DEV Community: forkcount

There's no more labagent.tech spam or phishing on dev.to. Here's how it got removed.

forkcount — Wed, 28 Oct 2026 10:06:15 +0000

Two weeks ago, every post I read had the same comment underneath it. Vietnamese text, on-topic, ending with a link to labagent.tech. Click it and you got a fake dev.to login page asking for your credentials.

That's phishing. Not spam, not self-promotion — a fake login page designed to steal accounts.

Today, there's none. I checked. The scanner I run every night came back with zero reportable findings for the third day in a row. No labagent.tech, no tr.ee impersonation accounts, no phishing campaign against dev.to users.

Here's what happened.

What is Tiger Sentinel

Tiger Sentinel is a Python script that scans dev.to's public API for coordinated spam and phishing comments.

The concept came from Harun (@koda2026), a 12-year-old developer who built the original version to protect his own posts. I expanded it into a full daily scan that covers thousands of articles per run.

The name comes from Harun. The expansion is mine. The bot runs on GitHub Actions at 3 AM UTC every day.

What it does

For each article on dev.to, it fetches the comment thread and scores every comment against two tiers of signals.

Strong signals — two or more means "report this":

Known phishing domains (labagent.tech, suppdev.io)
Two or more impersonation phrases ("official platform update", "verify your account", "you have 24 hours")
Shortlink domain + Vietnamese text
Shortlink domain + near-empty comment
Shortlink domain + bot-style username (name_name_hexid)

Weak signals — flags for review, not report:

Single shortlink
Single impersonation phrase
Boilerplate phrases

A comment needs two strong signals to be classified as reportable. One strong signal plus weak signals lands in the review queue. Zero strong signals means ignore.

That's the whole design. The first version flagged every comment with a link at the end — 313 findings, most of them legitimate. The rewrite requiring two strong signals dropped the noise to near zero.

What it found

First full scan: 500 articles, 313 flags, 4 confirmed phishing accounts.

@anh_nguynvn_0478e614ba — 16 comments, labagent.tech
@shieldxbot — 12 comments, labagent.tech
@suppdevbot — 8 comments, tr.ee + "official platform update"
@devantibot — 9 comments, tr.ee + "verify your account"

All four created on the same day. All four posting the same pattern. That's not four spammers who found the same domain. That's a coordinated phishing campaign.

The bot also groups findings by shortlink domain, which turned 4 accounts into a larger picture:
tr.ee — 2 accounts (phishing)
labagent.tech — 2 accounts (phishing)
tinyurl.com — 25 accounts (coordinated?)
shorturl.at — 23 accounts (coordinated?)
t.co — 20 accounts (likely legitimate)

text

The tr.ee and labagent.tech pairs were the actual phishing campaign. The rest were pattern matches that needed human judgment.

How it got reported

dev.to has a report abuse form at /report-abuse that accepts bulk reports. I sent one submission:

The 4 confirmed phishing accounts
The 3 domain clusters
A note explaining which were confirmed phishing and which were pattern matches

Not 199 individual reports. One form, five groups. That's the difference between a report a moderation team can act on and a report that gets filed as noise.

What happened

A few days later, all four phishing accounts were gone. dev.to banned them. The tr.ee cluster dropped from 5 accounts to 3. labagent.tech disappeared entirely.

Two weeks later, my account was flagged as Trusted User. The system recognized that my report got a real phishing campaign removed. Trusted User status means future reports go to the front of the moderation queue.

What the scanner looks like now

Three full scans in a row have found zero reportable findings. The bot runs for five hours, covers roughly 5,000 articles per run, and comes back with nothing.

That's the success case. Not "the bot found more phishing." The bot finding nothing means the phishing campaign is gone and no new one has appeared.

The review findings — 900 to 1,000 per scan — are legitimate comments with shortlinks. People sharing tweets, blog posts, YouTube videos. Not phishing.

The cluster counts still fluctuate: t.co has 137 accounts, shorturl.at has 45. Those are likely legitimate. Twitter links and URL shorteners used by real users.

The lessons

The first version was wrong. 313 flags, mostly legitimate comments. The fix wasn't removing weak signals — it was requiring strong ones to co-occur.

