AI Coding & Developer Tools

Cloudflare OS AI agents company operating system Cloudflare Workers

Artificial intelligence is changing the way companies build software, manage information and complete everyday work.

But what if AI was not just another chatbot sitting inside a browser?

What if an entire company could have an AI-powered workspace where agents could build applications, work with company information, create documents and interact with business systems — while operating inside carefully controlled security boundaries?

That is the idea behind Cloudflare OS.

Cloudflare OS is an open-source AI productivity environment built on Cloudflare Workers. It combines AI agents, sandboxed applications, company context and security controls into one platform. Cloudflare describes it as an "operating system" for AI productivity and AI workloads rather than a traditional computer operating system.

The project was originally developed for use inside Cloudflare and is now available as open-source software so organisations can customise the concept for their own needs.

In simple terms, the vision is:

Turn AI prompts into useful private applications — while keeping control over data, permissions and external connections.

Cloudflare OS on GitHub

What Is Cloudflare OS?

Cloudflare OS is an AI productivity environment designed around three major ideas:

1. AI agents that can perform tasks

2. Sandboxed applications called Gadgets

3. A security framework called Gatekeepers

The official repository says Cloudflare OS provides an agent chat interface, sandboxed application development and a security framework that applies guardrails to agents and applications.

This makes it very different from a normal chatbot.

Instead of simply asking an AI to write some text, you can ask the system to create an application and then continue working with that application.

For example, you could ask it to:

• Create a presentation

• Build a dashboard

• Make a collaborative whiteboard

• Create a small game

• Build an internal company tool

• Analyse information from connected services

The important part is that the AI can create actual working software rather than only returning a block of text.

Why Is Cloudflare OS Different?

There are already hundreds of AI assistants available.

So why is Cloudflare OS interesting?

The answer is its architecture.

Cloudflare is trying to combine AI agents + applications + company context + security + cloud infrastructure into one environment.

Instead of thinking:

"I have an AI chatbot."

Cloudflare wants organisations to think:

"I have an AI-powered workspace where my employees and AI agents can safely create and use software."

That is a much bigger idea.

It Is Not a Traditional Operating System

The name "Cloudflare OS" can be slightly confusing.

It does not replace Windows, macOS or Linux.

You cannot install it on your laptop and use it like a traditional desktop operating system.

Cloudflare uses the word "operating system" because the platform manages AI workloads, applications, users, permissions and external services in a way that is conceptually similar to an operating system.

Cloudflare's own architecture documentation even compares components of the platform with traditional operating-system concepts such as kernels, processes, device drivers and permissions.

AI Agents as First-Class Workers

Traditional operating systems were designed around users and programs.

Cloudflare OS adds another important component:

AI agents.

The project's architecture treats agents as entities that should have their own restricted permissions rather than simply being treated as ordinary users.

This is important because an AI agent may be capable of writing code, executing code and interacting with external services.

Giving such an agent unrestricted access would obviously be dangerous.

Cloudflare OS therefore focuses heavily on controlling what an agent is allowed to do.

How Cloudflare OS Works

Cloudflare OS revolves around several important components.

The easiest way to understand them is to think about them as members of a virtual technology ecosystem.

Agents perform work.

Gadgets are the applications those agents can create.

Gatekeepers control connections to external services.

Cloudflare Workers provide the underlying execution environment.

Together, these components create the Cloudflare OS architecture.

Gadgets: AI-Built Applications

One of the most interesting concepts in Cloudflare OS is the Gadget.

A Gadget is essentially a small application created for a user.

Imagine asking:

"Build me a dashboard showing my project's tasks."

Instead of receiving only HTML or JavaScript in the chat, the AI can create an actual application inside the Cloudflare OS environment.

You can then interact with that application.

Even more interestingly, you can continue asking the AI to modify it.

For example:

"Add a search box."

Then:

"Add a chart showing completed tasks."

Then:

"Change the layout for mobile."

This creates a continuous loop:

Prompt → Application → Test → Modify → Improve

Cloudflare describes Gadgets as private application instances that run in their own sandbox.

Why Gadget Sandboxing Matters

Suppose an AI creates a small application.

What happens if that application contains a security bug?

In a traditional environment, a vulnerable application could potentially access resources it should not.

Cloudflare OS uses sandboxing to isolate Gadgets.

The goal is to ensure that a Gadget cannot freely access another user's information or unrelated resources.

This is one of the key security ideas behind the project.

Gatekeepers: The Security Layer

Another important component is the Gatekeeper system.

Gatekeepers act as controlled intermediaries between agents or applications and external services.

For example, suppose an AI agent needs to interact with:

• GitHub

• Google

• Slack

• Notion

• Cloudflare

• Supabase

• Spotify

• ZoomInfo

Instead of allowing the agent unrestricted network access, the relevant Gatekeeper can control the interaction.

The current project includes Gatekeeper packages for several external services, including GitHub, Google, Cloudflare, Supabase, Notion, Confluence, Slack and others.

This is a powerful idea because it creates a defined boundary between AI agents and external systems.

Human Approval

Gatekeepers can also support human approval workflows.

This means an AI agent does not necessarily have to be allowed to perform every sensitive action automatically.

Instead, the system can ask a human for approval when required.

This is especially useful for businesses.

Imagine an AI agent preparing an email campaign.

Creating the draft may be automatic.

Sending thousands of emails should probably require additional controls.

That distinction is exactly where capability-based permissions and approval workflows become valuable.

AI Agents in Cloudflare OS

The agent is the component that performs the actual work.

Cloudflare OS includes a multi-purpose coding agent capable of writing, executing, testing and debugging code in its Code Mode.

The platform is also designed to work with different large language model providers.

This means the system is not conceptually tied to only one AI model.

The architecture can support providers such as OpenAI, Anthropic and self-hosted models, depending on configuration.

This is useful for companies that want more flexibility over which AI models they use.

What Can You Build With Cloudflare OS?

This is probably the most exciting part for ordinary users.

Cloudflare OS is designed around natural-language interaction.

Instead of starting by writing code manually, you can describe what you want.

Create Presentations

For example:

"Make slides for my upcoming meeting with a customer."

Cloudflare OS includes a built-in slides blueprint that can be used for this type of task.

The important difference is that the AI is not merely writing a paragraph about the presentation.

It can create an application or document workflow around the request.

Build Collaborative Apps

You can also ask the system to create an application from scratch.

For example:

"Make a collaborative whiteboard app."

This is a good demonstration of the larger Cloudflare OS idea.

A user describes an application in natural language and an AI agent builds it.

Create Games

You can even use the platform for small interactive applications.

The official README gives a tic-tac-toe example:

"Make a tic tac toe game."

You can then continue interacting with the application through natural language.

This shows that Cloudflare OS is not limited to traditional office documents.

Build GitHub Dashboards

Cloudflare OS can also work with external services when the relevant integration has been configured.

For example:

"Make an issue dashboard for this GitHub repository."

The GitHub integration is required for this workflow.

