September 2026

HuiaHub

AI tools, open-source projects, guides and news, researched from primary sources and checked before anything goes live.

I built HuiaHub to find AI worth using. Five research engines gather candidates from GitHub, Hacker News, official feeds, YouTube and the news, and every article has to pass a quality gate that rejects unsupported claims. The first run of every pipeline against live sources cost less than one cent in AI.

Build something similar

passing Vitest tests: 98
Playwright tests with axe checks: 52
database tables: 40
scheduled jobs on one cron: 24
research engines: 5
stages in the article engine: 7
weighted quality signals: 13
prompt-injection patterns screened: 8

Architecture

Five research engines, one AI router.

My role: Product owner and developer. I set the requirements, reviewed and tested the work, and ran every pipeline against live sources before trusting any of it, working with AI coding assistants.

lib/pipelines
One pipeline per section: projects, tools, news, videos, articles, keywords, images and maintenance.
lib/ai
The AI router: the provider board, a circuit breaker, a 30-day answer cache, budgets and the manual inbox, plus the house style every prompt carries.
lib/scoring
Deterministic scorers for projects, tools, videos, keywords and news clusters, and the content quality gate.
lib/security
SSRF-safe fetching, prompt-injection screening, AES-256-GCM encryption, rate limits and spam checks.
lib/jobs
A Postgres job table with leases, logs, retries and back-off, driven by one Vercel Cron every 10 minutes.
lib/integrations
GitHub, Hacker News, RSS and YouTube feeds, GDELT, Product Hunt, web search, Search Console, Brevo and IndexNow.

Next.js 16
React 19
TypeScript
Tailwind CSS v4
Drizzle ORM
Neon Postgres
PGlite
Postgres full-text search
Zod
WebAuthn passkeys
OpenRouter
sharp
Vercel Cron
Vitest
Playwright

Research

Five engines with the same shape

Every section of the site runs the same loop: keywords, then sources, then an AI research call, then a verification call, then a score that decides between publishing and waiting for a person.

Blog

Seed keywords, AI ideation, Search Console, on-site searches, and GitHub and Hacker News momentum.
Judges 25 keyword opportunities in one call, then hands the best to the article engine.

AI News

GDELT (free, no key), web news search, Hacker News and official feeds.
Clusters the day's headlines across outlets, and writes a sourced post only where it can add something. Otherwise the story stays a link.

AI Tools

Product Hunt, Show HN, official announcements and keyword web search.
Extracts facts from the official site, pricing page and docs, with 'unknown' allowed as an answer, and flags red flags.

AI Projects

Topic query families and keywords, run as GitHub searches.
Rejects archived, forked, abandoned and spam repositories in code, then summarises the README in its own words.

Videos

YouTube Data API keyword search and curated channel feeds.
Drops Shorts, stale and low-engagement uploads in code, then writes a real post: summary, takeaways, chapters and VideoObject data.

Quality

It would rather publish nothing

The quality gate combines deterministic checks with an AI fact-check, and missing evidence always lowers the score.

Thirteen weighted signals

Source quality, source diversity and whether a primary source is present.
Citation coverage, factual consistency, original value and whether the article answers what was searched.
Writing quality, topical relevance, structure, duplication, clickbait risk and house style.

Hard caps

No sources caps a draft at 40. Without a primary source it can never publish itself.
A claim of first-hand testing ('we tested...') with no stored test data caps it at 50.
Each unsupported claim costs 8 points, up to 30. Anything under 600 words is capped at 60.

Decisions

90 or more publishes, and only when auto mode is on. 75 to 89 waits for a person. Under 75 is rejected.
'Reviewed by' appears only when a person has ticked 'I reviewed this'.

Tested on itself

On the first live run, one article went through all seven stages and the gate rejected it at 63 out of 100 for three unsupported claims. That is the gate doing its job.

Cost

Under one cent for a full run

The router treats every model call as expensive and looks for a reason not to make it.

The provider board

Any number of providers, several keys per vendor, dragged into fallback order.
Free rows first, each capped below its free quota. Paid rows run only when allowed, and stop at a monthly budget.
It stores the name of an environment variable, never the key, and refuses names containing SECRET, PASSWORD, DATABASE, ENCRYPTION or SALT.

Spending less

A 30-day answer cache, so running a job again costs nothing.
Batching: 25 keywords judged per call, and every source for an article read in one.
Rules decide first. News categories, AI relevance and hard project rejections are plain code, before any model sees them.

When a provider fails

A circuit breaker cools a failing provider down instead of spending retries on it.
When every provider is out, tasks wait in a manual inbox: paste the prompt into any free chat assistant, paste the JSON back, and the pipeline carries on.

Measured

DeepSeek through OpenRouter at $0.038 in and $0.077 out per million tokens, 8 to 12 seconds a call.
The first live run cost under one cent in AI, including 13 video posts, 14 project summaries, 57 keyword judgements and one complete article.

Security

Research means reading the hostile web

Server-side request forgery

Every research fetch goes through one guard: http(s) and default ports only, no credentials in URLs.
Every resolved address is checked against private, loopback, link-local, cloud-metadata, CGNAT and IPv6 ULA ranges.
Redirects are followed by hand and each hop is validated again. Size, type and time are capped.

Prompt injection

Fetched text reaches a model only as data inside a delimited block, with look-alike delimiters neutralised.
Eight patterns are screened, from instruction overrides and role hijacks to fake tool calls and secret exfiltration, and invisible characters are caught too.
Models get no tools. Output is JSON validated with Zod, and any URL in it is checked again before use.

Accounts

Several admins with roles, and two-factor authentication is mandatory: passkeys, TOTP or single-use recovery codes.
Passwords hashed with scrypt, and checked against Have I Been Pwned without the password leaving the server.
Sudo mode for sensitive settings, and an audit log of every admin action and automated decision.

Testing

What the first live run found

Every job was run against the live internet and a real model before any of it was trusted. That run turned up eight bugs.

What it produced

135 headlines ingested, deduplicated and categorised.
60 video candidates and 13 published; 40 repositories discovered and 14 published.
5 tool candidates: 3 rejected as not AI products, 2 sent to review.

Bugs it caught

One slow answer opened the circuit breaker and sent every later task to the manual inbox. Soft failures now need two strikes.
Three scorers read missing data as bad data, so no video could reach the publish bar. An unknown signal is now dropped instead of scored as zero.
Two stray control characters had crept into the source: one weakened an injection pattern, the other made the image fetcher reject everything. A test now fails the build on them.

Automated

98 Vitest unit and integration tests, including the provider board and router against a real embedded Postgres.
52 Playwright tests with axe WCAG 2.2 AA checks in both themes, on desktop and mobile.

Growth

Skills I sharpened.

AI engineering: A multi-provider router with a circuit breaker, an answer cache, budgets and a manual fallback.
Content automation: Staged research pipelines, deterministic gates before AI calls, and a scored quality gate.
Security: SSRF-safe fetching, prompt-injection screening, passkeys and TOTP, AES-256-GCM secrets at rest.
Full-stack TypeScript: Next.js 16 with Cache Components and Partial Prerendering, React 19, server actions.
Databases: A 40-table Postgres schema with Drizzle, full-text search, and a job table with leases.
Integrations: GitHub, Hacker News, GDELT, YouTube Data API, Product Hunt, OpenRouter, Search Console and Brevo.
SEO: Per-entity Open Graph images, VideoObject and SoftwareSourceCode data, split sitemaps and IndexNow.
Testing: Vitest against embedded Postgres, Playwright with axe, and full pipeline runs against live sources.