The scanner is not a judge. It produces candidates. A human decides. The 313 → 4 funnel is the point. If a bot reports everything, it reports nothing.

Bulk beats individual. A moderation team processes "4 accounts using the same phishing domain" faster than 199 separate flags.

Continuous beats one-time. Daily scanning means the next phishing campaign gets caught on day one, not week three.

What's next

The bot runs every night. If a new phishing campaign appears, findings_report.json will have it in the morning. If a new cluster forms with a known phishing domain, the report goes to dev.to within a day.

The concept came from Harun. The daily scan is mine. The result is a platform with no active phishing campaign against it.

That's a real win. Not "I built a tool" — "I built a tool, used it, and the phishing campaign it was built to fix is gone."

The scanner is Python on GitHub Actions. I wrote it by describing what I wanted to Google AI Studio and fixing what broke. It's not production-grade — no tests, no retries on transient failures, no alerting. But it caught a real phishing campaign and got it removed.

Credit to Harun (@koda2026) for the original Tiger Sentinel concept. He built it to protect his own posts. I turned it into a daily scan.

The report abuse form at dev.to is /report-abuse. Bulk submission made the difference.

I built a bot that scans dev.to for phishing comments. It found a coordinated campaign. dev.to banned 70+ accounts.

forkcount — Wed, 28 Oct 2026 09:13:15 +0000

Two weeks ago, a phishing bot commented on my post. Vietnamese text, on-topic, ending with a link to labagent.tech. Click it and you got a fake dev.to login page.

I reported it. Another appeared. Then another. Same pattern, different accounts, all created the same day.

So I built a scanner. The idea came from Harun (@koda2026), who built the original Tiger Sentinel to protect his own posts. I expanded it into a daily scan.

What it does

Scans dev.to's public API. For each article, fetches comments and scores them against two tiers of signals.

Strong (2+ needed to flag as reportable):

Known phishing domains
Two or more impersonation phrases ("verify your account", "you have 24 hours")
Shortlink + Vietnamese text
Shortlink + near-empty comment
Shortlink + bot-style username

Weak (review only):

Single shortlink
Single impersonation phrase

The two-tier scoring is the whole trick. The first version flagged every comment with a link at the end — 313 findings, most legitimate. Requiring two strong signals dropped the noise to near zero.

What it found

First full scan: 500 articles, 313 flags, 4 confirmed phishing accounts.

@anh_nguynvn_0478e614ba — 16 comments, labagent.tech
@shieldxbot — 12 comments, labagent.tech
@suppdevbot — 8 comments, tr.ee + "official platform update"
@devantibot — 9 comments, tr.ee + "verify your account"

All four created the same day. All four posting the same pattern. That's a campaign.

The bot groups findings by shortlink domain. That turned 4 accounts into a report:
tr.ee — 2 accounts (phishing)
labagent.tech — 2 accounts (phishing)
tinyurl.com — 25 accounts (coordinated?)
shorturl.at — 23 accounts (coordinated?)
t.co — 20 accounts (likely legitimate)

text

How I reported it

dev.to has a report abuse form at /report-abuse that accepts bulk reports. I sent one submission:

The 4 confirmed phishing accounts
The 3 domain clusters

Not 199 individual reports. One form, five groups.

What happened

A few days later, all four accounts were gone. dev.to banned them. The tr.ee cluster dropped from 5 to 3. labagent.tech disappeared.

Two weeks later, my account was flagged as Trusted User. The system recognized that my report got a real campaign removed. Future reports now go to the front of the moderation queue.

That's the whole pipeline: Harun's idea → my expanded scan → report → platform acts → trust built.

The lessons

The first version was wrong. 313 flags, mostly legitimate comments. The fix wasn't removing weak signals — it was requiring strong ones to co-occur.

The scanner is not a judge. It produces candidates. A human decides. The 313 → 4 funnel is the point. If a bot reports everything, it reports nothing.

Bulk beats individual. A moderation team processes "4 accounts using the same phishing domain" faster than 199 separate flags.

Continuous beats one-time. Three scans in a row found zero new reportable accounts. That's the success case — no new campaign appeared after the first was removed.