This could be particularly useful for development teams that want custom internal dashboards without spending days building them manually.

Work With Google Documents

Another example provided by Cloudflare is:

"Fix the typos in this Google Doc."

Again, the Google integration needs to be configured.

This demonstrates how Gatekeepers can connect AI agents to external business systems while maintaining a controlled permission model.

Cloudflare OS and Company Context

One of the most important parts of Cloudflare OS is company context.

A generic AI assistant may know a lot about the world but know very little about your company.

Your organisation may have:

• Internal terminology

• Company policies

• Product information

• Customer information

• Internal processes

• Documentation

• Private systems

Cloudflare OS is designed to connect agents with a company's context and systems.

This is what transforms a generic AI assistant into something closer to an organisation-specific AI workspace.

The ultimate vision is not simply to use Cloudflare's own setup.

Cloudflare describes the project as something organisations can copy and customise into their own "Your Company OS."

How Gatekeepers Improve Security

Security is arguably the most important part of Cloudflare OS.

Giving AI agents access to company systems without restrictions would create obvious risks.

An AI agent could potentially:

• Read sensitive information

• Modify records

• Send messages

• Execute code

• Access APIs

• Make changes to external systems

Cloudflare's approach is to put controlled boundaries around these capabilities.

Gatekeepers mediate external service access, while sandboxing limits what applications can access.

This creates a security model in which the AI agent does not automatically receive unlimited authority.

Cloudflare Workers Architecture

Cloudflare OS is built on Cloudflare Workers, making the project particularly interesting for developers who follow the Workers ecosystem.

The project makes extensive use of technologies such as:

• Durable Objects

• Dynamic Workers

• Facets

• Workers runtime features

• Workerd

Cloudflare says the platform was built by the Workers team and uses some Workers Runtime features that were developed specifically to support Cloudflare OS.

Durable Objects

Cloudflare OS uses Durable Objects for workspace-related state.

In simple terms, Durable Objects provide a way to maintain strongly consistent state associated with individual objects or users.

This makes them useful for collaborative and stateful applications.

Dynamic Workers and Facets

Cloudflare OS also makes extensive use of Dynamic Workers and Facets.

The architecture uses these capabilities to isolate and run Gadgets and Gatekeepers.

This is an interesting demonstration of what modern Cloudflare Workers infrastructure can be used for beyond conventional request-response applications.

Workerd

Another interesting component is workerd, Cloudflare's open-source Workers runtime.

Cloudflare OS can run on workerd, although the project currently describes self-hosted production deployment documentation as still being developed.

This means the architecture is not conceptually limited to the hosted Cloudflare environment.

How to Run Cloudflare OS Locally

Developers can experiment with Cloudflare OS on their own computer.

The current repository provides a quick local setup using pnpm.

Install pnpm

First, make sure pnpm is installed on your system.

The repository currently specifies pnpm 11.17.0 in its package configuration.

Run the Local Environment

After cloning the repository and installing dependencies, the quick-start command is:

pnpm install

Then run:

pnpm run-local

The official README says this runs the complete local stack using Wrangler and workerd.

Open Cloudflare OS

Once the local environment is running, open:

http://localhost:8787

You should then be able to explore the Cloudflare OS interface locally.

Keep in mind that Cloudflare explicitly describes this local setup as a way to try the product and not as the recommended production deployment method.

Deploy Cloudflare OS to Your Cloudflare Account

Cloudflare also provides an online deployment flow for users who want to deploy Cloudflare OS to their own Cloudflare account.

There is also a separate cloudflare-os-starter repository for organisations that need more sophisticated customisation, such as branding, authentication, integrations, routes and upgrades.

The starter project is designed around pinned Cloudflare OS releases and gives organisations greater control over their deployment.

However, the project currently warns that Cloudflare OS is early-access software.

That means businesses should test carefully before relying on it for critical production workloads.

Who Should Use Cloudflare OS?

Cloudflare OS is particularly interesting for organisations that want to experiment with AI agents while maintaining strong control over security and data.

Engineering Teams

Engineering teams can use AI agents to build internal tools, dashboards and prototypes.

Instead of waiting for a developer to build a small internal application, a team member could describe the requirement and let an AI agent create the first version.

Product and Operations Teams

Product and operations teams frequently need small tools.

Examples include:

• Dashboards

• Trackers

• Planning tools

• Whiteboards

• Reporting interfaces

• Internal utilities

Cloudflare OS aims to make creating these applications much faster.

Security-Focused Organisations

Companies that are cautious about giving AI access to internal systems may find the Gatekeeper and sandboxing concepts particularly interesting.

The platform is designed around controlled capabilities rather than unrestricted AI access.

Cloudflare Developers

Developers interested in Cloudflare Workers can also learn a lot from the architecture.

The project provides a real-world example of Durable Objects, Dynamic Workers, Facets and other Workers technologies being combined into a complex AI platform.

Advantages of Cloudflare OS

There are several major advantages to the Cloudflare OS approach.

AI-Native Application Building

You can describe an application in natural language and let an AI agent build it.

Sandboxed Gadgets

Applications run in isolated environments designed to reduce the risk of one application affecting another.

Controlled External Access

Gatekeepers provide a structured way to connect agents to external services.

Company Context

The platform is designed to work with an organisation's own information and systems.

Flexible AI Models

The architecture is designed to support different LLM providers rather than locking the concept to a single model.

Cloudflare Workers Infrastructure

The platform benefits from Cloudflare's modern serverless and edge-computing infrastructure.

Limitations and Early Access Status

Cloudflare OS is exciting, but it is important to keep expectations realistic.

The official repository currently labels the project early access and warns that it is under heavy development. Cloudflare describes version 2 as a complete rewrite and acknowledges that there are still rough edges.

That means this is not necessarily a finished enterprise product that every organisation should immediately deploy.

Companies should test:

• Security boundaries

• Authentication

• Data handling

• Integrations

• AI behaviour

• Application isolation

• Costs

• Reliability

before putting important workloads into the platform.

Is Cloudflare OS Open Source?

Yes.

The Cloudflare OS repository is publicly available on GitHub and is released under the Apache-2.0 licence.

This is significant because organisations can inspect the implementation and customise the platform according to their requirements, subject to the licence.

Cloudflare's separate starter repository is specifically designed to help organisations customise their deployments.

Why Cloudflare OS Matters

The biggest idea behind Cloudflare OS is not simply another AI chatbot.

It represents a possible future where companies build their own AI-powered software environments.

Imagine an employee saying:

**"Build me a dashboard for today's sales."

The AI creates the dashboard.

Then the employee says:

**"Connect it to our CRM."

The system asks for the appropriate permission.

After approval, the dashboard connects to the approved service.

Then the employee says:

**"Add a weekly report."

The AI modifies the application.

This is very different from traditional software development.

Instead of every small tool requiring a developer, AI could allow employees to create specialised software themselves — while security controls determine what the software and AI agents are allowed to access.

