🪙 Tolk NFT Blueprint released

A complete, production-ready NFT implementation on TON, written entirely in the new Tolk language.

This is what I wish I'd had when I started learning Tolk: a clone-and-ship reference repo, not another half-finished demo.

What's inside:

- NFT Collection + Item contracts in Tolk 1.2
- TypeScript wrappers with every Tolk quirk handled (address?, RemainingBitsAndRefs, dict encoding)
- 9 Sandbox + Jest tests - deploy, mint, batch, transfer, admin
- Blueprint scripts - TonConnect & mnemonic deploy / mint
- Pinata IPFS metadata recipe with the chicken-and-egg CID workaround
- TEP-62 / TEP-64 / TEP-66 compliant
- Verified on TON mainnet (deployed live)

➡️ Repo: github.com/nikandr-surkov/tolk-nft-blueprint

If it saves you time - drop a ⭐️ on GitHub.

NIKANDR'S APPS | YOUTUBE

💱 Toncoin is now Gram

Pavel Durov announced the rebrand on June 1, reviving the original 2018 name from Telegram's first whitepaper. The transition runs ~3 weeks, with no token swap required.

What changes for builders:

🏷 Token ticker: TON → GRAM. UI labels, payment displays, and exchange listings will roll over during the transition window.
🔗 The TON blockchain name stays the same. Contracts, addresses, RPC endpoints, SDKs — unchanged. This is a token-label change, not a chain migration.
⚡️ Telegram has also taken over as the network's largest validator (~2.2M staked) and cut fees roughly 6x. Cheaper on-chain ops for anyone routing payments or NFT mints through a mini app.

Action item this week: grep your mini app and bot UI for "Toncoin" and ticker references, and plan a copy swap to "Gram" / "GRAM" over the next few weeks. The chain stays TON; only the token name moves.

NIKANDR'S APPS | YOUTUBE

🧠 Claude Fable 5 is here

Anthropic released Claude Fable 5 yesterday - the first publicly available model from the new Mythos tier that sits above Opus. It's positioned for long-running, autonomous coding sessions where previous models lost the thread.

What stands out:

🟢 80.3% on SWE-Bench Pro (Opus 4.8: 69.2%, GPT-5.5: 58.6%, Gemini 3.1 Pro: 54.2%). On Cognition's FrontierCode it hits 29.3% vs Opus 4.8 at 13.4%.
🟢 Built for end-to-end work: planning, tool use, multi-hour runs, self-repair. Better than Sonnet or Opus at owning a whole feature from a single prompt.
🟢 $10/M input, $50/M output. Free in Claude apps until June 22, then paid usage credits.
🟢 Has cybersec/biology guardrails that route some requests to Opus 4.8 instead.

For us building Telegram bots and TON mini apps, the practical upshot: Fable 5 is now the strongest model for refactors, security audits, and "go through my whole repo and fix X" work. Next post: a ready-to-use prompt to audit your project with it.

NIKANDR'S APPS | YOUTUBE

🔍 Audit any project with Fable 5

A drop-in prompt that points Fable 5 at any repo - Telegram bot, TON contract, React app, Go API - makes it identify the stack first, derive the right best-practice checklist for what it found, and web-search the latest guidance when its training might be stale.

You are a senior code reviewer and security engineer auditing this codebase end-to-end. Work through four phases.

Before you start: if a CLAUDE.md, AGENTS.md, or README at the repo root exists, read it. It tells you what the project is and which conventions matter.

# Phase 1 — Map the project
Identify and summarize:
- Languages and framework versions (read manifests: package.json, pyproject.toml, go.mod, Cargo.toml, build.gradle, *.csproj, etc.)
- Build tools, package managers, runtime targets
- Architecture: entry points, layers, external services, data stores, queues, blockchains
- Auth and trust boundaries — who calls what, with what credentials
- Deployment target (cloud, container, edge, on-device, on-chain)

If you spot a stack component whose best practices may have shifted since your training, look up the current "<stack> best practices 2026" and "<stack> common vulnerabilities" before continuing.

