Pre-built code blocks
Payments, logins, uploads, admin areas, storage. The same handful of things get rebuilt on every project, and the same handful of mistakes get made. These are written once, carefully, and installed into your app as ordinary source you can read and edit.
Each one carries its own due-diligence record. Some passed. Some are marked caution, some have not been audited at all, and every page says which — because a block that claims a clean bill of health it has not earned is the exact problem the audit exists to catch.
A full audit was run against these and the verdict was a pass. Each page carries the date and what the run recorded.
A back office for your app — a sidebar, tabs, and tables you can add to and edit. The login is checked on the server rather than in the browser, so it cannot be clicked past.
Who it’s for “An admin back office to manage it”
node · vanilla
Lets people add photos and shrinks them before they are stored. It checks the file size before it opens the image, so an oversized upload is refused rather than being loaded first.
Who it’s for “People upload photos or images”
vanilla
Texts or emails you when something matters — a payment failed, a job stopped. It never throws an error back into the thing it is watching, and it throttles itself so a fault cannot spam you.
Who it’s for “Text or email me when something breaks”
node
Writes the tags search engines and social previews read, the sitemap and robots file, and privacy and terms pages — from details the site already holds. It fails your build if launch placeholders are still in the text.
Who it’s for “People should find it on Google, and it needs privacy/terms pages”
python
Remembers things after a refresh without the usual traps: it handles running out of space, survives a change to the shape of the saved data, and can export and re-import the lot.
Who it’s for “It remembers things after a refresh”
vanilla · react
A form that checks what people type, blocks the simplest spam, and says clearly whether it worked. The server checks everything a second time, because the browser half is convenience rather than a boundary.
Who it’s for “People submit something — a form, a signup, a message”
vanilla · node
Pop-up dialogs and slide-out panels that behave: the keyboard stays inside them, Escape closes them, the page behind stops scrolling, and a screen reader announces them properly.
Who it’s for “It has modals, drawers, or dialogs”
vanilla · react
Shows reviews and testimonials from the public, with a moderation queue in front of them — everything submitted is held as pending, and no code path can publish one without you.
Who it’s for “It shows reviews or testimonials from the public”
vanilla · node
Somebody looked and the verdict was caution or ungraded. Each page gives the verdict and its date, and lists what the audit found.
Shapes the data your app collects so it still counts as an asset if you ever sell the business: the numbers a buyer’s due diligence asks for, and the consent and deletion trail that makes the data legally transferable at all.
Who it’s for “I might sell this business one day”
sql · node
Saves that survive an update instead of wiping what the player earned, sound generated in the browser with no audio files to ship, and a shared scoreboard that needs no accounts.
Who it’s for “It is a game — saves that survive updates, sound, and a shared no-accounts backend”
node · react
After a job is finished, asks the customer a few short questions and then offers their own words back to them to post publicly on Google, Facebook or the BBB.
Who it’s for “Ask finished customers for a public review (Google, Facebook, BBB)”
vanilla · node · php · python
Takes card payments through Stripe, with a cart. The price is decided on your server and never in the browser, so a buyer cannot edit it on the way through.
Who it’s for “It takes payments”
node · vanilla
No full audit has been run against these. That is not a pass — it means nobody has looked at them yet, and each page says so.
Lets your app call a paid AI or API without the key ever reaching a visitor’s browser. A spending ceiling reserves before each call and settles after it, and a rate limiter stops one visitor draining the budget.
Who it’s for “It calls an AI or a paid API with a secret key”
node
What a local app needs before other people can use it on a server rather than you on your laptop — separate data per customer, a readiness check, a safe answer when it is only half-configured, and a gate on who gets in. Every one of those was a real defect in the Playground first.
Who it’s for “It runs on a server for other people, not just on my machine”
node · sql
A members-only area for the people who already have an account in your app — no second login. Each member gets a profile that shows other members only their name, bio and picture, and a directory lists only the members who chose to be in it. A skeleton: groups, forums, courses and messaging are not built yet.
Who it’s for “People sign in to a members area: profiles, a member directory, and private groups with a forum and feed”
node
Shows live MLS listings on a real estate website, straight from the MLS’s own data feed. The display rules come built in: a listing the seller kept off the internet never appears, and a hidden address stays hidden. Until your MLS approves the feed, it shows clearly labelled sample homes.
Who it’s for “It shows real estate listings from an MLS”
node
A mortgage payment calculator, a how-much-house-can-I-afford calculator, and this week’s average rates from Freddie Mac. If Freddie Mac is down, the rates widget keeps showing the last figures it fetched.
Who it’s for “It has a mortgage payment or affordability calculator”
vanilla · node
