state updates. Key entry points include src/app/main.js (application bootstrap), src/project_editor/project_editor.js (central controller managing navigation, history, and selection), and src/formats_io/otf/font_export.js (binary font generation). The editor supports multi-project editing, undo/redo with IndexedDB persistence, and a variety of panels for attributes, layers, guides, and quality checks. The codebase demonstrates solid engineering practices with a clear data model, reusable UI components, and comprehensive unit tests for core data structures and import/export routines, though some areas (e.g., UI panels) have less test coverage.
PayloadsAllTheThings is a curated knowledge base of web application security payloads, bypass techniques, and exploitation methodologies. It is organized by vulnerability type (e.g., SQL Injection, XSS, SSRF, SSTI, File Inclusion) with each category containing a README.md explaining the technique, references to original research, and subdirectories for payload wordlists (Intruder/), exploit scripts (Files/), and diagrams (Images/). The repository also includes methodology guides for Active Directory, cloud pentesting, and privilege escalation. While primarily a static reference, it contains hundreds of standalone exploit scripts (Python, PHP, Ruby, shell) and configuration files (e.g., .htaccess, web.config) that can be directly reused in penetration testing engagements. The content is actively maintained with recent commits and CI/CD workflows, though some payloads reference older CVEs and may require adaptation for modern environments. This is a hybrid resource: a research-oriented payload collection with embedded executable components.
Rock Radar is a frontend web application for displaying multi-dimensional data using interactive radar charts. It visualizes entity attributes (such as bands or game players) across configurable dimensions with animated transitions, background particle effects, and synchronized audio playback. The application features a draggable timeline for navigating between data points, fullscreen mode for video capture, and extensive customization through a CONFIG object. Built with vanilla JavaScript and HTML5 Canvas, it implements sophisticated visual effects including multi-layer glow effects on the radar chart and a dual-type particle system. The codebase includes two variants: index.html (general purpose) and index-cs.html (specialized for Counter-Strike statistics).
This repository implements an RSS feed aggregator for corporate tech blogs. It fetches RSS/Atom feeds from a predefined list of company technology blogs, processes and enriches the feed items with metadata (Open Graph data, Hatena bookmark counts), generates aggregated feeds in Atom/RSS/JSON formats, and builds a static website using Eleventy to display the aggregated content. The site features a homepage with recent articles grouped by date, a 'hot' page showing popular articles based on Hatena bookmarks, individual blog pages, and a blog listing page. Updates are automated via GitHub Actions that run hourly on weekdays and every two hours on weekends.
Gogs is a self-hosted Git service written in Go, providing a full-featured platform for hosting Git repositories with issue tracking, pull requests, wiki, webhooks, and Git LFS support. The backend is a monolithic Go application using a dual web framework (Macaron and Flamego) and dual ORM (XORM and GORM) during an ongoing migration. The frontend is a hybrid of legacy server-rendered templates and a modern React SPA built with TanStack Router, Radix UI, and Tailwind CSS. The system supports multiple authentication backends (LDAP, SMTP, PAM, GitHub OAuth), SSH and HTTP Git protocols, and extensive REST API. It is deployed via Docker with s6 supervisor and backup rotation scripts. The codebase demonstrates strong engineering practices with well-structured utility packages, security-conscious input validation, and comprehensive test coverage using golden files and mock stores. However, it carries technical debt from the framework migration, vendored outdated frontend plugins (CodeMirror 5.17.0), and a monolithic legacy JavaScript file.
WebGoat is a deliberately insecure web application designed for security training, providing hands-on lessons for the OWASP Top 10 vulnerabilities. In production, it operates as a Spring Boot monolith with a modular lesson architecture; each lesson is a self-contained endpoint that simulates a real-world vulnerability (SQL injection, XSS, CSRF, JWT misuse, etc.) and validates the user's attack payload. A companion application, WebWolf, acts as attacker infrastructure (file hosting, JWT encoding/decoding, request logging). The system includes user registration, progress tracking via JPA/Flyway with per-user database schemas, and a Thymeleaf/Backbone.js frontend with multilingual support. External dependencies include H2/HSQLDB, Spring Security, AsciiDoc rendering, and intentionally outdated libraries (e.g., jQuery 2.1.4) to demonstrate specific weaknesses. The architecture is well-structured but carries intentional technical debt for educational purposes. The most reusable components are the WebAuthn support utilities (CBOR, COSE, attestation parsing) and the command execution service, both of which demonstrate non-obvious engineering skill and can be extracted independently.