# Phase 2 — Derive the checklist
For the stack you found, derive a stack-specific checklist covering:
- Security: input validation, auth, secrets, injection, SSRF, deserialization — the OWASP/ASVS items that actually apply
- Correctness: error handling, concurrency, race conditions, time/locale, off-by-one, unhandled states
- Performance: N+1 queries, missing indexes, unbounded loops, sync-in-async, memory leaks
- Reliability: retries with backoff, idempotency, timeouts, circuit breakers, graceful shutdown
- Maintainability: dead code, duplicated logic that hurts maintenance, type-safety gaps, missing tests on risky paths
- Supply chain: pinned versions and dependencies with known CVEs — run the appropriate audit command for the ecosystem, then verify any old-looking package against the advisory database
- Stack-specific traps — pull from your own knowledge plus the latest guidance from the web for "<framework> security pitfalls" if your knowledge isn't current

# Phase 3 — Review
Think carefully about each finding before writing it. Work semi-formally:
- Premise: "this function reads X from Y and passes it to Z"
- Trace: the concrete path an attacker or operator can take
- Conclusion: what breaks and how confident you are

Don't invent issues. If a check passes, note it. Mark uncertain items NEEDS HUMAN REVIEW with the specific question — include any sources you consulted and what you found.

# Phase 4 — Report

For each finding:
[SEVERITY] path/file:LINE — title
What: one-sentence description
Impact: what an attacker or operator can do
Fix: concrete change (include code if short)

Severities:
- CRITICAL — funds loss, RCE, account takeover, data corruption
- HIGH — realistic exploit, data exposure, DoS
- MEDIUM — unlikely preconditions or limited impact
- LOW — defense-in-depth, hygiene, maintainability

End the report with:
1. Detected stack — one paragraph from Phase 1
2. Top 3 to fix this week — best impact-to-effort
3. Checked and clean — categories that passed
4. Sources — any URLs you consulted for current best practices

Run the whole thing in one pass.

NIKANDR'S APPS | YOUTUBE

I CAN BUILD THE BEST APP FOR YOU!... NOW ON FIVERR!

A lot of people message me on Telegram about custom Telegram Mini App development.

Some are serious. Some are just exploring. Some want a custom build but prefer paying with fiat instead of crypto.

So I’m testing Fiverr as a cleaner entry point for new projects.

It gives buyers:

🟢 clear packages
🟢 clear scope
🟢 clear delivery timelines
🟢 a familiar fiat payment flow

And it gives me a better way to filter serious requests while seeing what teams are building and experimenting with right now.

The focus is still the same:

Telegram Mini Apps, TON wallet integration, Telegram Stars payments, Web3 payments, games, referral systems, admin panels, and full-stack Next.js apps.

I’ll keep this open while I’m testing the channel, but I won’t take many custom builds at the same time.

Tell me about your project idea: https://www.fiverr.com/s/jjNkq6w

NIKANDR'S APPS | YOUTUBE

💪 I made something I'm genuinely proud of!

A while back I started building a deep cybersecurity course - honestly, just for myself, my team, and a few friends. I wanted one place that explained how security actually works at the level the biggest companies operate at: not surface-level tips, but the real architectures and the real breaches behind them.

It took me a huge amount of time. And once it was done, it felt wrong to keep it locked away. So I decided to open it up to everyone.

The first part is free on YouTube ⬇️ A full 2-hour course on how the internet really works - and how hackers exploit every layer of it (networking, DNS, TLS, the whole attack surface):
➡️ https://www.youtube.com/watch?v=2ppV7rpv2XY

The premium series lives on my site - 3 in-depth videos (~5.7 hours) on how Google, Apple, Microsoft, and Cloudflare defend billions of users: Zero Trust, passkeys, privacy engineering, threat detection, AI security, and the software supply chain.

Here's why I think this matters right now: in the AI era, almost anyone can get AI to write the code. That part is being commoditized fast. What AI can't hand you is the deep understanding of how these systems break and how they're defended - the judgment to look at a system and see where it fails. That knowledge is what stays valuable when everything else gets automated. This course is built to give you exactly that.

🎁 It's currently 50% off - $49 instead of $99, lifetime access
https://nikandr.com/cybersecurity

If you watch the free one and it clicks for you, the premium series is the natural next step 🙌

NIKANDR'S APPS | YOUTUBE

🗝 Just dropped a new free video - 2+ hours, and I really think it's the best thing out there right now on how login actually works (and why passwords are dying).

This is part 2 of my free cybersecurity series. The first was how the internet works under the hood. This one goes straight for the front door of your whole digital life: authentication.

It kicks off with the MGM hack - a casino empire shut down for days, ~$100M gone, and it didn't take some genius exploit. It took one phone call to the help desk. That's the whole shift right there: attackers don't break in anymore. They just log in.

