All labs

Lab

Live

FlowRunner

Design pages. Run flows. Ship apps.

A no-code platform where a drag-and-drop page builder and a visual flow engine publish straight to live HTTP endpoints. The visible half is a builder; the interesting half is everything required to execute someone else’s logic on your infrastructure without regretting it.

www.flowrunner.io (opens in a new tab)
Built-in flow nodes
20+
Export targets
HTML · Next.js · Expo
Monorepo
~64k lines

Running untrusted code

The Code node executes user JavaScript inside a QuickJS interpreter compiled to WebAssembly — no host access, no network, no reach into the secret vault, with hard memory and time ceilings. Sandboxing by construction rather than by blocklist, which is the only version of this that survives contact with a real user.

Rails around the engine

  • SSRF egress guard on every outbound request
  • Auto-retry with backoff on I/O nodes, bounded by a per-run budget
  • Runaway-graph guardrails and per-run step and delay budgets
  • Secrets and env values redacted from traces — including coerced numbers and object keys
  • Webhook HMAC signature verification for Stripe, GitHub and Shopify shapes

Third-party components, safely

Custom components ship with Ed25519-signed manifests and a permission model, so a workspace can install someone else’s component without granting it the run of the editor. This is the piece that makes a component marketplace possible later instead of impossible.

Operating it

  • Persisted run history with per-node traces and per-node output on failures
  • An in-editor run inspector with ok / failed / skipped / handled badges on the canvas
  • Throttled flow-failure email alerts and a public status page with a self-monitoring heartbeat
  • Standalone HTML, Next.js and React Native / Expo exports of any published form

Stack

  • Next.js
  • Turborepo
  • QuickJS/WASM
  • Ed25519
  • MongoDB
  • Claude API

More labs

Keep looking

  • Trigata

    Live

    Process automation for people who do not write code.

    Structured data tables, custom forms, and trigger-based automations — send an email, call a webhook, run a scheduled job — behind fine-grained role-based access control. Aimed squarely at small-business teams with a process and no engineer.

    • Next.js
    • MongoDB
    • QStash
    • Zod
    • +2
    Read morewww.trigata.com (opens in a new tab)

  • Band Tutor Buddy

    Live

    Practice between lessons, for band kids.

    Notation and tab that plays back, listens through the microphone, and tells a kid whether they actually hit the note. Built for the gap between weekly lessons — where nearly all the practice happens and nobody is there to correct anything.

    • Next.js
    • VexFlow
    • Tone.js
    • Pitch detection
    • +1
    Read morewww.bandtutorbuddy.com (opens in a new tab)

  • Forge3D

    Live

    A WebGPU game engine and editor that never leaves the browser tab.

    Open a tab, build a 3D game, export a single self-contained game.html you can double-click. Forge is a real editor — hierarchy, gizmos, inspector, TypeScript scripting — running on WebGPU with no install, no account, and nothing leaving your machine.

    • WebGPU
    • WGSL
    • TypeScript
    • ECS
    • +1
    Read morewww.forge3d.dev (opens in a new tab)

Want the long version?

Happy to go deeper on any of this — architecture, trade-offs, what I would do differently.

Get in touchBack to home