This is a comprehensive visual programming system called 'Unit' that implements a dataflow/reactive paradigm where programs are composed of interconnected units (MIMO finite state machines) in a directed graph. The system includes a full-stack runtime (Node.js server and browser client), a graph editor UI with drag-and-drop, a rich library of built-in functional units (arithmetic, string, array, control flow, etc.), platform API wrappers (canvas, audio, Bluetooth, WebSocket, etc.), and a custom spec language for defining units. The architecture is centered around a core class hierarchy (Unit, Graph, Pin, Component) with a reactive push-based execution model. The project is actively maintained with a large community (4920 stars) and demonstrates sophisticated engineering in areas like force-directed layout simulation, custom parser with type inference, and a comprehensive debugging infrastructure. While the codebase is extensive and well-structured, some components (e.g., the main Component class) are large and tightly coupled, and there are signs of duplication and incomplete implementations in some areas.
This is a monolithic Spring Boot web application built with Kotlin that implements a blog engine. The application serves both HTML pages via Mustache templates and provides a REST API for articles and users. It uses Spring Data JDBC for data access with an H2 database, and includes sample data initialization. The architecture follows standard Spring MVC patterns with controllers handling web and API requests, repositories for data access, and configuration properties for externalized settings. The code demonstrates idiomatic Kotlin usage with extension functions, data classes, and proper null safety.
Bundlephobia is a production web application that analyzes the bundle-size cost of npm packages by performing real builds with a bundler. It exposes a public REST API (endpoints for size, exports, history, trends, similar packages) and a rich Next.js frontend with interactive visualizations (treemaps, trends charts, export analysis). The architecture is microservice-oriented: a main Koa/Next.js server orchestrates requests, a Fastify build-service executes package builds with timeout and profiling, a cache-service backed by Firebase and LRU memory stores results, and an installation-service deduplicates npm installs with lease-based concurrency control. The system also includes a separate Kotlin/Gradle sub-project for JVM package analysis (Maven, Android AAR/JAR) and a curated similar-packages catalog maintained via automated AI research workflows. External dependencies include npm registry, GitHub API, Algolia, Contentful, and Amplitude analytics. Key design patterns include a language-agnostic analysis gateway with adapter registration, a middleware pipeline for request processing (caching, rate-limiting, error handling), typed service contracts using Zod schemas, and a queue service with priority and cancellation. The codebase demonstrates strong engineering practices with extensive unit and e2e tests, custom Oxlint lint rules enforcing internal TypeScript standards, and CI/CD automation for package recommendation updates and JVM releases. While primarily an application, the repository also contains data-research elements: a curated similar-packages catalog with weighted tags, trends analysis merging npm downloads and GitHub stars, and automated library research scripts that propose catalog updates. These are integrated into the application's recommendation features.
pgweb is a web-based PostgreSQL database explorer written in Go. It provides a single-page application frontend (jQuery, Bootstrap 3, Ace editor) and a REST API backend (Gin framework) for browsing schemas, executing SQL queries, viewing table data, and exporting results. The application supports multi-session management, SSH tunnels, TOML-based bookmarks, Prometheus metrics, and third-party authentication backends. It is distributed as a single cross-platform binary with zero external runtime dependencies beyond a PostgreSQL server. The architecture is a monolith: the Go server serves static files and exposes API endpoints for database operations. Key entry points are the CLI (main.go -> pkg/cli/cli.go) and the API routes (pkg/api/routes.go). The codebase demonstrates solid engineering with clean abstractions for database client, connection string building, session management, and metrics, but the frontend relies on outdated libraries (jQuery 2.1.1, Bootstrap 3, Ace editor) and the project shows some technical drift in dependency versions and deprecated environment variables.
Local Deep Research is a self-hosted, privacy-focused AI research assistant that performs deep, agentic research using multiple LLMs and web searches. It provides a full-stack web application (FastAPI + JavaScript), a programmatic API, and a Model Context Protocol (MCP) server. The system ingests user queries, decomposes them, executes parallel searches across web and academic sources (SearXNG, Google, arXiv, PubMed, Semantic Scholar, etc.), fetches and extracts content, evaluates evidence, and synthesizes reports with citations. It features per-user encrypted SQLCipher databases, a settings system with environment variable overrides, a RAG library with FAISS vector store, journal quality scoring, news subscriptions, and extensive security controls (egress policy, SSRF protection, credential scrubbing). The codebase is heavily tested with unit, integration, UI, accessibility, and security tests. It is a hybrid of a web application and a research data pipeline, but the dominant character is a production-grade application.
TasmoAdmin is a web-based application for managing Tasmota-flashed IoT devices. It provides a responsive interface for device configuration, monitoring, firmware updates, and batch operations. The application features a modular PHP backend with dependency injection, factory patterns, and reusable helper utilities. It supports MQTT-based device discovery, automatic firmware updates via GitHub, and includes a self-update mechanism. The frontend uses Bootstrap 5 and jQuery for a modern user interface, with JavaScript modules handling dynamic interactions and state management.