From there I take you through everything, from zero, no experience needed:

- how passwords are really stored and cracked
- why the password rules you were taught are actually wrong now
- MFA, and why some of it is way weaker than you think
- where your fingerprint actually goes
- passkeys - the thing finally killing the password
- how "Sign in with Google", sessions, cookies and SSO work
- and how today's attackers (deepfakes included) walk right past all of it

➡️ Watch it free: https://www.youtube.com/watch?v=QsTEJgiuLZk

My take hasn't changed: in the AI era anyone can get a model to write code. The part that stays valuable is actually understanding how this stuff breaks and how it's defended. That's what I'm trying to give you here.

🎁 And if you want the deep end - how Google, Apple, Microsoft & Cloudflare defend billions of identities, real architectures, real breach breakdowns - the premium course is still 50% off ($49), lifetime access:
https://nikandr.com/cybersecurity

NIKANDR'S APPS | YOUTUBE

🚀 I made a big update to my Complete Telegram Mini App source code!

And I just published a full review showing everything it can do now.

😎 Watch it here:
https://youtu.be/IKCrSrZIKjE

What's inside the code 👇
🎮 A real, playable in-app game
💰 Telegram Stars payments
💎 TON crypto payments + transaction history
👥 Referral system + leaderboard
🎁 Daily rewards & levels
👛 Wallet collection (airdrops / Web3)
⭐️ NEW: Tasks & quests system
⭐️ NEW: Admin panel — manage everything without touching code

It's a complete, production-ready system for launching a Telegram mini app for your game, crypto project, community, meme coin, or NFT project — and it saves you weeks of development.

🔥 Right now it's 30% OFF on my website.

➡️ Get the source code: https://nikandr.com/en/product/viral-telegram-app-mastery/preview

👾 Check the live game: https://t.me/ViralTgGameBot/app

NIKANDR'S APPS | YOUTUBE

⚡️⚡️⚡️ The best SaaS boilerplate you can get for free. Period.

I just open-sourced a COMPLETE AI SaaS:

- Auth: email, Google, GitHub, magic links (Better Auth)
- Stripe subscriptions + customer portal, live-tested
- A real credits system: append-only ledger that survives double-spends, webhook replays, race conditions - proven by tests, not promises
- AI image generation (gpt-image-2 - swap any model with one env string)
- 105+ tests, CI, Lighthouse 100s
- Neo-brutalist design that looks like an actual product, not another dark-purple AI template

😮 And the part NOBODY else ships free: it's AI-native. AGENTS. md, Claude Code skills, path-scoped rules, hooks that block broken code, a code-reviewer agent that caught 4 real money bugs during the build. Open it with Claude Code or Cursor - the repo briefs your agent by itself.

MIT license. Nothing crippled, nothing paywalled. Clone it and build YOUR product on top.

Try the live demo - sign up, generate images, subscribe with test card 4242 4242 4242 4242, watch the credits ledger do its thing:
→ https://ai-saas-starter-six.vercel.app

Get the code:
→ github.com/nikandr-surkov/ai-saas-starter

If it saves you weeks of work - and it will - star the repo. That's the whole price.

NIKANDR'S APPS | YOUTUBE

🔥 NEW VIDEO: The Best FREE SaaS Boilerplate in 2026 - Full Overview

I just published a full walkthrough of my open-source AI SaaS boilerplate - the complete, working product, live on screen. If you're planning to build a SaaS this year, watch this first.

Watch it here:
→ https://www.youtube.com/watch?v=2c0UhiK8ZTo

What you'll see in 5 minutes:

- The live product: Next.js 16 SaaS with auth, Stripe subscriptions, credits system, and AI image generation
- The money layer most templates fake: an append-only credits ledger - every transaction recorded, double-spends impossible, proven by tests against real Postgres
- The moment a generation FAILS - the system refunds the credit automatically. No support ticket, no manual fix. That's what a real billing system does
- Real Stripe checkout and one-time top-ups, wired end to end
- The AI-native part nobody else ships: AGENTS. md, Claude Code skills, hooks, a code-reviewer agent that caught 4 real money bugs during the build. Open the repo with Claude Code or Cursor - it briefs your AI by itself
- Neo-brutalist design with custom illustrations - looks like a product, not a template
- 105+ tests, CI, Lighthouse 100s, full production deploy guide

Everything is MIT licensed - the full code, no strings. Clone it, add your Stripe and AI keys, and you have a product that takes real payments - in hours, not months.

Try the live demo (test card 4242 4242 4242 4242):
→ https://ai-saas-starter-six.vercel.app

Get the code:
→ https://github.com/nikandr-surkov/ai-saas-starter

Watch the video, clone the repo, and star it if it saves you weeks - because it will.