The code

The core scoring function:


python
def score_comment(text, username):
    strong, weak = [], []

    for domain in PHISHING_DOMAINS:
        if domain in text.lower():
            strong.append(f"phishing-domain:{domain}")

    hits = [p for p in IMPERSONATION_PHRASES if p in text.lower()]
    if len(hits) >= 2:
        strong.append("impersonation-pair")
    elif len(hits) == 1:
        weak.append(f"imp-phrase:{hits[0]}")

    short = next((d for d in SHORTLINKS if d in text.lower()), None)
    if short:
        if VIETNAMESE_REGEX.search(text):
            strong.append(f"shortlink+vn:{short}")
        elif len(text) < 20:
            strong.append(f"shortlink+near-empty:{short}")
        else:
            weak.append(f"shortlink:{short}")

    if len(strong) >= 2:
        return "report"
    elif strong or weak:
        return "review"
    return None
That's the whole logic. The rest is pagination, rate limiting, and output formatting.

The takeaway
dev.to is mostly safe. The spam you see is a small number of accounts posting a lot. A coordinated campaign of 4 accounts produced 45 comments across the platform — enough to feel like a flood if you're one of the people getting them, but tiny against the total comment volume.

The report form works. Bulk reporting works. Trusted User status is real and earned by making reports that get acted on.

The scanner is Python on GitHub Actions. I wrote it by describing what I wanted to Google AI Studio and fixing what broke. Not production-grade — no tests, no retries, no alerting. But it caught a real campaign and got it removed.

Credit to Harun (@koda2026) for the original Tiger Sentinel concept. He built it to protect his posts. I turned it into a daily scan.

forkcount.github.io is the calorie tracker I built the same way.

The report abuse form at dev.to is /report-abuse. Bulk submission made the difference.

I built a free calorie tracker with a metabolic safety floor. No card, no email, no paywall. And I found out why every other app doesn't.

forkcount — Wed, 28 Oct 2026 07:23:56 +0000

Every calorie app I tried had the same problem: it let you set a target of 1,200 calories or lower and called it a plan. Some went lower. That's how people end up in the binge-starve cycle — you eat 800, your body fights back, you eat 4,000, you hate yourself, repeat.

So I built one that refuses.

But here's the thing I figured out after two weeks of building it: the apps aren't badly designed. They're designed around a number you can't argue with.

The number that matters

Your BMR is the calories your body burns just staying alive. Mine is 1,396. If you eat below that for weeks, you don't just lose fat — you lose muscle. Your metabolism slows. The deficit that worked at 2,000 calories stops working at 1,400 because your body has adapted to the smaller intake.

Every app I tried let you set a target below your BMR anyway. Because the user asked. Because a lower number is a faster result. Because "it won't let me" is a support ticket.

ForkCount won't let you. It calculates your BMR (Mifflin-St Jeor), your TDEE (BMR × activity multiplier), and a target that keeps you above the BMR floor. If you try to set a target below that line, it refuses. You can override it in the settings, but the app tells you what you're doing and shows the maths.

That one decision — refusing to let the user hurt themselves — is the whole app. Everything else is a food diary.

What it does

A food diary that parses typed text. You type "200g chicken and 150g rice" and it becomes two items with macros. No database search, no barcode scan. Just type.

A weekly meal plan generator that respects your dietary preference. Set vegetarian, get vegetarian. Set vegan, get vegan. Set a calorie target of 1,400, get a plan built around 1,400 — not the default 2,000 that most generators quietly use.

A water tracker, weight log, exercise log with kcal estimates, and a community feed.

Free. No card. No trial. No paywall. Signup is a username, email, and password.

Stack

React + Vite + TypeScript
Supabase for database and auth (started on Firebase, migrated after the outage below)
GitHub Pages for hosting (deployed from docs/, not the repo root)
No backend. All logic is client-side.

The two bugs that taught me the most

Bug 1: The database disappeared.

I was on Firebase Firestore. One morning, every account was gone. Login failed. The app showed "user not found" for accounts that existed the day before. The Firestore API returned 404 NOT_FOUND: The database (default) does not exist for project.

It came back four hours later, untouched. Google had a backend issue. My data was fine. But for four hours, I thought I'd lost everything.

