惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

D
Darknet – Hacking Tools, Hacker News & Cyber Security
T
Tenable Blog
阮一峰的网络日志
阮一峰的网络日志
S
Schneier on Security
A
Arctic Wolf
Latest news
Latest news
C
Check Point Blog
S
SegmentFault 最新的问题
T
Tor Project blog
B
Blog RSS Feed
The GitHub Blog
The GitHub Blog
爱范儿
爱范儿
腾讯CDC
C
CERT Recently Published Vulnerability Notes
A
About on SuperTechFans
U
Unit 42
L
LINUX DO - 热门话题
罗磊的独立博客
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
MyScale Blog
MyScale Blog
D
Docker
Blog — PlanetScale
Blog — PlanetScale
GbyAI
GbyAI
V
Vulnerabilities – Threatpost
月光博客
月光博客
aimingoo的专栏
aimingoo的专栏
WordPress大学
WordPress大学
Security Latest
Security Latest
博客园_首页
C
Cybersecurity and Infrastructure Security Agency CISA
cs.CL updates on arXiv.org
cs.CL updates on arXiv.org
AI
AI
H
Hacker News: Front Page
C
CXSECURITY Database RSS Feed - CXSecurity.com
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
Google DeepMind News
Google DeepMind News
T
Tailwind CSS Blog
TaoSecurity Blog
TaoSecurity Blog
博客园 - 司徒正美
云风的 BLOG
云风的 BLOG
S
Securelist
Engineering at Meta
Engineering at Meta
D
DataBreaches.Net
P
Privacy & Cybersecurity Law Blog
T
Threat Research - Cisco Blogs
V2EX - 技术
V2EX - 技术
Vercel News
Vercel News
N
News and Events Feed by Topic
Security Archives - TechRepublic
Security Archives - TechRepublic
S
Secure Thoughts