Cloudflare OS vs Traditional SaaS

Traditional SaaS generally works like this:

Company → SaaS provider → Shared application

Cloudflare OS is moving toward a different model:

Company → AI agent → Private Gadget → Controlled integrations

That could change how internal software is created.

Instead of purchasing a separate SaaS product for every small workflow, companies could potentially build their own small applications when required.

Of course, this approach also creates new responsibilities around security, maintenance and governance.

Final Verdict

Cloudflare OS is one of the more interesting open-source AI projects to watch right now.

Its biggest idea is simple but powerful:

AI should not only answer questions — it should be able to safely build and operate software.

The combination of AI agents, Gadgets, Gatekeepers, sandboxing and Cloudflare Workers creates an architecture aimed at turning natural-language instructions into working applications.

For developers, it offers an interesting look at the future of AI-native software development.

For businesses, it presents a possible model for building private internal applications without giving AI unrestricted access to company systems.

And for Cloudflare Workers developers, the project provides a fascinating real-world example of what the Workers platform can do.

The project is still in early access, so it should be approached as an evolving technology rather than a finished replacement for every enterprise software system.

But the direction is compelling.

The future may not simply be:

"Open an AI chatbot and ask a question."

It could be:

"Tell your company's AI what you need — and let it build the software for you, safely."

Explore Cloudflare OS on GitHub

Frequently Asked Questions

1. What is Cloudflare OS?

Cloudflare OS is an open-source AI productivity environment built on Cloudflare Workers. It allows users to interact with AI agents, create sandboxed applications called Gadgets and connect to external services through controlled Gatekeepers.

2. Is Cloudflare OS a replacement for Windows or Linux?

No. Cloudflare OS is not a traditional desktop operating system. The name refers to its role as an operating environment for AI workloads, applications, users and company productivity.

3. What are Gadgets in Cloudflare OS?

Gadgets are small applications that AI agents can create for users. Each Gadget runs in a sandboxed environment and can be modified or extended with AI assistance.

4. What are Gatekeepers in Cloudflare OS?

Gatekeepers are security and integration components that control how agents and applications communicate with external services. They can handle authentication, permissions and controlled access to services such as GitHub, Google, Slack and other platforms.

5. Is Cloudflare OS ready for production use?

Cloudflare currently describes Cloudflare OS as early-access software that is still under heavy development. Organisations should thoroughly test security, reliability, integrations and data handling before using it for critical production workloads.

Conclusion

Cloudflare OS gives us a glimpse of a very different future for workplace software.

Instead of buying or manually developing every small application, employees could describe what they need and allow AI agents to build it.

The key difference is that Cloudflare is not ignoring security in this model.

With Gadgets, Gatekeepers, sandboxing, capability-based permissions and Cloudflare Workers, the project is attempting to create an environment where AI can be productive without receiving unlimited access to everything.

That makes cloudflare/cloudflare-os a GitHub project worth watching — especially if you are interested in AI agents, enterprise automation, Cloudflare Workers or the future of software development.

Cloudflare OS could be an early glimpse of the "company operating system" of the AI era.

Stremio Web is the official open-source web interface of Stremio.

If you enjoy movies, TV series and online video content, you have probably experienced the same problem: your entertainment is spread across multiple platforms and services.

This is where Stremio takes a different approach.

Stremio is a modern media centre designed to bring your video entertainment into one interface. Its official web interface, Stremio Web, is available as the open-source Stremio/stremio-web project on GitHub.

The project describes Stremio Web as the official web UI of Stremio and currently has more than 14,000 GitHub stars and around 1,600 forks, showing strong interest from the open-source community.

The current Stremio Web project is much more than a simple webpage. It is a React-based application connected to Stremio's core engine, addons, APIs and video playback components.

So, what exactly is Stremio/stremio-web, how does it work, and why are developers interested in it?

Let's take a closer look.

What Is Stremio?

Stremio is a media centre that provides a central interface for discovering and organising video entertainment.

Instead of constantly moving between different applications and websites, Stremio aims to provide one place where users can discover movies, series and channels through its addon ecosystem.

The important point is that Stremio itself is built around an addon-powered model.

Addons can provide catalogues, metadata and streaming-related resources that become available inside the Stremio interface.

This makes the platform flexible because the main application does not have to contain every possible content source itself.

What Is Stremio/stremio-web?

Stremio/stremio-web is the open-source repository containing the official web interface for Stremio.

The GitHub repository describes it as the official web UI for Stremio, a modern media centre designed as a one-stop solution for video entertainment.

The project is built using modern web technologies and can run directly in a browser.

It can also be installed as a Progressive Web App (PWA), giving users a more application-like experience.

Developers can also inspect the source code, run the project locally, contribute improvements and study how the web interface communicates with Stremio's underlying components.

Why Is Stremio Web Getting Attention?

There are several reasons why the project is interesting to both users and developers.

First, it provides a clean web-based interface for Stremio.

Second, it is open source.

Third, the project uses a modern architecture involving React, Rust, WebAssembly and Web Workers.

And finally, it has an active development community with thousands of commits and ongoing feature development.

One Place for Your Video Library

One of Stremio's biggest attractions is organisation.

Instead of searching through different services and applications, users can maintain a central library and continue watching content through the Stremio ecosystem.

The official web interface supports account-based synchronisation, meaning the library and Continue Watching information can follow the user across supported devices.

Addon-Powered Experience

Addons are at the heart of Stremio's flexibility.

The current Stremio Web documentation describes the interface as addon-powered, allowing users to discover movies, series and channels from catalogues provided by addons.

This is an important distinction.

Stremio Web is not simply a website containing a fixed catalogue of videos. Instead, the addon ecosystem helps provide the information and resources that appear inside the application.

Users should always make sure that the addons and content sources they use are legitimate and that they have the necessary rights to access the content.

Key Features of Stremio Web

Stremio Web includes several features designed to make the media-centre experience easier and more convenient.

Discover Movies, Series and Channels

The Discover interface helps users browse content provided through Stremio's addon ecosystem.

Instead of searching for each title separately, users can explore catalogues through a unified interface.

This can make finding something to watch considerably easier.

Synchronised Library

Another useful feature is synchronisation.

Your Stremio account can keep your library information available across supported devices.

That means you do not necessarily have to recreate your library every time you switch between devices.

Continue Watching

Stremio Web also supports synchronisation of Continue Watching information.

This is particularly useful when you start watching something on one device and later want to continue on another.

The goal is simple: your viewing activity should remain connected to your account rather than being locked to a single device.

Chromecast Support

The official Stremio Web README lists Chromecast support among its features.

This allows compatible playback to be sent to a larger screen, making the web interface more useful for home entertainment setups.

Subtitles

Subtitles are another part of the Stremio Web experience.

The project supports addon-provided or local subtitles, along with customisable subtitle styling.

For viewers who regularly watch international content, this can make a significant difference.

Keyboard-Friendly Player

Stremio Web also takes a keyboard-first approach to playback.

The official documentation highlights keyboard controls that allow users to control playback without constantly reaching for a mouse.