That's when I migrated to Supabase. Postgres. Real backups. No Google Cloud 2FA requirement. The migration took a weekend, and now the database is mine.

Bug 2: Firestore rejected undefined. Everywhere. Deeply.

Before the migration, the bug that cost me the most time was this:
Function setDoc() called with invalid data. Unsupported field value: undefined

text

Firestore refuses any document containing undefined anywhere inside it. Not null — undefined. And when it fails, it doesn't tell you which field. Just the document path. If you're saving a nested object with 40 fields, you're searching for a needle in a haystack.

The fix was a recursive cleaner routed through every write:


js
function cleanForFirestore(obj) {
  if (Array.isArray(obj)) return obj.map(cleanForFirestore);
  if (obj instanceof Date) return obj;
  if (obj && typeof obj === 'object') {
    const out = {};
    for (const k in obj) {
      if (obj[k] !== undefined) out[k] = cleanForFirestore(obj[k]);
    }
    return out;
  }
  return obj;
}
Then I wrapped setDoc, updateDoc, and addDoc in a safeFirestore helper that cleans the data before every write. One import change, and no write in the app can send undefined to Firestore again.

The lesson wasn't "fix the bug." It was "there is a class of bug, and you can kill the whole class with one wrapper."

The deploy lesson
The site broke for two days with this:

text
Failed to load module script: Expected a JavaScript-or-Wasm module script but the server responded with a MIME type of "application/octet-stream"
I was staring at the code. The problem was in GitHub Pages settings. It was serving my repo root — which has /src/main.tsx — instead of my built dist/ folder. The fix was to copy dist/ into a docs/ folder, point Pages at /docs, and stop letting it serve source.

The error message was the browser refusing to run a TypeScript file as JavaScript. Once you know that, it makes sense. The code was never broken. The deploy was.

What I'd like feedback on
Is the calorie calculation right? Mifflin-St Jeor for BMR, activity multiplier for TDEE, 300–500 deficit, floor at BMR. I want someone who actually knows nutrition math to sanity-check it. If the numbers are wrong, the app is wrong.

Does the onboarding flow make sense the first time you see it? Country → height/weight/age → fitness level → goal. Four steps. If it's confusing, I want to know where.

Does it break on your phone? I've tested on one device. I need more.

Does the meal plan respect your dietary preference? I fixed a bug where vegetarian users were getting turkey. If you set a diet and get a plan that violates it, that's a bug and I want to hear about it.

forkcount.github.io

I'm 13 and I built this by directing Google AI Studio, not by writing code by hand. So if something looks like a beginner mistake, it probably is. Tell me and I'll fix it.

Read this.

forkcount — Tue, 27 Oct 2026 11:49:33 +0000

Harun - solo dev

Oct 26

Live Terminal Demos: Watch KAVLR Block Destructive Commands & HYNA-Stage Spin Up in 5.1s 🐯🛡️

#showdev #ai #buildinpublic #hackerstage

2 min read

I'm 13. I Built a Free Calorie Tracker That Shows You the Math. No Card, No Trial, No Paywall.

forkcount — Mon, 26 Oct 2026 16:17:32 +0000

I built a calorie tracker. It's called ForkCount. It's free. There's no card, no trial, no "start your 7-day free trial" wall, and no premium tier hiding the barcode scanner behind $12.99/month.

I'm 13. I can't write JavaScript from memory. I built it using Google AI Studio — describing what I wanted, testing what came back, fixing what broke. Two weeks of debugging. It's live now.

What it does

Shows you the math. Most apps give you a number. ForkCount gives you the number and the formula behind it — your BMR, your TDEE, your activity multiplier, your goal adjustment. Every step is visible. If you want to know why your target is 1,400 and not 2,000, the app tells you.

Calculates from your body, not an average. Mifflin-St Jeor for BMR, Katch-McArdle if you know your body fat percentage. Then activity level, then goal. The target is yours, not a default.

Logs food by typing. "200g chicken and 150g rice" parses to two items with macros. No searching a database for each ingredient. Type it, log it.

Weekly meal plans that use your target. Not a generic 2000 kcal plan. Your calorie target. Your dietary preference. If you're vegetarian, the plan is vegetarian.