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant Common SOC 2 Failures (Real World) Stop Vibe-Checking Your AI App: A Practical Guide to Evals How to Use SonarQube and SonarScanner Locally to Level Up Your Code Quality Your Next To-Do App Is Dead — I Replaced Mine with an OpenClaw AI Sign a Nostr event in 60 lines of Python using coincurve — no nostr-sdk, no nbxplorer, no rust toolchain ITGC Audit Explained Like You’re in Big 4 Patch Tuesday abril 2026: Microsoft parcha 163 vulnerabilidades y un zero-day en SharePoint Stop scraping everything: a better way to track competitor price changes Listing on MCPize + the Official MCP Registry while routing payments OUTSIDE the marketplace — how I kept 100% of my x402 revenue Building an AI-Powered Risk Intelligence System Using Serverless Architecture Why We Ripped Function Overloading Out of Our AI Toolchain Testing AI-Generated Code: How to Actually Know If It Works SaaS Churn Is Killing Your Business. Here Is What to Do About It (Without a Support Team) The Speed of AI Is No Longer Linear - And Self-Improving Models Are Why How to Implement RBAC for MCP Tools: A Practical Guide for Engineering Teams From Standard Quote to Persuasive Proposal: AI Automation for Arborists I built a CLI that scaffolds complete multi-tenant SaaS apps Axios CVE-2025–62718: The Silent SSRF Bug That Could Be Hiding in Your Node.js App Right Now The dashboard that ended our friendship Data Pipelines Explained Simply (and How to Build Them with Python) The Hidden Cost of AI Systems Nobody Talks About. undefined vs undeclared, and how typeof behaves Switching from file-based jobs to NATS/Kafka in Rust without changing code io_uring Adventures: Rust Servers That Love Syscalls Why Agentic AI is Killing the Traditional Database The POUR principles of web accessibility for developers and designers Quantum Neural Network 3D — A Deep Dive into Interactive WebGL Visualization How To Install Caveman In Codex On macOS And Windows Automation Pipeline Reliability: Why Your Workflow Breaks When Nobody Is Watching I Built an 'Open World' AI Coding Agent — It Works From ANY Folder From Freelancing to Product: A Tech Service Company's SaaS Transformation China's AI Giants: Adding Tencent Hunyuan & ByteDance Doubao to AI University (74 Providers) On the Vibe Coders and Their Lies clerk: Auto-Summarize Your Claude Code Sessions AI Weekly — 2026/04/10–04/17 | The Model Lockdown Is Here, but the Toolchain Is the Real Battleground AI 週報 — 2026/04/10–2026/04/17 模型封鎖潮來了,但工具鏈才是真戰場 Maybe this is how Open-Source apps are born... 🚀 Fine-Tune LLMs with LoRA and QLoRA: 2026 Guide tRPC v11 + Next.js App Router: End-to-End Type Safety Without the Boilerplate ShadCN UI in 2026: Why I Stopped Installing Component Libraries and Started Owning My Components SaaS Billing in React Server Components: Stripe + Supabase Without a Single `useEffect` Join our DEV Weekend Challenge — $1,000 in Prizes Across TEN winners! Submissions Due April 20 at 6:59 AM UTC. Implementing FSRS Spaced Repetition in Flutter + Supabase — Adding Memory Science to an AI Learning App "I Texted My Localhost From the Train — Claude Code Fixed the Bug Before I Got Home" I Built a Sales Prep AI and It Went Deeper Than Expected Design to Code #2: One JSON, Eleven Outputs Solving the 100M-Row Problem: A Summary Table Pattern for High-Volume Push Notification Logs Flutter Web With Wasm: What Actually Changes For Developers I Built 50 Royalty-Free Soundtracks for My Side Project in a Weekend Using AI Music Generation The Vibe Coding Security Checklist: 7 Things to Check Before You Ship Stop Letting Googlebot Guess Fix Your React App's SEO Right Desconstruindo o Streaming do LinkedIn: Como Criar um Engine de Extração de Vídeo de Alta Performance com HLS e FFmpeg (EDA Part-1) EDA (Exploratory Data Analysis) Explained With Real Life — Why Looking at Your Data Is the Most Important Step in Machine Learning Brand Relationship Management at Scale: Our 4-Touch Outreach System for 200+ Brands Why String.fromEnvironment() Might Return an Empty String in Dart JGuardrails 1.0.0 — Hardening Java LLM Apps Against Jailbreaks, Toxicity, and Prompt Injection Plan and Schedule a Full Week of Threads Content From One Claude Conversation Coding Cat Oran Ep3, Five Tables Changed Everything Updated: BFF Pattern I'm done watching freelancers get buried by 200 proposals. So I'm building the alternative. This is my first post BFS Algorithm in Java Step by Step Tutorial with Examples Tracking LLM Pricing Monthly: An Open Dataset for 22 AI Models How We Measure Content ROI on a Comparison Site: Revenue Attribution Without Perfect Data Introducing Nova AI Ops: The AI-Native Operating System for SRE Teams I built a free desktop video downloader for Windows — Grabbit How Talkie OCR Helps Vision-Impaired & Dyslexic Users Read the World Around Them VRCFaceTracking安装和iPhone面捕配置教程,有bug Even CrowdStrike Can't See Your Agents The Automation Gold Rush: What n8n Workflows and Claude Are Opening Up for Developers Right Now
The Teach-Stack for Building Web Platforms in the AI-Native Era
Martin · 2026-06-16 · via DEV Community

Tools like Claude Code and Codex have completely reshaped how software engineering is done. This new tooling allows for much faster development and iteration, but it's important to keep the code maintainable and scalable to make sure the project can continue evolving over the long term.


A template project with an initial structure using all of the technologies described here is available on GitHub: https://github.com/MartinXPN/nextjs-firebase-mui-starter


When working on a startup, the speed of iteration is key. The requirements change quickly, features are added daily, and code gets modified rapidly. In those conditions, picking technologies that enable fast iteration, while ensuring your users get the best experience possible, is crucial.

During the last four years or so, we have experimented with many modern technologies while building Profound Academy. So, in this blog post, I'd like to present the whole tech stack that enables building quickly, while having a highly maintainable codebase, scalable infrastructure, and a great user experience. We'll cover everything from Authentication to UI, we'll talk about the backend, hosting, testing, and much more!