This is a small feature, but it can make a media player feel much more polished.

50+ Languages

The project supports more than 50 languages, with translations contributed through the Stremio translations project.

This is important for an international open-source project because users do not necessarily want their entire entertainment interface in English.

Progressive Web App

Stremio Web can also run as a standalone Progressive Web App.

A PWA can provide a more application-like experience while still using modern web technologies.

This is particularly useful for users who prefer not to install a traditional desktop application.

How Stremio Web Works

This is where the project becomes particularly interesting for developers.

At first glance, Stremio Web looks like a normal React application.

However, the architecture behind it is more sophisticated.

The official documentation explains that the user interface is built with React, while the underlying Stremio core is written in Rust and compiled to WebAssembly.

That core runs inside a Web Worker.

The simplified architecture looks like this:

React UI → Stremio Core → API and Addons → Video Playback

This separation allows the user interface and underlying application logic to have different responsibilities.

React-Based User Interface

The web interface is built with React.

React handles the visible application, including screens, navigation, media information and user interactions.

This makes the project interesting for frontend developers who want to study a real-world React application.

Rust and WebAssembly Core

The core logic is handled by stremio-core, which is written in Rust.

For Stremio Web, the core is compiled to WebAssembly and runs inside a Web Worker.

This architecture allows substantial application logic to run in the browser without putting everything directly into the React interface.

It is also an excellent example of how Rust and WebAssembly can be integrated into a modern web application.

Stremio Addons

The Stremio ecosystem includes an addon system.

The addons can provide catalogues and other resources that the Stremio interface uses.

The wider ecosystem also includes the stremio-addon-sdk, which developers can use when building addons in Node.js.

This creates an ecosystem where the core application, web interface and addons have separate responsibilities.

How to Run Stremio Web Locally

If you are a developer and want to experiment with the project, you can clone the GitHub repository and run it locally.

However, the current installation requirements are different from older instructions that may still appear on third-party websites.

The current README requires:

• Node.js 22 or newer

• pnpm 11 or newer

The project currently uses pnpm rather than the older npm-based setup described in some previous documentation.

Requirements

Before starting, install a current version of Node.js and pnpm.

You can then clone the Stremio Web repository from GitHub.

Install Dependencies

After entering the project directory, install the required dependencies:

pnpm install

This downloads and prepares the packages required by the project.

Start the Development Server

Once the dependencies are installed, start the development environment:

pnpm start

The current development server runs at:

http://localhost:8080

The development server supports hot reloading, allowing developers to see changes without manually restarting the entire application.

Build for Production

When you are ready to create a production build, use:

pnpm run build

The project also provides commands for testing, linting and checking translations.

For example:

pnpm test

and:

pnpm run lint

This makes the repository suitable not only for experimentation but also for developers who want to contribute to an active open-source project.

Docker Support

Developers who prefer containers can also build and run Stremio Web using Docker.

The project README provides the following commands:

docker build -t stremio-web .
docker run -p 8080:8080 stremio-web

Docker support can be useful when you want a more isolated and reproducible development environment.

Stremio Web Ecosystem

One of the most interesting aspects of Stremio is that the web interface is only one part of a larger ecosystem.

The official repository identifies several related projects, including:

• stremio-core – Rust-based core containing state, addon protocol, library and application logic

• stremio-video – video player abstraction

• stremio-translations – community translation project

• stremio-addon-sdk – tools for creating Stremio addons in Node.js

This separation makes the architecture easier to understand.

The web interface handles presentation, while other projects handle core logic, playback and extensions.

Is Stremio Web Open Source?

Yes.

The Stremio/stremio-web repository is publicly available on GitHub and is released under the GPL-2.0 licence.

This means developers can inspect the source code, contribute to the project and build on it according to the terms of the licence.

The open-source nature of Stremio Web is one of the reasons it has attracted a developer community around the project.

Who Should Use Stremio Web?

Stremio Web can appeal to several groups.

Home-Theatre Enthusiasts

If you want a central interface for discovering and organising video content, Stremio can be an interesting option.

Developers

Developers can study the project to understand how React, Rust, WebAssembly and Web Workers can work together.

Open-Source Enthusiasts

People who enjoy contributing to open-source software can explore issues, pull requests and the project's development process.

The repository actively welcomes bug reports and pull requests.

Addon Developers

Developers interested in extending Stremio can also explore its addon ecosystem and SDK.

This makes Stremio more than simply a media player; it is also an extensible platform.

Advantages of Stremio Web

There are several reasons why Stremio Web stands out.

Unified Interface

Users get one interface for discovering and organising supported video content.

Open Source

The web application source code is publicly available on GitHub.

Modern Architecture

The combination of React, Rust, WebAssembly and Web Workers makes the project technically interesting.

Cross-Device Synchronisation

Library and Continue Watching information can follow the user's Stremio account across supported devices.

Addon Ecosystem

The addon model gives the platform considerable flexibility.

PWA Support

The web application can be installed as a standalone Progressive Web App.

Limitations and Things to Consider

Stremio Web is not a magic replacement for every streaming service.

Its experience depends heavily on the addons and services available to the user.

The legality and availability of particular content can also vary depending on the source.

Users should therefore understand what an addon provides before installing it and should use legitimate sources and services.

From a developer perspective, the current project also has a relatively modern toolchain requirement. If you are following an old tutorial that says Node.js 12 or npm 6 is sufficient, that information is outdated for the current repository.

The current README specifies Node.js 22+ and pnpm 11+.

What Is New in Stremio Web?

The repository continues to evolve.

The project's recent development activity includes improvements to the Discover interface, player functionality and other parts of the web experience.

Recent release information also shows continued work on areas such as Live TV and the Discover experience. For example, the v5.0.0-beta.40 release included native EPG support for Live TV and fixes related to Discover pagination.

This ongoing development is another reason developers may want to keep an eye on the repository.

Final Verdict

Stremio/stremio-web is much more than a simple streaming webpage.

It is an open-source web interface connected to a broader media-centre ecosystem involving addons, APIs, a Rust-based core, WebAssembly and video playback components.

For ordinary users, the main attraction is convenience: discover and organise supported video content from a central interface, synchronise your library and Continue Watching information, use subtitles, cast to compatible devices and even install the web application as a PWA.

For developers, the project is even more interesting.

It provides a real-world example of how React + Rust + WebAssembly + Web Workers can be combined to build a modern browser-based application.

If you are interested in open-source media software or modern web development, Stremio/stremio-web is certainly a GitHub repository worth exploring.

<a href="https://github.com/Stremio/stremio-web" target="_blank" rel="noopener">View Stremio/stremio-web on GitHub</a>

Frequently Asked Questions

1. What is Stremio Web?

Stremio Web is the official web interface of Stremio. It provides a browser-based media-centre experience for discovering and organising video content through Stremio's addon ecosystem.

2. Is Stremio Web open source?

Yes. The Stremio Web source code is publicly available on GitHub and the repository is released under the GPL-2.0 licence.