Tracks water, weight, and exercise. Water in glasses, weight in trends, exercise with kcal burned.

Runs in your phone browser. No download. No app store. Open the link, sign up, done.

What it doesn't do

No food photo scan (in progress)
No barcode scanner (removed after it kept misfiring — it's coming back when it works)
No Apple Health / Google Fit sync
No verified nutrition data for anything not in the built-in list
No premium tier, because there's no business model. It's just free.

Why I built it

Every calorie app I tried wanted a card before it showed me anything useful. The math was always hidden. The target was always a black box. The "free" version was always a trial, or an ad-supported version of a paid app, or a version that locked the one feature you actually needed behind a subscription.

So I built one that doesn't do that. The math is visible. The target is yours. The app is free.

Why I'm posting

I want to know if the calorie math is right. If you've tracked long enough to know your real TDEE, run the onboarding and compare. If the number ForkCount gives you is off by more than 100 kcal, tell me how and I'll fix it. If it's right, tell me that too — I need to know the calculator works before I trust it.

I also want to know what's missing. What feature do you use in MyFitnessPal that you can't live without? What would make you switch? Not "add every feature" — what's the one thing?

Try it

https://forkcount.github.io

Free. No card. No trial. Works on any phone browser. Two weeks old, so there will be bugs — but every bug I hear about gets fixed within a day.

If you try it and something breaks, tell me what you were doing and what phone you're on. I read every message.

Built with React, Vite, Supabase, and a lot of patience. Deployed on GitHub Pages. If you're building something similar and want to know how the Supabase migration went, ask in the comments — I'll write it up.

I Fixed 3 Bugs in My AI-Built Calorie Tracker Today. All Three Were "The AI Is Ignoring Me." None of Them Were the AI.

forkcount — Mon, 26 Oct 2026 16:16:02 +0000

I'm 13. I built a free calorie tracker called ForkCount using Google AI Studio. It runs on React + Vite, deployed to GitHub Pages, database on Supabase. I can't write JavaScript from memory. I build by describing what I want and debugging what comes back.

Today I fixed three bugs that all felt like "the AI is ignoring my settings." Every one turned out to be a completely different problem. Here's what happened, and what I learned.

Bug 1: The plan said "vegetarian" but served turkey

I set my profile to vegetarian. Generated a 7-day meal plan. Day three: turkey breast.

The plan generator was calling the AI with a prompt that said "make a meal plan" and nothing else. It never read profile.dietary_preference. It never filtered the response. It asked for food and took what came back.

The fix was two layers. First, pass the diet into the generation prompt:


js
const prompt = `Generate a 7-day meal plan for a ${profile.dietary_preference} user. 
Do NOT include any meat, poultry, or fish if vegetarian.`
Second, verify the response before showing it:

js
const forbidden = ['turkey', 'chicken', 'beef', 'pork', 'lamb', 'fish']
if (profile.dietary_preference === 'vegetarian') {
  for (const meal of plan.meals) {
    for (const item of meal.ingredients) {
      if (forbidden.some(f => item.toLowerCase().includes(f))) {
        // regenerate this meal
      }
    }
  }
}
Asking the AI is not enough. You have to check the answer.

Bug 2: The plan used 2000 kcal, not my actual target
Same root cause, different field. The plan generator had a hardcoded default of 2000 calories. My profile target was 1400. The plan ignored it.

The bug was subtle: the generator did read profile.target_calories, but the read happened before the profile finished loading from Supabase. So it got undefined, fell back to 2000, and generated the plan around that number.

The fix was to await the profile load before generating:

js
const { data: profile } = await supabase
  .from('profiles')
  .select('target_calories, dietary_preference')
  .eq('id', user.id)
  .single()

if (!profile) throw new Error('Profile not loaded')
if (!profile.target_calories) throw new Error('No target set')
No fallback. If the target is missing, fail loudly instead of quietly using 2000. Silent fallbacks are how you end up with plans that don't match the user.

Bug 3: The Diary showed one target, the Edit screen showed another
This one took the longest. The Diary screen showed a calorie target of 1580. The Edit Daily Calorie Target screen showed 1396. Both were reading from "the profile." Both were wrong in different ways.