AI Agents, Skills, and MCP servers

AI Agents enable quick iteration and rapid improvement, including bug fixes, the addition of new features, and performance improvements. Yet, it's important to keep the code maintainable for the long run. AI tools make it really easy to overengineer things and add thousands of lines of code to a project. It's important to resist the urge to solve problems that don't exist yet, and keep things simple (both in terms of the code, the infrastructure, and the user experience).

Even in the Agentic Software Development Era, having a small and simple setup helps. Agents coordinate better, features are added faster, bugs are fixed more easily, and the code is maintainable by humans, too.

So, we have chosen to take a balanced/nuanced approach to how we use AI Agents when it comes to working on code that's pushed to production. The setup for AI Agents is pretty simple:

  • Keep the AGENTS.md or CLAUDE.md file as small as possible. It should only contain things that you keep repeating in every conversation with the agent, and some project-specific things that the Agents keep getting wrong.
  • Large AGENTS.md files can actually hurt the performance of an LLM and make it less useful.
  • For skills, it's best to only install the skills relevant to the current conversation and then remove them when the conversation is over.
  • Less is more when it comes to the number of skills installed and the size of the AGENTS.md file.
  • Here are several skills that can be useful (don't keep them installed all the time, as that contaminates the context window):

For MCP Servers, the one from PostHog allows for easy access to Error traces and logs, which helps in debugging and fixing issues.

Context7 is an MCP server that provides code documentation for LLMs. That way, the Agents can reference the latest docs of libraries and frameworks.

In most cases, the Agents are smart enough to figure things out without the extra help from the MCP server. So, I find myself rarely needing to install/enable the MCP servers.

Frontend

As the core frontend technology, React stands out as the top pick for many full-stack projects. While there are other options like Vue or Svelte, React shines because of its vast range of libraries. This big ecosystem makes it easier to add new features and change things fast, which is why it's a favorite for many developers.

However, React, as a frontend library, often doesn't get along well with search engines like Google or Bing. These search engines use bots to look through the HTML of a page and understand its content. Yet, pages built with React usually start with an empty HTML body from the server. This means if you want your website to show up in search results on Google, Bing, or other search engines, you need to make sure the first content from the server includes HTML elements filled with the right information about the page.

That's where Next.js shines. It's a React framework that provides server-side rendering and static website generation. So, the pages powered with Next.js get rendered on the server first, after which the HTML is sent to the browser, making sure the initial content of the page has all the necessary information about the page. After the page is rendered, only the necessary JavaScript is sent to the client, making sure that the bundle sent to the user's browser is minimal. This improves both the user experience and how well search engine bots understand the page.

The latest standard in NextJS projects is the app router, which makes it easy for developers to use features like incremental static regeneration, partial pre-rendering, and many other features that improve the user experience and make the app feel faster. So, I highly recommend starting the project with the app router.

React is moving in the server-side direction (becoming somewhat similar to PHP), and Next.js app router provides a great developer experience for developing "server-first" React components. Features like caching, TurboPack, and AI agent-friendly setup in Next.js make it easy to build and iterate quickly.

UI

When developing web apps, the traditional workflow in companies goes through several stages, which include planning, UI/UX design, implementation, and many iterations of back and forth between designers and developers. Startups require quick iteration, where keeping the development cycle short is crucial.

In our experience, the most efficient way of going about UI/UX was by picking a solid UI framework (MUI in our case) and following a design template instead of asking a designer to create everything in Figma, after which the developers would re-create everything in the React app. We kept a single source of truth - the codebase. This literally saved us months!

MUI has a rich collection of highly customizable components that cover the most common use cases. The great thing is that everything is customizable, but because of the great defaults, in most cases, we would end up using the components with all their default behaviors and appearances.

One bonus of using MUI is that it also provides a wide collection of icons that can be used as React components. This makes including icons in the app very straightforward.