3. What technology does Stremio Web use?

The user interface is built with React. Stremio's core is written in Rust and compiled to WebAssembly for the web, where it runs in a Web Worker.

4. What do I need to run Stremio Web locally?

The current project README requires Node.js 22+ and pnpm 11+. You can install dependencies with pnpm install and start the development server with pnpm start.

5. What port does the Stremio Web development server use?

The current development server runs at http://localhost:8080 when using the standard pnpm start command.

Conclusion

Stremio is an interesting example of how an open-source project can combine a user-friendly media interface with a powerful technical architecture.

The Stremio/stremio-web repository brings together React, Rust, WebAssembly, addons and modern web technologies to create a flexible media-centre experience.

Whether you are a movie enthusiast looking for a central media interface or a developer interested in studying a modern open-source application, this GitHub project deserves a closer look.

Stremio's goal is simple: Freedom to Stream.

msitarzewski/agency-agents: 230+ AI Agents for Your Virtual AI Team

Artificial intelligence is moving beyond the idea of using one chatbot for everything. Today, developers and businesses are increasingly experimenting with specialised AI agents that can perform specific roles such as software development, design, research, marketing, project management and security.

One GitHub project that has attracted significant attention in this area is msitarzewski/agency-agents, popularly known as The Agency.

The project is designed as a collection of specialised AI agents that behave more like virtual members of a professional team. Instead of giving a generic AI assistant a new role every time you start a task, you can select an agent designed specifically for that type of work.

With 230+ specialised agents, support for multiple AI coding environments, installation tools and a dedicated desktop application, the project offers an interesting approach to building an AI-powered virtual workforce.

What Is msitarzewski/agency-agents?

msitarzewski/agency-agents is an open-source collection of specialised AI agent definitions available on GitHub.

The basic idea is simple. Instead of treating AI as one general-purpose assistant, The Agency divides different responsibilities among specialised agents.

For example, you might use one agent for frontend development, another for backend engineering, another for security, another for product planning and another for marketing.

Each agent is designed around a particular role and includes information about its identity, mission, workflow, communication style and expected deliverables.

This makes the project more than just a collection of random AI prompts.

Why Is Agency Agents Getting Attention?

The biggest attraction of Agency Agents is specialisation.

A general AI model can perform many different tasks. However, when you repeatedly work on a large project, it can be useful to have predefined roles for different responsibilities.

Think of it like building a virtual company.

Instead of asking one AI:

"Do everything for me."

you can approach your project as if you have a team:

• A developer for coding

• A designer for user experience

• A researcher for information gathering

• A security specialist for security reviews

• A marketing specialist for promotion

• A project manager for planning

• A technical writer for documentation

The underlying AI model may still be doing the work, but the agent definition provides a more structured role and workflow.

More Than Just AI Prompts

One of the interesting aspects of Agency Agents is that its files are structured around specific roles rather than being simple one-line prompts.

An agent can define its personality, responsibilities, workflow, communication approach and expected outputs.

That means the user can reuse the same specialist across different projects instead of recreating a similar prompt every time.

For people who regularly use AI for development or business tasks, this can make workflows more organised.

230+ Specialised AI Agents

The project has grown into a large collection containing more than 230 specialised agents.

The available agents cover a wide range of areas, including:

• Software engineering

• Frontend development

• Backend development

• DevOps

• Security

• Product development

• Design

• Marketing

• Research

• Finance

• Project management

• Content and communication

• Game development

• Other specialised professional roles

This large selection is one of the reasons the project stands out from a simple collection of AI prompts.

How Does The Agency Work?

The concept behind Agency Agents is relatively straightforward.

First, you identify the type of work that needs to be completed. Then you select an appropriate specialised agent.

The agent provides a predefined role and workflow that can guide the AI through the task.

For example, if you are developing a website, you might use a frontend development agent for the interface, a backend agent for APIs and a security-focused agent to review potential vulnerabilities.

The idea is to create a team of AI specialists rather than relying on a single generic personality.

Domain-Focused Expertise

Each agent is built around a particular professional role.

This is useful because different jobs require different priorities.

A frontend developer might focus on:

• User interfaces

• React components

• Accessibility

• Responsive layouts

• Performance

A security-focused agent, on the other hand, may concentrate on:

• Vulnerabilities

• Authentication

• Permissions

• Secure configuration

• Risk assessment

The role itself provides additional context before the actual task begins.

Personality-Driven Agents

Agency Agents also puts emphasis on personality and communication style.

This means agents are not defined only by what they should accomplish. Their interaction style and approach to problems can also be part of the definition.

This may make conversations feel more consistent.

For example, a technical reviewer may be direct and critical, while a creative specialist may be more experimental and idea-oriented.

Deliverable-Focused Workflows

Another important feature is the focus on deliverables.

AI output becomes much more useful when you know exactly what you expect at the end of the task.

Depending on the agent, the expected result could be:

• Code

• Documentation

• Research

• Design specifications

• Project plans

• Checklists

• Metrics

• Technical recommendations

• Marketing material

This helps move AI usage from casual conversations towards repeatable workflows.

Production-Oriented Processes

The project is designed with practical workflows and success criteria in mind.

However, users should not misunderstand this point.

An AI agent is not automatically equivalent to a human senior engineer.

Even if an agent has an excellent workflow, its output still needs to be checked, tested and validated.

For production systems, human review remains important.

What Types of AI Agents Are Available?

One of the most interesting things about The Agency is the variety of roles available.

You are not limited to software development.

The project covers many professional areas, making it possible to assemble different types of virtual teams depending on your requirements.

Engineering Agents

Engineering is one of the most obvious use cases.

Developers can use specialised agents for different aspects of software development.

For example, an engineering team could potentially use separate AI specialists for frontend development, backend development, DevOps, security, debugging and technical architecture.

This can be particularly useful for developers working on large applications.

Design and Product Agents

Building a successful application is not only about writing code.

You also need to think about:

• User experience

• Product requirements

• Interface design

• User journeys

• Feature planning

• Usability

Design and product-focused agents can help developers and startups approach these areas separately.

This is especially useful for small teams where one person may be responsible for product, development and design.

Marketing and Social Media Agents

The Agency also extends beyond traditional technical work.

Marketing-related agents can help with activities such as content planning, campaign ideas, positioning and community-related work.

For an independent developer or startup founder, this could be useful because building a product is only half the challenge.

You also need people to discover it.

Research, Finance and Project Management Agents

The project also includes agents designed for research, finance and project-management-related tasks.

This opens up another possibility.

Instead of using AI only for coding, you can potentially use it throughout the complete project lifecycle.

For example:

Research → Product Planning → Design → Development → Testing → Marketing → Documentation

Different specialised agents can potentially participate at different stages.

Agency Agents Desktop App

Another interesting development is the Agency Agents desktop application.

Instead of relying completely on command-line installation, users can use the desktop application to browse available agents and manage installations.

The application is designed for Windows, macOS and Linux.

