Launching Bytes

Bytes started as a weekend hack. The pitch: “What if you could read the day's news in 90 seconds?” The first prototype was a single React component that scraped a handful of RSS feeds in the browser, with no caching and no error handling.

The audit

Before shipping to real users, we ran an end-to-end audit. The findings were sobering: 11 bugs, 8 vulnerabilities, 12 performance issues. Highlights:

• RSS fetches ran client-side, leaking the user's IP to every publisher
• The search bar crashed on articles with undefined titles
• No auth, no database — everything lived in localStorage
• Zero tests, zero error boundaries, zero rate limiting

The rewrite

We moved to Next.js 16 (App Router), added MongoDB and NextAuth.js for storage and auth, and built a proper two-tier cache. The RSS pipeline moved server-side with import ‘server-only’ guards. Rate limiting, CSP headers, Zod validation on every input and every cache read.

Rebuilding took longer than the original prototype. That's normal: making something actually safe to use is 10x the work of making it demo-able.

What we got right

• Starting with an audit. Listing every known flaw up front kept us honest about scope.
• No shortcuts on security. Every API route is validated, authenticated, and rate-limited.
• Server Components by default. Every page is server-rendered unless it absolutely needs 'use client'.

What we got wrong

We underestimated the legal pages. “Write a privacy policy” sounds like a one-hour task until you're researching CCPA categories of personal information at midnight.

Thanks

If you're reading this, thanks for trying Bytes. We'd love your feedback via the contact form.