There are several alternatives to MUI:

  • shadcn/ui is a modern alternative that is very popular. Although I can't convince myself that copy-pasting the library code (through CLI) into your codebase is a good idea.
  • Ant Design is also a great alternative.
  • Chakra UI can also be used as a UI Framework.
  • HeroUI, previously known as NextUI, is also great.

Some people suggest just using styled components. Some use Tailwind CSS. Yet, for both styled components and Tailwind CSS, one still writes a lot of CSS. This might not provide the best developer experience compared to using a UI Framework, especially if we aim to avoid designing all the pages on the website.

One can look for inspiration in different Template stores:

Alternatively, you can just ask the AI Agent to design several prototypes and pick the best one from those. To improve the UI generated, you can add skills like the UI/UX skill: https://github.com/nextlevelbuilder/ui-ux-pro-max-skill.

Forms

Forms are a big part of full-stack projects. In our experience, Zod and React Hook Form work great together and provide all the functionality one might need to create forms. In this combo, Zod provides schema validation (types, min/max bounds, lengths, enums, etc.) while React Hook Form gives a flexible API to interact with the form. With these two libraries, one can nest components that interact with the same form, perform different complex validations, and update the data on the fly. They make working with forms seem too easy.

Backend, Authentication, and Database

Platforms like Firebase and Supabase provide backend as a service, helping you scale to millions of users without maintaining your own infrastructure. We currently use Firebase for authentication, storage, database (Firestore), and serverless functions to handle custom backend logic.

Authentication

One great product that can be used for authentication is Clerk, but we currently use the default Firebase authentication system as it works pretty well. Firebase even has a separate package called firebaseui-web that helps one set up Firebase authentication without writing any UI code.

For Authentication to work properly, we also deploy the Next.js application to auth.profound.academy so that Firebase is able to handle authentication without issues.

Database

When developing large projects in a traditional way (separate frontend + separate backend with a database), one usually ends up having many API calls, triggered from the frontend, that modify the database entries. For many projects, 80% of those calls are simple CRUD (Create, Read, Update, Delete) operations. The other 20% involve more complex operations (like updating several entries or reading and aggregating data from several sources). One thing that Firebase does that's really smart is optimize for the 80%, making it very easy to manipulate data from the frontend without redundant API endpoints (the other 20%, which require more complex logic, can be handled with Firebase Functions).

This is achieved with 2 components:

  1. Firestore Rules: Everything related to access management and permissions is isolated into a single file: firestore.rules. This makes sure that API Endpoints don't need to check for user permissions in every function, as Firebase does that automatically - it checks if the user is allowed to read the given piece of data or create/update/delete it. This isolation is invaluable when writing code, as it helps drastically reduce redundant boilerplate code.
  2. Firestore Client SDK: Creating, reading, updating, or deleting data is handled through the Firebase SDK. It provides many useful features like listening for real-time updates, incrementing counters, and batching updates together. All of which gets checked against firestore.rules automatically!

One caveat of using Firestore is the mental model for storing the data. As Firestore is optimized for read operations (which are usually the majority), it encourages keeping the data denormalized. This can be counterintuitive, especially for people coming from an SQL background. Here is a great talk explaining the details of data modeling in Firestore: link.

Overall, Firestore provides a great user experience (especially through real-time change listeners) and developer experience, making it easy to move fast and adapt the whole application to changing needs.

I would advise starting the project with Firestore's Enterprise database variant in Native mode. That supports many more features that might not be available in the prior (standard) versions of Firestore, like pipeline queries, built-in full-text search, etc. This gives the full flexibility of a MongoDB-like database, with the ease of use that comes with Firestore.

Serverless Functions

We usually like to keep the client code very simple, while isolating the more involved parts into the backend code - inside serverless functions. Keeping the frontend code "dumb", while the backend "smart" has worked pretty well. Firebase provides a service called Functions, which can contain any backend code and is triggered in several ways. They can be invoked with a regular HTTP request, get triggered as soon as an entry is created or updated in Firestore, or run periodically as a cron job with Pub/Sub. This way, we can have all the functionality we need on the "server" implemented in separate serverless functions. The best part is that the serverless functions scale up and down really well. So, big spikes in traffic are handled automatically by Google, and you get charged for only the resources used - idle time is free.