NIKANDR'S APPS | YOUTUBE

🥶 Product Update — Full Clicker Game for Telegram 2.0 (v2026.07.25)

Your favorite Telegram Mini App clicker game template just got a serious security & maintainability upgrade. If you're building a tap-to-earn game (Hamster Kombat / Notcoin style) on TON, this is a big one. 👇

🔓 Security & anti-cheat hardening

✅ Closed a point-inflation exploit in the tap-sync endpoint — the server now strictly caps what a client can claim
✅ Telegram Stars payments are now fail-closed — forged payment webhooks can no longer hand out free points
✅ On-chain (SBT) tasks: a database-level unique index kills the double-claim race for good
✅ Fixed the daily energy-refill counter across the UTC day boundary

🤖 New: AI-portable update system
Every future update now ships as a clean, dated changelog in an _updates/ folder — written so an AI coding agent (Claude Code, Cursor) can merge it into YOUR customized copy without overwriting your work. No more manually diffing releases. Point your agent at the update file, and it applies the changes for you.

⚙️ Still the complete package:
Tapping + passive mining, referrals, standard tasks, TON on-chain SBT tasks, Telegram Stars payments, leaderboard, and a built-in admin panel — production-ready on Next.js 16 + React 19 + Prisma + MongoDB.

Already own it? Pull the update from _updates/2026.07.25. md
New here? Grab the full source and launch your own TON clicker game this week. 🚀

🛒 Get it: https://nikandr.com/en/product/full-clicker-game-for-telegram-2/preview

NIKANDR'S APPS | YOUTUBE

⚡️ FLASH SALE — 30% OFF for 30 HOURS ONLY

The complete Full Clicker Game for Telegram 2.0 source code is 30% off — but only for the next 30 hours. When the timer's up, the price goes back. No extensions.

If you've been waiting to launch your own tap-to-earn game on TON, this is the moment. 👇

👾 What you get — a full, production-ready template:

✅ Tapping + passive mining, referrals, leagues & leaderboard
✅ TON on-chain SBT tasks + native Telegram Stars payments
✅ Built-in admin panel to manage tasks & rewards
✅ Built on Next.js 16 + React 19 + Prisma + MongoDB — deploy to Vercel in an afternoon

🛡 Just updated (v2026.07.25): hardened anti-cheat, fail-closed Stars payments, and a new AI-portable update system so you can pull future updates into your customized copy with Claude Code — without losing your changes.

Skip months of development. Ship your clicker game this week. 🚀

🕙 30% OFF ends in 30 hours — grab it now:
➡️ https://nikandr.com/en/product/full-clicker-game-for-telegram-2/preview

NIKANDR'S APPS | YOUTUBE

😯 Building an app is getting ridiculously easy. Getting customers IS HARD AF

AI can write a huge part of your code now.

Hosting is cheap. Payments, auth, databases, analytics - most of the infrastructure can be added in hours instead of weeks. According to Supabase’s 2026 State of Startups report, 61% of startup builders said more than half of their codebase is AI-generated.

But!
Only 11% said technical complexity is their biggest challenge.
Customer acquisition is now #1.

And I think this changes what developers should be learning. A few years ago, being able to build the product was the hard part. Now you can build an MVP with just one prompt.

🫵 The real questions are:
- How do you get the first 100 users?
- How do you get people to trust you?
- How do you turn attention into customers?
- How do you build distribution that you can reuse for your next product?

In other words:
Code is becoming cheaper. Distribution is becoming HARD AF

This is something I want to experiment with much more myself - not only building apps, but actually learning how to grow, market and monetize them.
I’ll share the numbers and what works here as I test things.

NIKANDR'S APPS | YOUTUBE

🤯 ALL SOFTWARE IS BECOMING OPEN SOURCE

AI is getting surprisingly good at reverse-engineering software and games.

👀 Recently:

- Claude Code was used to decompile more than half of a Game Boy Advance game back into matching C code.
- Developers are using AI-assisted reverse engineering to do crazy things like putting Minecraft inside GTA V.
- An unofficial AI-assisted version of GTA V was even made playable in a browser before being taken down.

We used to think:

source code -> compiler -> binary

was basically a one-way street.

Now AI is getting better at going:

binary -> AI -> readable code

Give this another few generations and "closed source" might simply mean:

the source isn't public, but AI can reconstruct it anyway.

