How we build, in the open.
Engineering and design notes from the studio. System design and the stack we reach for, how we wire AI agents into a build, the performance and accessibility work, and the design decisions behind the interface. Specifics over slogans, written by the team that ships it.
We put a 5MB embedding model in the browser
On-device semantic search: type a question, get back meaning-ranked results in milliseconds. No server involved.
Read →Who builds GattyWorks
How is that even possible with that few people? Here is who is actually behind GattyWorks, and what they built before.
Read →Indian builds, personal data, and AI: the problem we are taking on
AI features widen how much personal data an Indian build touches. The DPDP Act just made that legally risky.
Read →We clicked an Instagram ad to buy a ticket. The login screen had a critical bug, and we are not telling you how it broke.
Nobody paid us to audit this site. We found a critical login bug anyway, and chose not to explain how.
Read →We audited every free-tier quota on our Cloudflare account. Two were on fire.
Five domains, twelve Workers, one audit. Two Cloudflare quotas were already on fire and we did not know.
Read →CommonCrawl: the free web archive most LLMs are trained on
Most LLMs were trained on this. It's free, public, and sitting in an S3 bucket anyone can pull from.
Read →Why Review Relay starts with GattyWorks
One GattyWorks tenant, a reusable client intake, and no model call behind the review drafts.
Read →We tested five UI sound families. Warm Pulse won.
We tested 30 generated click sounds, chose Warm Pulse, removed hover audio, and gave email its own motif.
Read →Why GattyWorks is now a global AI and software audit studio
Three audit tiers, public prices, and one test: can the buyer prove what the vendor or AI system does?
Read →How BitChat works without a central chat server
Inside BitChat's BLE flood control, Noise sessions, courier mail, Nostr fallback, and failure modes.
Read →How we built a local social publishing desk with SQLite
Inside GattyWorks' local social desk: SQLite state, live checks, human gates, and no scheduler.
Read →What Astryx's AI-agent manifest gets right that most design systems don't
AI agents hallucinate props from prose docs. Astryx fixes that, and it is a pattern worth stealing.
Read →Handoff: a one-time secret that never touches our server
Paste text, get a link, it travels browser to browser over WebRTC. Here is what our relay is and is not allowed to see.
Read →Handoff had no rate limit. Now it does.
Our signaling relay was unauthenticated on purpose. Here is what we shipped once we thought through what that actually exposes.
Read →Your LLM judge might agree with your experts less than a coin flip
An LLM judge that spits out a score is not the same as one you can trust. Here is how you tell the difference.
Read →A public issue talked an AI agent into leaking private repos. So we audited our own.
An attacker leaked private repos with plain English in a public issue. We used it as a checklist against our own agents.
Read →LocalSend: file sharing that skips the cloud entirely
Send a file across the room without touching a cloud server in between. Free, open source, cross-platform.
Read →Adding search to /tools, /blog, and /news without a backend
Fuzzy search across every tool, post, and story, running entirely in the browser with zero backend.
Read →selfhost.directory: 2,500+ self-hosted alternatives, one search box
Self-hosted alternatives to the SaaS tools you are renting, organized by category, license, and version.
Read →We ran an eval on our own search. Full post bodies barely moved the score.
We built an eval harness for our own search and ran it. The number that mattered most was smaller than we expected.
Read →FckSignups: 174 open-source tools, zero signups
174 open-source, no-signup tools in one directory, built by one person for free. Here is why we back it.
Read →Anytype got too restrictive. We are looking again.
We moved to Anytype for local-first notes and said so. The rigid object model boxed us in, so we went looking again.
Read →CC Switch: one window for every AI CLI's config
One window for every AI CLI's config, instead of editing dotfiles by hand. We recommend it, with one honest catch.
Read →Notion's block limit is a wall. Anytype is how we get past it.
Add a second person to a free Notion workspace and you hit a 1,000 block wall that deleting cannot undo. Here is our fix.
Read →Instant Domain Search: every tool in one screen, no lock-in
The domain tool we keep open on every scope call. Live availability as you type, no forced checkout, no upsell maze.
Read →What is next: tools, SEO, and spinouts
Our plan for gattyworks.com: ship small useful tools, make them findable, and spin out the ones that get real traction.
Read →Why our brand kit lives on the website
Brand assets go missing exactly when you need them. So ours live on a public page, not a locked folder, one click away.
Read →Cookbooks, playbooks, and the tools we ship.
We publish the notes we use internally. Email is the only channel. No tracking pixel, no list rental. One note when something new is live.
hello@gattyworks.com