In general, BaaS technologies like Firebase save a lot of time. In most cases, they just work! I very rarely find myself debugging an issue caused by some irregularity in a database, a failed migration, or something similar.

AI Features

AI is a big part of modern web apps, and many applications integrate AI chatbots and Agents into their offering. We currently use the AI SDK from Vercel to integrate different AI model providers into our application and create our own custom Agents.

The great thing about the AI SDK is that it's easy to integrate different AI models into the application and switch between them when necessary. The developer experience is much cleaner than any of the model-specific SDKs.

Tests

Testing is probably one of the most controversial topics, especially for startups that have constantly changing requirements. In the early days, we didn't have tests. Yet, as the product grew, it became almost impossible to make changes to the existing codebase, while being confident that everything would work fine after the changes were pushed to production. So, we started introducing tests for the "backend". More specifically, the service layer of Firebase Functions. The frontend is not tested as we keep it "dumb", while the backend code, which is "smart", is tested against edge cases. Most tests are integration tests. We very rarely do unit tests. As most services touch several other parts, it's more reasonable to perform integration tests to make sure all the parts work fine together, without mocking too much.

To test the backend, we use jest. One library that helps a lot in automatically generating fake data inside tests is faker.js.

To execute the tests, a separate Firebase project is created to make sure the production project is intact. Having a separate "test" Firebase project helps in iterating quickly and not worrying about affecting the users. After all the tests are passed, the new version of Firebase Functions can be pushed to production.

Refactoring

As the project grows, features are added or modified, requirements change, and things get "old", refactoring becomes inevitable. The two largest contributors to a confident code modification process are TypeScript and robust Integration tests. TypeScript takes care of the type safety after changes, while the integration tests make sure that the logic hasn't been broken during those changes.

Project refactoring actually happens more often than expected. For instance, we haven't had a 6-month period where we haven't done any major refactoring in the project. As the platform constantly changes, the addition of some technologies requires some major code modifications. Two of our largest refactoring milestones were switching from pure React to Next.js and switching from Next.js pages router to the app router.

Hosting

As the whole backend code sits on Firebase (Google Cloud), the frontend code is deployed to Vercel. It provides the most convenient infrastructure to ship Next.js projects. Vercel makes it very straightforward to deploy Next.js applications. It has a GitHub integration, which works really well with branches (without any manual setup):

  • As soon as something gets pushed to the main branch, Vercel automatically deploys it to production.
  • As soon as something gets pushed to some other branch, Vercel automatically creates a "Preview" deployment and generates a separate link for that deployment. After which, the link contains the deployed version of that branch. So, iterating is very convenient and fast.

Analytics and Monitoring

Knowing your users and how they use your product is invaluable. It can save weeks or sometimes even months of development time, helping prioritize the right things. The right monitoring can help improve the user experience by fixing common bugs and issues.

For general analytics and product monitoring, we use PostHog, including analytics, session replay, exception capture, logs, and production sourcemaps.

Alternatively, you can use Google Analytics for Firebase (with more setup, but free of charge) or Sentry (which is a bit more expensive).

All of these help a lot in improving the product and really knowing your users. However, there is nothing like directly talking to them.

Emails

Emails are one of the most reliable ways of staying in touch with users, sending updates, and engaging them. We've recently switched from sending emails with Sendgrid to sending them with react-email and Resend.

react-email makes it very easy to have highly customizable emails - it basically turns writing an email into writing a React component. Resend, on the other hand, integrates well with react-email and has great pricing. The good part about having emails as React components is that they get checked in with the rest of the code to the version control, and one is able to keep track of all the changes in one place.

Get Started

If you liked the setup described in this post, you can use this GitHub template project to get started faster: https://github.com/MartinXPN/nextjs-firebase-mui-starter. Feel free to fork and start it. Enjoy!