Turns out the Diary was reading a cached value from localStorage. The Edit screen was reading from Supabase. The cache was never invalidated when the target changed. Two sources of truth. One updated, one didn't. Refresh didn't help because the localStorage cache survived the refresh.

The fix was to delete the localStorage cache entirely and always read from Supabase on mount. One source of truth. Cache invalidation bugs are almost always fixed by removing the cache.

What I actually learned today
Three bugs, three patterns:

The AI does what you ask, not what you meant. "Make a plan" is not "make a vegetarian plan." You have to say the diet in the prompt, and then verify the answer. The AI will happily hand you turkey if you don't say no.

Silent fallbacks hide bugs. A ?? 2000 fallback looked harmless. It made the app silently wrong for months instead of loudly broken for 5 minutes. Fail loud. Fail early. A red error message is better than a wrong number.

Two sources of truth always disagree. If the Diary reads localStorage and the Edit screen reads Supabase, they will diverge. Not "might diverge." Will. The fix is one source. Always.

None of these were "the AI is broken" bugs. They were "the code is doing exactly what it says, and what it says is wrong" bugs. The AI wrote the code correctly. The code did the wrong thing correctly.

That's the part nobody warns you about with AI-assisted development. The AI doesn't make the same mistakes a human makes. It makes different mistakes — cleaner ones, more consistent ones, the kind that hide behind passing builds.

The fix is the same as with human-written code: read what it actually does, not what you think it does. Add a log. Check the value. Find the layer where the bug lives.

Three bugs down. No idea how many left.

ForkCount is a free calorie and macro tracker with no card, no trial, and no paywall. It calculates your BMR and TDEE from your own stats and shows you the maths. If you've ever wanted a tracker that doesn't hide the calorie math behind a subscription, try it at forkcount.github.io. It's two weeks old, so it's rough around the edges — but it works, and every bug gets fixed within a day.

I Spent 3 Days Debugging a Deploy That Was Never Deploying. Here's the Checklist That Fixed It.

forkcount — Sun, 18 Oct 2026 14:55:34 +0000

Three days. That's how long I spent pushing fixes to a GitHub Pages site that never changed.

Every push succeeded. Every workflow showed green. Every fix worked in my dev environment. And every single time I opened the live URL, the same console error stared back at me:

Failed to load module script: Expected a JavaScript-or-Wasm module script but the server responded with a MIME type of "application/octet-stream"

I'm 13. I built a calorie tracker called ForkCount using AI Studio. The app worked. The deploy didn't. And the worst part wasn't the error — it was that I couldn't tell whether my fixes were failing or whether they were never reaching the browser at all.

Day one, I blamed the build. I rebuilt locally, checked the output, saw that the script tag pointed to a real .js file. The build was fine.

Day two, I blamed GitHub Actions. The workflow looked correct. Green checkmarks everywhere. But the live site was still serving source files instead of the built ones. I didn't understand how both could be true at once.

Day three, I opened my own repo and looked at the docs/ folder. It had assets, it had a .nojekyll file, it had a manifest. It did not have an index.html. The folder I was deploying from was empty of the one file that mattered. GitHub Pages was serving a 404, which fell back to the repo root, which contained my raw source files with /src/main.tsx — a file no browser can execute.

That was the bug. Not the code. Not the workflow. A missing file in a folder I'd looked at ten times without seeing what was absent.

The fix took four commands. Build, copy, add the missing file, push. Three days of debugging ended with a solution so simple I felt stupid for not finding it sooner.

But here's what I actually learned, and it has nothing to do with GitHub Pages:

When something breaks and the fix doesn't work, the first question isn't "what's wrong with the fix?" It's "did the fix actually arrive?" I spent two days debugging code that was never running. Every prompt I sent to my AI assistant went to the source. The source was fine. The source was never the problem.

If you're building something and it keeps failing after every fix, check the layer between your code and your user. Look at what's actually being served, not what you think you deployed. View source. Check the hash. Open the folder. Count the files.

The AI can write the code. It can't see your screen. When something breaks, you have to be the one who notices where the break is.

ForkCount is live now at forkcount.github.io. Free, no card, no trial. I built it because every calorie app I tried hid the math behind a paywall. It still has bugs. But the deploy works, and I know how to check it.