That's CRAZY SCARY:

Software -> AI reverse-engineers it -> generated code improves AI -> harder software gets reverse-engineered.

So yeah...

ALL SOFTWARE IS BECOMING OPEN SOURCE.

Not by license.

By AI 😎

NIKANDR'S APPS | YOUTUBE

🎬 Opus 5.5 can make a good motion video, but you need to know what to do with the result

In just a few prompts I made this promo for Splitsy, a fictional Telegram Mini App. No After Effects and no manual animation: the whole video is code, including the sound.

And it does its job well. In 20 seconds it explains the core idea of the app without a wall of text, and that's the real reason to have a video like this.

Will it get millions of views on TikTok? Very unlikely ⛔️ It's not that kind of video.

😏 But it's great for:
• pitching collaborations and partners
• onboarding and instructions
• ads inside Telegram
• landing pages and app previews

So it's the right tool, as long as you understand how to use what it gives you.

The prompt to make videos like this one is in the next message ⬇️

NIKANDR'S APPS | YOUTUBE

🎬 The prompt (tap to copy)

Make a 20-second motion-design promo for my product.
The whole video is code: one HTML file, one canvas, one draw(t) function.

First, ask me for:
• product name + what it does in one line
• 8–12 UI states that tell its story
• the real data in each state (names, prices, numbers, no placeholders)
• brand colors, fonts, accent color
• format: 16:9, 1:1 or 9:16

Rules
• No CSS transitions, no timers, no state carried between frames
• One shape, never cut: every state is the same card changing size, radius and color while the content swaps
• A cursor drives the story with real clicks, typing and one drag
• Solid background, no gradients
• Moving from the very first frame; last frame = first frame, so it loops

Motion
• 120 BPM grid: something happens on every beat
• Closed-form springs with a tiny overshoot; if a target changes, add one spring per change
• Content enters after its container starts morphing and leaves before the next morph
• One accent element travels between states instead of fading in
• Tab indicators stretch: each edge on its own spring
• Zoom the camera so every state fills the frame

Sound
• Synthesize everything in code: a music bed in one key with a build and a drop on the hero moment
• One sound per on-screen event, tuned to the key, panned to where it happens, following the real motion
• Duck the music under key moments; master to -14 LUFS

Export
• First render a contact sheet, one frame per beat, and fix anything cramped or broken
• Then render at 60fps with motion blur (average 6 subframes), H.264 + yuv420p, with the audio muxed in

NIKANDR'S APPS | YOUTUBE

🎰 AI CHARACTERS ARE A LOTTERY TICKET

Jean Phil is a fully AI-generated Frenchman with a blond bob and a mustache who shadowboxes in the streets of Paris. He appeared in mid-September, and within two weeks his videos had more than 75M views on Instagram alone.

🤔 What happened:

- He gained ~240K followers on Instagram and ~260K on TikTok in less than a month.
- His creator launched the $JEANPHIL memecoin, which reached a ~$12M market cap and then lost 70–90% of its value.
- According to on-chain trackers, the creator started with about $43 and earned more than $100K in pump.fun fees.

So the money here didn't come from views or brand deals. It came from turning attention into a token.

☝️ Higgsfield's role:

Higgsfield launched an AI Influencer tool and then posted that "every viral AI influencer was made on Higgsfield", crediting JeanPhilMadame.

Some people think this was planned marketing:

seed the characters -> let people argue whether they're real -> show everyone how to make their own

Higgsfield hasn't confirmed that, but either way it worked as a showcase for the tool. The company says it's now at a $1B revenue run rate.

💃 The copycats:

- Archibald Brown, an English "rival" who challenges Jean Phil to a fight, now has ~130K Instagram followers. His $ARCHIBROWN token went above $1M and fell to about $125K two days later.
- Derek Mercer, a long-haired gym character, grew from about 1K to ~60K Instagram followers in two weeks. One of his videos got 29.7M plays.
- X filled up with threads promising that the laziest person can make $10K/month with an AI character.

💡 My take:

AI characters work more like a lottery ticket than a business plan. The ticket is cheap now: anyone can make a character in an evening with tools like Higgsfield. But for every Jean Phil there are many characters nobody watches, and even the winners can't repeat their hits on demand. In early October, Derek Mercer's newest post got about 120K plays, compared with 29.7M on his best one.

The people who earn reliably here are the ones selling the tickets: the tool makers and the course sellers. If you want to try, do it because it's fun and cheap to test, and don't build your plans around becoming the next Jean Phil.

NIKANDR'S APPS | YOUTUBE