This makes the project more accessible to users who are not comfortable working entirely from the command line.

The desktop application is particularly useful if you want to browse a large number of agents and select only the ones relevant to your workflow.

How to Install Agency Agents

There are several ways to install and use the agents.

The simplest option for many users is the desktop application.

Developers who prefer the command line can use the installation scripts provided by the project.

There is also a manual approach where individual agent files can be copied into the appropriate directory for the AI development environment.

Installing Agents for Claude Code

Claude Code users can install Agency Agents using the project's installation scripts.

For example, the repository provides commands for installing agents into Claude Code.

A typical workflow can look like:

./scripts/install.sh --tool claude-code

Users can also select particular divisions rather than installing every available agent.

This is useful because installing hundreds of agents may not be necessary for every project.

If you are building a web application, for example, you may only need engineering, design and security-related agents.

Using Agency Agents With Other AI Tools

One of the strongest features of the project is its support for multiple AI coding environments.

Depending on the current supported integrations, users can work with tools such as:

• Claude Code

• Cursor

• Codex

• Gemini CLI

• OpenCode

• Copilot

• Aider

• Other supported AI development tools

This makes the project more flexible than a system designed exclusively for one AI assistant.

The important idea is that the agent definition can be reused across different AI development environments.

What Are Agency Agents Runbooks?

Runbooks take the idea of specialised agents one step further.

Imagine that you are starting a new software project.

Instead of manually deciding which AI agent should handle each part of the project, a Runbook can help define a suitable team for a particular scenario.

For example, a project could require:

1. Product planning

2. UI design

3. Frontend development

4. Backend development

5. Security review

6. Testing

7. Documentation

Rather than selecting every specialist individually, a predefined team configuration can make the process more repeatable.

This is especially useful for people who regularly start similar types of projects.

Who Should Use Agency Agents?

Agency Agents can be useful for several types of users.

Developers

Developers can use specialised agents for coding, debugging, architecture, documentation and security-related work.

Startup Founders

A startup founder often has to handle product development, marketing, research and planning simultaneously.

A collection of specialised AI agents could provide assistance across these different areas.

Small Businesses

Small businesses may not have dedicated specialists for every function.

AI agents can potentially help with research, content, marketing, documentation and planning.

Content Creators

Content creators can explore research, writing, marketing and social-media-focused agents.

However, human editing remains important if the content needs to demonstrate expertise and originality.

Project Managers

Project managers can use AI specialists to assist with planning, documentation, task breakdown and project coordination.

Advantages of Agency Agents

There are several potential advantages to using this approach.

Specialisation

Instead of one generic AI assistant, you get predefined specialists for different jobs.

Reusable Workflows

Once you find an agent that works well for a particular task, you can reuse it across projects.

Large Selection

With more than 230 agents, there is a wide range of roles to explore.

Open Source

The project is open source and released under the MIT licence, making it accessible for personal and commercial use subject to the licence terms.

Multiple AI Tools

The ability to work with multiple AI coding environments makes the system more flexible.

Desktop Application

The desktop application provides a simpler way to browse and install agents.

Limitations and Things to Consider

Agency Agents is interesting, but it is not magic.

The first limitation is that the quality of the final result still depends heavily on the underlying AI model.

A well-designed agent cannot completely compensate for an unsuitable model or insufficient project context.

The second limitation is that having hundreds of agents does not necessarily mean you should use hundreds of agents.

In fact, installing too many agents can make a workflow unnecessarily complicated.

A better approach is to start with a small team.

For example:

Frontend + Backend + Security + Product

Then add other specialists only when they are actually needed.

Security Considerations

Security is particularly important when working with AI coding tools.

You should understand what scripts you are executing and what permissions your AI tools have.

Never place sensitive API keys, passwords, private tokens or production credentials inside agent files.

You should also avoid giving an AI tool unnecessary access to sensitive folders or production systems.

Before executing installation scripts from any open-source project, it is good practice to review what the scripts actually do.

AI can accelerate development, but convenience should never replace security.

Is Agency Agents Free?

The main Agency Agents repository is released under the MIT License.

This allows broad use of the project, including commercial use, subject to the conditions of the licence.

The open-source nature of the project is one of its biggest attractions.

Developers can inspect the agent definitions, customise them and potentially create their own specialised agents.

Why Is Agency Agents Important?

The most interesting part of this project is not simply the number of agents.

It represents a broader change in the way people may use AI.

The old model was:

One AI → One conversation → One task

The emerging model is:

AI model → Specialised agents → Team → Workflow → Deliverables

That is a significant shift.

Instead of thinking about AI as a single assistant, developers can start thinking about AI as a collection of specialised digital workers.

Of course, these agents are still powered by AI models and require human supervision.

But the organisational structure can make AI much more useful for repeatable professional work.

Final Verdict

msitarzewski/agency-agents is definitely worth exploring if you are interested in AI-powered development and productivity.

The project's biggest strength is its focus on specialisation.

With more than 230 agents covering areas such as engineering, design, marketing, research and project management, it provides a large library from which users can build their own virtual AI teams.

The desktop application makes installation easier, while Runbooks provide a way to organise groups of agents around particular project scenarios.

The most important thing, however, is to use the agents intelligently.

You do not need 230 AI agents.

Start with the few specialists that match your actual work, test their output, refine your workflow and expand the team only when necessary.

For developers already using tools such as Claude Code, Cursor, Codex or Gemini CLI, Agency Agents could become an interesting addition to the AI development toolbox.

Frequently Asked Questions

1. What is msitarzewski/agency-agents?

msitarzewski/agency-agents is an open-source collection of specialised AI agents designed for different professional roles, including software development, design, marketing, research and project management.

2. How many agents are available in Agency Agents?

The project currently contains 230+ specialised AI agents, covering a wide range of professional roles and workflows.

3. Can Agency Agents be used with Claude Code?

Yes. The project provides installation options for Claude Code along with support for several other AI coding environments.

4. Is Agency Agents free to use?

The main Agency Agents repository is open source and released under the MIT License. Users should review the licence terms for their particular use case.

5. Does Agency Agents have a desktop application?

Yes. Agency Agents also has a desktop application designed to make browsing and installing agents easier across supported AI coding tools.

Conclusion

The rise of projects such as msitarzewski/agency-agents shows how quickly AI development workflows are changing.

Instead of relying on a single generic AI assistant, users can create a virtual team of specialised AI agents, each designed for a particular responsibility.

Whether you are a developer, startup founder, content creator or business owner, the concept is worth watching.

The future of AI may not simply be about having a smarter chatbot.

It may be about building the right AI team for the job.

 How to Write a Business Plan: A Complete Step-by-Step Guide for Beginners

Introduction

Whether you're applying for a startup loan, seeking investors, or simply want clarity on your own business idea, a well-written business plan is one of the most valuable documents you'll create. This guide breaks down exactly how to write one, even if you've never done it before.

Why a Business Plan Matters

A business plan forces you to think through every aspect of your idea before spending real money on it. It's also usually required by banks, investors, or government schemes (like Mudra loans in India) before they'll fund your venture.