I'm 13 and I built a free calorie tracker. It's live, and here's everything that broke.

forkcount — Fri, 16 Oct 2026 12:24:59 +0000

Every calorie app I tried wanted my email and a card before it showed me anything. So I built one that doesn't.

I don't write code by hand. I describe what I want to Google AI Studio and it writes it. Then I test it on my phone, find what's broken, describe the fix. That's the loop. Two weeks of it.

The app is called ForkCount. forkcount.github.io

What it does

It asks your height, weight, age, gender, and activity level. Then it works out your BMR (Mifflin-St Jeor), your TDEE, and a calorie target that keeps you above your BMR floor. If you try to set a target below that line, it shows you the numbers and explains why.

The rest is a food diary, water tracker, weight log, exercise log, weekly meal plan generator, and a community feed. You type "200g chicken and 150g rice" and it parses the food. No card. No trial. No paywall. No email — just a username and password.

Stack

React + Vite + TypeScript
Firebase Firestore
Firebase Auth
GitHub Pages, deployed from the docs/ folder
No backend. All logic is client-side.

The bug that cost me the most time

Firestore rejects any document that contains an undefined value anywhere inside it. Not null — undefined. And when it fails, it doesn't tell you which field. It just says:

Function setDoc() called with invalid data. Unsupported field value: undefined

If you're saving a nested object with 40 fields, you're searching for a needle in a haystack. I spent days on this. Fix one field, redeploy, same error for a different one.

The fix was a recursive cleaner, routed through every Firestore write:

function cleanForFirestore(obj) {
  if (Array.isArray(obj)) return obj.map(cleanForFirestore);
  if (obj instanceof Date) return obj;
  if (obj && typeof obj === 'object') {
    const out = {};
    for (const k in obj) {
      if (obj[k] !== undefined) out[k] = cleanForFirestore(obj[k]);
    }
    return out;
  }
  return obj;
}

Then I wrapped setDoc, updateDoc, and addDoc in a helper that cleans every write. One import change, and no write in the app can send undefined to Firestore again.

The second bug: GitHub Pages was serving my source files

The site broke with this:

Failed to load module script: Expected a JavaScript-or-Wasm module script but the server responded with a MIME type of "application/octet-stream"

I stared at the code for two days. The problem was in GitHub Pages settings. It was serving my repo root — which has /src/main.tsx — instead of my built dist/ folder. The fix was to copy dist/ into a docs/ folder, point Pages at /docs, and stop letting it serve source.

The error was the browser refusing to run a TypeScript file as JavaScript. Once I knew that, it made sense.

What I'd like feedback on

Does the onboarding flow make sense the first time you see it?
Is the calorie calculation right? Mifflin-St Jeor for BMR, activity multiplier for TDEE, 300–500 deficit, floor at BMR.
Does it break on your phone?

I'm 13 and I built this by directing AI Studio, not by writing code by hand. If something looks like a beginner mistake, it probably is. Tell me and I'll fix it.

forkcount.github.io

I built a free calorie tracker with a metabolic safety floor. No card, no email, no paywall.

forkcount — Fri, 09 Oct 2026 15:04:37 +0000

So I built one that refuses.

What it does

ForkCount asks your height, weight, age, gender, and activity level. Then it calculates your BMR, your TDEE, and a target that keeps you above the BMR floor. If you try to set a target below that line, it won't let you.

The rest is a food diary, water tracker, weight log, exercise log, weekly meal plan generator, and a community feed. You type "200g chicken and 150g rice" and it parses the food.

Free. No card. No trial. No paywall. Signup is a username and password — no email required.

Stack

React + Vite + TypeScript
Firebase Firestore
Firebase Auth
GitHub Pages
No backend

The hardest part: Firestore rejects undefined

The error was: Function setDoc() called with invalid data. Unsupported field value: undefined

Firestore refuses any document that contains an undefined value anywhere inside it. When it fails, it doesn't tell you which field. So if you're saving a nested object with 40 fields, you're searching for a needle in a haystack.