This repository is the official Composer project template for bootstrapping new Sulu CMS applications. It is not a standalone CMS but a pre-configured Symfony 7.4 application skeleton that wires together the Sulu 3.0 bundles (admin, media, security, page, search, article, snippet, etc.) with Doctrine ORM, MySQL, Twig, Messenger, Flysystem, and a React-based admin SPA built via Webpack. The application exposes two runtime contexts through a single kernel: an admin backend under /admin with a JSON API and a website frontend serving Twig templates. Entry points are public/index.php for web requests and bin/console, bin/adminconsole, bin/websiteconsole for CLI operations. The template includes production-oriented infrastructure: HTTP cache layer via SuluHttpCache, FOSHttpCache for proxy caching, 2FA via scheb/2fa, search via CMSIG Seal with Loupe adapter, media handling, and a maintenance mode script that works without framework dependencies. The composer.json defines an extensive lint/test pipeline (PHPStan level max, PHP-CS-Fixer, Rector, Twig CS Fixer, container validation, Doctrine schema validation) and the GitHub Actions workflow tests the template across PHP 8.2-8.5, MySQL 5.7-8.4, and Node.js 20-24, including a create-project test that verifies the template can bootstrap a new project. Because this is a skeleton, the actual application code is minimal (a Kernel class, empty fixtures, and basic Twig templates). Its value lies in the configuration and integration of the Sulu ecosystem, serving as a starting point for multi-lingual, multi-portal CMS websites. The repository is actively maintained with recent commits and a comprehensive CI pipeline.
CATMAID (Collaborative Annotation Toolkit for Massive Amounts of Image Data) is a full-stack web application for collaborative connectomics research. It enables neuroscientists to trace neuron skeletons, annotate synapses, and analyze neural circuits across massive image stacks. The backend is a Django monolith with a REST API, PostgreSQL/PostGIS database, Celery for async tasks, and WebSockets for real-time collaboration. The frontend is a large JavaScript codebase using jQuery, Three.js, Pixi.js, D3, and custom widget system. Key features include skeleton tracing tools, 3D visualization, NBLAST neuron similarity, connectivity matrices, and review workflows. The codebase is well-structured with many reusable client-side utilities (event system, command pattern, caching, settings manager) and demonstrates strong engineering practices with CI/CD, tests, and Docker deployment. However, it carries some technical debt from vendored libraries and complex database migrations.
This is the official Laravel skeleton application, the default starting point for new Laravel projects created via `composer create-project laravel/laravel`. It provides a minimal, well-structured web application foundation with a single welcome page, default authentication scaffolding (routes only), database migrations for users/cache/jobs, a basic User model, and standard configuration files for all major Laravel services. The repository itself contains no business logic or custom features; it is a clean, maintained template that reflects the current best practices of the Laravel ecosystem (PHP 8.3+, Vite 8, Tailwind 4, PHP 8 attributes). Its primary purpose is to serve as a foundation for developers to build upon, not as a functional application in its own right.
This is a modern Next.js 16 starter template using the App Router, designed to jumpstart full-stack web applications. It provides a production-ready monolith with authentication via NextAuth (GitHub provider), payment processing through Stripe subscriptions, and a PostgreSQL database layer using Drizzle ORM and Neon serverless. The application includes internationalization (i18n) with next-intl, dark mode theming, custom fonts, and standard SEO features like sitemap and robots.txt. The codebase demonstrates disciplined engineering with TypeScript, Zod environment validation, Biome linting, Husky git hooks, and both unit (Jest) and end-to-end (Playwright) testing. While functionally complete and well-structured, it is fundamentally a starter kit composed of framework boilerplate and standard integrations, without innovative or deeply reusable custom abstractions beyond what is typical for such templates.
CloudDM is a database management platform providing unified access to multiple database systems. It features a web-based console interface built with Vue.js and a Java/Spring Boot backend with a plugin architecture for database drivers. The platform combines database querying, management, access control, SQL auditing, CI/CD capabilities, and workflow automation in a single system. The architecture follows a modular, layered design with clear separation between frontend, backend API, service layer, data access layer, and plugin system. Key features include multi-database support (MySQL, PostgreSQL, Oracle, SQL Server, MongoDB, Redis, etc.), SQL parsing and analysis, security rule engine, and extensibility through plugins.
Qexo is a Django-based web application that serves as a comprehensive online editor and management dashboard for static blog generators, primarily Hexo but also supporting Hugo, Valaxy, VuePress, Vitepress, Nuxt, and Astro. It provides CRUD operations for posts, pages, images, friend links, talks, and custom settings, with a rich text editor (Vditor) and image upload to multiple providers. The architecture follows a modular provider pattern for blog hosting (GitHub, GitLab, Gitea, local) and image hosting (S3, FTP, AliOSS, Upyun, etc.), along with a notification abstraction layer (OnePush) supporting 16+ services. It includes user authentication with passkeys (WebAuthn), multi-language support (7 languages), a version upgrade system (Elevator), and deployment options for Vercel, Docker, and traditional servers. The codebase is well-structured with clean abstractions, but contains some inline JavaScript and duplicated pagination logic in templates.