1. Executive Summary

This is a one-page overview written last but placed first — it summarizes your business idea, target market, and what you're asking for (funding, partnership, etc.). Keep it concise enough that someone understands your entire business in under two minutes of reading.

2. Business Description

Explain what your business does, what problem it solves, and why it exists. Include your mission, the industry you're entering, and what makes your approach different from existing options.

3. Market Research and Analysis

This section shows you've actually studied your market, not just assumed demand exists:

• Who is your target customer? (age, income, location, needs)
• How big is this market?
• Who are your competitors, and what are they doing well or poorly?

4. Organization and Management Structure

Outline who runs the business, their roles, and relevant experience. For a solo venture, this simply means explaining your own background and why you're positioned to succeed.

5. Products or Services

Describe exactly what you're selling, how it works, its pricing, and its lifecycle. If you have early traction — pilot customers, pre-orders, a working prototype — include that here as proof of concept.

6. Marketing and Sales Strategy

Explain how customers will actually find out about and buy from you — social media, local advertising, partnerships, SEO, or direct sales. Be specific rather than vague ("we will use digital marketing" says nothing useful).

7. Funding Request (If Applicable)

If you're seeking investment or a loan, state exactly how much you need, what it will be used for, and over what timeframe. Vague funding requests are one of the fastest ways to lose investor confidence.

8. Financial Projections

Include realistic revenue projections, expected expenses, and a break-even estimate for at least the first year, ideally three. These don't need to be perfect — they need to show you've thought through the numbers logically.

9. Appendix

Attach supporting documents: resumes, permits, market research data, letters of intent from potential customers, or product photos — whatever strengthens your case.

Common Mistakes to Avoid

• Being overly optimistic with revenue projections without justification
• Ignoring competitors or claiming "we have no competition"
• Writing a plan that's too long and unfocused — most investors prefer concise, clear documents over exhaustive ones
• Skipping market research and relying only on personal assumptions

How Long Should a Business Plan Be?

For most small businesses, 10-20 focused pages is sufficient. Investors and lenders generally prefer substance over length — a tight, well-reasoned 15-page plan beats a padded 40-page document every time.

Conclusion

A business plan isn't just paperwork to satisfy a bank or investor — it's a thinking tool that forces clarity on your own idea before you commit real time and money to it. Even if you never show it to anyone else, writing one honestly will reveal gaps in your plan while they're still cheap to fix.

Are you currently working on a business plan? Share what kind of business you're planning in the comments, and pass this along to a friend thinking about starting their own venture.

 Cybersecurity Tips Every Developer and Website Owner Should Know in 2026

Introduction

Whether you're running a WordPress blog, a PHP application, or managing your own small business website, cybersecurity isn't just an IT department's problem anymore — it's something every website owner needs a working understanding of. Here are the practical, non-technical-jargon tips that actually make a difference.

1. Use Strong, Unique Passwords — Everywhere

Reusing the same password across multiple accounts means one breach can cascade into many. Use a password manager (Bitwarden and KeePass both have free tiers) to generate and store unique, complex passwords for every account.

2. Enable Two-Factor Authentication (2FA)

2FA adds a second verification step — usually a code sent to your phone — beyond just your password. Even if someone steals your password, they still can't log in without that second factor. Enable this on your email, hosting account, and admin panels first, since these are the highest-value targets.

3. Keep Software and Plugins Updated

Outdated CMS platforms, plugins, and server software are the single most common entry point for attackers. Most breaches don't involve sophisticated hacking — they exploit known vulnerabilities in software that simply hasn't been updated.

4. Back Up Your Website Regularly

Automated daily or weekly backups mean that even if something goes wrong — a hack, a bad update, accidental deletion — you can restore your site quickly rather than losing everything.

5. Use HTTPS Everywhere

An SSL certificate (now free and automatic through services like Let's Encrypt) encrypts data between your visitors and your server. Beyond security, Google also factors HTTPS into search rankings, so this helps SEO too.

6. Limit Login Attempts

Install a plugin or configure your server to lock out an IP address after several failed login attempts. This blocks brute-force attacks where bots try thousands of password combinations automatically.

7. Be Wary of Phishing Emails

Many breaches start not with hacking, but with someone clicking a malicious link in a convincing fake email. Always verify sender addresses carefully, and never enter login credentials through a link in an email — type the website address directly instead.

8. Restrict File Upload Permissions

If your website allows file uploads (contact forms, user avatars), make sure uploaded files can't be executed as scripts. This is a common vulnerability that lets attackers upload malicious code disguised as an image.

9. Monitor Your Site for Unusual Activity

Tools like Google Search Console can alert you if Google detects malware or suspicious content on your site — often before you'd notice it yourself.

10. Educate Anyone Else With Access

If you have team members, freelancers, or family helping manage your sites, make sure they also follow these basics. Security is only as strong as the weakest person with access.

Conclusion

Most cyberattacks aren't sophisticated, targeted operations — they're automated bots scanning the internet for easy, common vulnerabilities. Following these fundamentals puts you ahead of a large share of websites that skip even basic precautions, significantly reducing your risk without requiring deep technical expertise.

Which of these steps have you already implemented on your sites? Share your own security tips in the comments, and pass this along to a fellow site owner who's never thought about this.

 Python Programming Tutorial for Beginners: A Complete Step-by-Step Guide

Introduction

Python has become the most recommended first language for anyone starting to code, and for good reason — its syntax reads almost like plain English, yet it powers everything from websites to AI models. If you've been putting off learning to code because other languages felt intimidating, this guide walks you through exactly how to get started, with no prior experience assumed.

Why Python Is a Great First Language

Python's clean, readable syntax means you spend less time fighting confusing symbols and more time understanding actual programming logic. It's used across web development (Django, Flask), data science (Pandas, NumPy), automation, and increasingly, AI and machine learning — meaning the skills you build here transfer directly into high-demand career paths.

Step 1: Install Python

Download Python from python.org (the official source) and run the installer. On Windows, make sure to check "Add Python to PATH" during installation — this one checkbox saves a lot of future headaches. On Mac, Python often comes pre-installed, but installing the latest version from python.org is still recommended.

Step 2: Choose Your Code Editor

VS Code (free, from Microsoft) is the most popular choice for beginners — lightweight, with excellent Python extensions. PyCharm Community Edition is another solid free option built specifically for Python.

Step 3: Write Your First Program

Open your editor, create a file called hello.py, and type:

print("Hello, World!")

Run it from your terminal with python hello.py. This simple line confirms your setup works and is traditionally every programmer's first program.

