DevAtlas

An open-source directory of developer profiles. Sign in with GitHub, add your stack, games, interests and writing, and share a single link.

DevAtlas started from a simple gap: stat-card generators for GitHub and LeetCode already exist, but none of them make the profile itself the product, and none of them let you browse other developers.

The goal was to combine live GitHub activity and a personal profile into one shareable page, then put those pages in a searchable directory.

It is live in production with 12 registered users.

The idea

The frontend and API are separate deployments. Server-side calls and browser calls take different paths into the API, and the API trusts neither blindly.

What it does

• GitHub sign-in using only the read-only read:user scope
• Profiles with bio, stack tags, links, interests, games, blog post cards and self-reported LeetCode stats
• GitHub stats: contribution graph, streaks, pinned repos, languages and recent public activity, cached and refreshed at most every 6 hours
• Per-section and per-card visibility, where hidden data is never sent to other visitors
• Searchable directory, embeddable README badge and three themes (terminal, coffee, forest)
• Self-service account deletion that also revokes the GitHub authorization
• Moderation: user reports, temporary suspensions, an audit log and an MFA-protected staff panel

Engineering decisions

Privacy is enforced on the server. Hidden sections are stripped in the API response, not hidden in the UI. Every public surface that shows user content has to respect visibility and suspensions, and there is a checklist in the code for adding new ones.

Rate limiting behind a proxy. Server-rendered traffic from Vercel all arrived at the API from the same IP, so a per-IP limit would have throttled everyone together. The Next.js server now forwards each visitor's real IP with an HMAC-SHA256 signature the API verifies, giving 30 requests per minute per visitor with no spoofable headers.

Directory performance. Directory pages went from 38 queries to 6 by batching lookups and replacing in-memory counting with SQL COUNT.

Staff access. The moderation panel needs a GitHub sign-in plus a TOTP MFA step. It has recovery codes, replay protection, lockout after 5 failed attempts, and 30-minute elevated sessions that are re-checked against the database on every request.

Tokens and deletion. GitHub tokens are Fernet-encrypted at rest. Account deletion cascades all user data and revokes the OAuth grant, and any new foreign key to a user must declare its ondelete behavior.

Local-first, production-grade checks

GitHub Actions CI
       │
       ├── Frontend: lint, typecheck, build
       │
       └── Backend: migrations applied to an empty Postgres

• 13 Alembic migrations, verified against a clean database on every push
• 13 backend test modules covering moderation rules, MFA, rate-limit keys, response safety and caching
• Dependabot enabled
• Architecture, deployment, moderation, security and contributing docs in the repo

What I learned

DevAtlas was my first project with real users, which changed how I thought about it.

The main things I learned were:

• Designing moderation, suspensions and account deletion before launch, not after
• Keeping rate limiting correct when traffic passes through a proxy
• Diagnosing slow pages from query counts instead of guessing
• Managing schema changes with Alembic against a live database
• Operating a split deployment (Vercel, Render, Neon) and handling free-tier cold starts

The biggest lesson was that privacy and abuse handling are far cheaper to design in from the start than to retrofit once people are using the product.

Current status

Shipped

DevAtlas is live and stable. It is in maintenance mode: bug fixes and contributor pull requests are welcome, with new features by issue first.

Repository