The fix was a recursive cleaner routed through every write:

function cleanForFirestore(obj) {
  if (Array.isArray(obj)) return obj.map(cleanForFirestore);
  if (obj instanceof Date) return obj;
  if (obj && typeof obj === 'object') {
    const out = {};
    for (const k in obj) {
      if (obj[k] !== undefined) out[k] = cleanForFirestore(obj[k]);
    }
    return out;
  }
  return obj;
}

Then I wrapped setDoc, updateDoc, and addDoc so every write cleans the data first.

The other lesson: deploy settings, not code

The site broke with: Failed to load module script: Expected a JavaScript-or-Wasm module script but the server responded with a MIME type of "application/octet-stream"

I was staring at the code. The problem was GitHub Pages settings. It was serving my repo root — which has /src/main.tsx — instead of my built dist/ folder. The fix was to copy dist/ into a docs/ folder and point Pages at /docs.

What I'd like feedback on

Does the onboarding flow make sense the first time you see it?
Is the calorie calculation right? Mifflin-St Jeor for BMR, activity multiplier for TDEE, 300–500 deficit, floor at BMR.
Does it break on your phone?

forkcount.github.io

I'm 13 and I built this by directing Google AI Studio, not by writing code by hand. If something looks like a beginner mistake, it probably is. Tell me and I'll fix it.

I built a free calorie tracker with a metabolic safety floor. No card, no email, no paywall.

forkcount — Fri, 09 Oct 2026 14:53:23 +0000

So I built one that refuses.

What it does

ForkCount asks your height, weight, age, gender, and activity level. Then it calculates your BMR (Mifflin-St Jeor), your TDEE (BMR × activity multiplier), and a target that keeps you above the BMR floor. If you try to set a target below that line, it won't let you. You can override it in the settings, but the app tells you what you're doing and shows the maths.

The rest is a food diary, water tracker, weight log, exercise log, weekly meal plan generator, and a community feed. You type "200g chicken and 150g rice" and it parses the food. There's a barcode scanner, weight tracking, exercise logging with a kcal estimate.

Free. No card. No trial. No paywall. Signup is a username and password — no email required.

Stack

React + Vite + TypeScript

Firebase Firestore for the database

Firebase Auth for accounts

GitHub Pages for hosting (deployed from the docs/ folder, not the repo root)

No backend. All logic is client-side.

The hardest part: Firestore rejects undefined

The bug that cost me the most time was this:

text
Function setDoc() called with invalid data. Unsupported field value: undefined
Firestore refuses any document that contains an undefined value anywhere inside it. Not null — undefined. And when it fails, it doesn't tell you which field, just the document path. So if you're saving a nested object with 40 fields, you're searching for a needle in a haystack.

The fix was a recursive cleaner, routed through every write in the app:

js
function cleanForFirestore(obj) {
if (Array.isArray(obj)) return obj.map(cleanForFirestore);
if (obj instanceof Date) return obj;
if (obj && typeof obj === 'object') {
const out = {};
for (const k in obj) {
if (obj[k] !== undefined) out[k] = cleanForFirestore(obj[k]);
}
return out;
}
return obj;
}
Then I wrapped setDoc, updateDoc, and addDoc in a safeFirestore helper that cleans the data before every write. One import change, and no write in the app can send undefined to Firestore again.

The other lesson: the deploy settings, not the code

The site broke for two days with this:

text
Failed to load module script: Expected a JavaScript-or-Wasm module script but the server responded with a MIME type of "application/octet-stream"
I was staring at the code. The problem was in GitHub Pages settings. It was serving my repo root — which has /src/main.tsx — instead of my built dist/ folder. The fix was to copy dist/ into a docs/ folder, point Pages at /docs, and stop letting it serve source.

The error message was the browser refusing to run a TypeScript file as JavaScript. Once you know that, it makes sense.

What I'd like feedback on

Does the onboarding flow make sense the first time you see it? It's country → height/weight/age → fitness level → goal.

Is the calorie calculation right? Mifflin-St Jeor for BMR, activity multiplier for TDEE, 300–500 deficit, floor at BMR. I want someone who actually knows nutrition math to sanity-check it.

Does it break on your phone? I've tested on one device and I need more.

forkcount.github.io

I'm 13 and I built this by directing Google AI Studio, not by writing code by hand. So if something looks like a beginner mistake, it probably is. Tell me and I'll fix it.