Step 4: Learn the Core Building Blocks

Variables store data:

name = "Rupesh"
age = 25

Conditionals let your program make decisions:

if age >= 18:
    print("Adult")
else:
    print("Minor")

Loops repeat actions:

for i in range(5):
    print(i)

Functions organize reusable code:

def greet(name):
    return f"Hello, {name}!"

print(greet("Rupesh"))

Lists store collections of data:

fruits = ["apple", "banana", "mango"]
for fruit in fruits:
    print(fruit)

Step 5: Work with Real Data

Once comfortable with basics, try reading and writing files:

with open("notes.txt", "w") as file:
    file.write("My first Python file operation")

Step 6: Practice with Small Projects

Theory alone doesn't build skill — build small projects: a simple calculator, a to-do list app, a number-guessing game, or a basic web scraper. Each project forces you to combine multiple concepts, which is where real learning happens.

Step 7: Explore Libraries Based on Your Interest

Once the fundamentals feel solid, branch into specialized libraries depending on your goal:

• Web development: Flask or Django
• Data analysis: Pandas, NumPy
• Automation: Selenium, BeautifulSoup
• AI/Machine Learning: scikit-learn, TensorFlow

Common Beginner Mistakes to Avoid

• Skipping fundamentals to jump straight into frameworks
• Not practicing typing code yourself (copy-pasting doesn't build muscle memory)
• Avoiding error messages instead of reading and learning from them
• Trying to memorize syntax instead of understanding logic

How Long Does It Take to Learn Python Basics?

With consistent daily practice (even 30-45 minutes), most beginners grasp core fundamentals within 4-6 weeks. Building genuine project-level comfort typically takes 2-3 months of regular practice.

Conclusion

Python's gentle learning curve combined with its massive real-world applications makes it one of the best investments of time for anyone entering tech — whether your goal is a job, a side project, or simply understanding how software works. Start small, build consistently, and focus on writing actual code rather than just reading about it.

What are you hoping to build with Python? Share your goal in the comments, and bookmark this guide to track your progress as you learn.

Introduction

If you're running a PHP and MySQL website in 2026, security isn't optional anymore — it's a baseline requirement. Cybercriminals increasingly target PHP applications specifically, often exploiting outdated codebases, weak input handling, and misconfigured servers rather than some exotic zero-day exploit. The good news is that modern PHP (8.x) now offers security tools that genuinely match other server-side languages. This guide walks through the practical, code-level steps every PHP/MySQL developer should know.

1. SQL Injection: Still the Most Dangerous, Still the Most Preventable

SQL injection remains one of the most critical and widespread vulnerabilities in web applications. It happens when untrusted user input gets embedded directly into a SQL query, letting attackers manipulate query logic, bypass login screens, dump entire databases, or delete records outright.

Here's what a vulnerable query looks like:

// VULNERABLE - never do this
$username = $_GET['username'];
$query = "SELECT * FROM users WHERE username = '" . $username . "'";

An attacker could pass something like ' OR '1'='1 as the username and bypass authentication entirely.

The fix: prepared statements. This is the primary, non-negotiable defense against SQL injection:

// SAFE - PDO prepared statement
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?");
$stmt->execute([$username]);

Prepared statements separate the SQL structure from the actual data, so user input can never change the meaning of the query — no matter what characters someone types in.

2. Input Sanitization and Validation

Even with prepared statements protecting your database queries, user input needs to be validated and sanitized before it's used anywhere else in your application — displayed on a page, used in a file path, or sent in an email.

// Sanitize an email field
$email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);

// Validate it's actually a valid email
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    die("Invalid email address");
}

filter_var() and htmlspecialchars() are your two best friends here — the first validates and cleans data, the second prevents cross-site scripting (XSS) by making sure user-submitted text can't be interpreted as executable HTML or JavaScript when displayed back on a page.

3. Secure Password Storage

Never store plain-text or weakly hashed passwords. PHP's built-in password functions handle this correctly out of the box:

// When a user registers
$hashedPassword = password_hash($password, PASSWORD_DEFAULT);

// When a user logs in
if (password_verify($inputPassword, $hashedPassword)) {
    // Password is correct
}

PASSWORD_DEFAULT automatically uses a strong, modern hashing algorithm and handles salting for you — there's no good reason to roll your own password hashing logic in 2026.

4. Database Connection Security

Beyond query-level protection, the database connection itself needs hardening:

• Use least-privilege database accounts. Your application's database user should only have the permissions it actually needs. A user account that only reads and writes to specific tables shouldn't also have permission to drop tables or create new users.
• Never hardcode database credentials directly in your PHP files. Use environment variables or a .env file kept outside your public web directory.
• Enable logging for auditing. MySQL's general log can help you spot unusual query patterns if you suspect your application is under attack, though it should be used selectively since it can impact performance.

5. Session Security

Sessions are a common weak point in PHP applications. A few essentials:

• Regenerate the session ID after login using session_regenerate_id(true) to prevent session fixation attacks.
• Set httponly and secure flags on session cookies so they can't be accessed via JavaScript and are only sent over HTTPS.
• Set a reasonable session timeout rather than letting sessions stay valid indefinitely.

6. HTTP Security Headers

Setting the right headers on every response adds a meaningful extra layer of protection:

• X-Frame-Options — prevents your site from being embedded in a malicious iframe (clickjacking protection)
• X-Content-Type-Options — stops browsers from trying to guess content types in ways that can be exploited
• Strict-Transport-Security — forces browsers to only connect to your site over HTTPS
• Content-Security-Policy — controls which sources of scripts, styles, and other resources your page is allowed to load from, which significantly reduces XSS risk

7. Keep PHP and Dependencies Updated

Many of the security problems still associated with PHP come from outdated versions, weak legacy defaults, and old libraries that haven't been patched. Running an old, unsupported PHP version is one of the most common — and easiest to fix — security risks still found on live websites today. Staying current with PHP.net releases and the PHP-FIG coding standards keeps you aligned with the latest security primitives the language offers.

8. Hide Your PHP Version

By default, PHP can leak its version number in HTTP headers, which gives attackers a head start in knowing exactly which vulnerabilities to try. Disabling expose_php in your php.ini file is a small but genuinely useful step.

9. Use a Modern Framework or ORM Where Possible

If you're building anything beyond a small personal project, using an ORM (Object-Relational Mapper) can abstract away a lot of raw SQL handling, making it structurally harder to accidentally introduce injection vulnerabilities. Frameworks like Laravel also come with many of these protections — CSRF tokens, input validation, secure sessions — built in by default, rather than something you have to implement manually.

10. Regular Security Audits

Security isn't a one-time setup — it's an ongoing practice. Periodically reviewing your code for these patterns, and where possible running basic penetration testing or automated security scanning tools, helps catch issues before an attacker does.

Conclusion

PHP and MySQL remain two of the most widely used technologies powering the web today, which is exactly why they're such a common target. The core defenses — prepared statements, proper input validation, secure password hashing, and keeping your stack updated — aren't complicated to implement, but they require consistency. Most real-world breaches don't come from sophisticated new attack techniques; they come from basic protections that were skipped or forgotten. Build these practices into your development habits from day one, and you'll be ahead of a large share of PHP applications still running on the internet.

Which of these practices are you already following in your projects? Share your own security tips in the comments, and pass this along to any developer still concatenating SQL strings directly.