🥚 I just vibe-coded the egg game from "I Think You Should Leave" and plugged it into my Telegram Mini App in 5 minutes

Saw the Feed Eggs bit from Tim Robinson's show, thought it was hilarious, and decided to turn it into a playable game inside my Telegram app.

Here's what I did:
- Asked AI to convert the HTML game into a React component
- Made sure it matches the existing game interface (sessionId, userId, onGameEnd callback)
- Swapped one file. Done.

Everything else kept working instantly:
→ TON & Telegram Stars payments
→ Referral system
→ Daily bonuses
→ Leaderboard
→ Anti-cheat & rate limiting

No backend changes. No config tweaks. No debugging. One file swap and the entire app now runs a completely different game.

That's not a hack - that's clean architecture doing its job.

Whether you want a Suika-style merge game, a clicker, a puzzle, or a ridiculous egg-feeding simulator from a sketch comedy show - the codebase doesn't care. Build your game, call onGameEnd(points), and everything else handles itself.

🍆You can play this Egg Game now → https://t.me/ViralTgGameBot/app

Full source code → https://nikandr.com/en/product/viral-telegram-app-mastery/preview

NIKANDR'S APPS | YOUTUBE

👔 I just built a Doodle Jump clone with Trump and plugged it into my Telegram Mini App

Took an open-source Doodle Jump game, asked AI to turn it into a React component, and swapped one file. Done.

And here's the thing - this plug-in game architecture is a goldmine for anyone who wants to capitalize on trending events. Trump does something wild? Swap in a Trump game. World Cup starts? Soccer clicker. New meme blows up? Build a game around it in an hour and plug it in. Your payments, referrals, leaderboard, and anti-cheat keep running like nothing changed.

One file swap. Same story as before:
→ TON & Telegram Stars payments
→ Referral system
→ Daily bonuses
→ Leaderboard
→ Anti-cheat & rate limiting

All untouched. All still working.

Three games now live in the same codebase - Suika merge game, Feed Eggs, and Trump Jump. Switching between them is one line change in one file. The game component just receives sessionId, userId, and calls onGameEnd(points). The backend doesn't know or care what game is running.

That's three completely different game genres - physics puzzle, clicker, and platformer - running on the same payments, referrals, and anti-cheat system without a single backend change.

👾 You can play this game now → https://t.me/ViralTgGameBot/app

Full source code → https://nikandr.com/en/product/viral-telegram-app-mastery/preview

NIKANDR'S APPS | YOUTUBE

🙄 Your landing page SUCKS if it doesn't have physics

In the AI era, anyone can generate a stunning landing page in minutes. Which means "stunning" is now the baseline - not the differentiator.

To actually stand out you need something people want to TOUCH.

So I built a landing page with a real-time cloth physics simulation - a security scan report you can grab, drag, and crumple. WebGL, Verlet integration, 1,250 particles, 15 constraint iterations per frame. All in a single HTML file.

The receipt isn't decoration. It IS the hook. People stop scrolling when something moves like it belongs in the real world.

Here's what powers it:
→ Canvas 2D generates the receipt texture
→ WebGL renders a 25×50 particle mesh
→ Verlet physics with structural, shear & bending constraints
→ Pointer raycasting for grab interaction
→ Wind simulation for subtle idle motion
→ Transparent compositing so it floats over the page

The whole landing page is ~400 lines of CSS + ~300 lines of JS. Zero dependencies. No Three.js. No libraries. Just raw WebGL.

I published the full code on CodePen: https://codepen.io/Nikandr-Surkov/pen/GgjjMNJ

Steal it. Fork it. Put physics in your landing page.

Your competitors won't.

NIKANDR'S APPS | YOUTUBE

⛔️ Nobody remembers a landing page they scrolled through

I put an entire SaaS landing page inside a macOS desktop simulation.

Each section opens as a draggable window from the dock. Boot screen, traffic lights, minimize, maximize, resize, terminal with easter eggs - all working.

No one scrolls past this. They play with it.

Single HTML file. No frameworks.

CodePen: https://codepen.io/editor/Nikandr-Surkov/pen/019cd880-4938-7aee-b77b-67f5cc108cc8

NIKANDR'S APPS | YOUTUBE

🤯 What if your landing page had liquid glass floating over it?

Metaball droplets with real physics — they merge, split, refract the text underneath, and respond to your cursor.

WebGL shader with Fresnel, chromatic aberration, soft shadows. Canvas 2D texture underneath. One HTML file.

Drag them around. Click to spawn more. Watch two droplets merge into one.

CodePen: https://codepen.io/editor/Nikandr-Surkov/pen/019cddc3-76f7-70a7-821c-3eec39238918

Landing pages should feel alive.

NIKANDR'S APPS | YOUTUBE

😮 I Ran a 3B AI Model in JavaScript — No Cloud, No Python, Just WebGPU

Something is shifting in AI and most people are missing it.

While everyone is focused on bigger models and more expensive GPU clusters, Microsoft went the opposite direction. They released BitNet b1.58 — an LLM where every weight is just -1, 0, or +1. Not compressed from a full-precision model. Trained from scratch with ternary weights baked into the architecture. The result: 0.4GB of memory instead of the usual 1.4–4.8GB, up to 6x faster inference on CPUs, and 82% lower energy consumption. Their framework can even run a 100B parameter model on a single CPU at human reading speed.

And it's not just Microsoft. TII released Falcon-Edge — their own native ternary models at 1B and 3B scale. Alibaba launched Qwen 3.5 Small, which takes a different approach with sparse MoE architecture — the 2B variant runs on an iPhone in airplane mode, no server needed. The trend is the same: serious AI leaving the cloud.

So I decided to test the limits. Could I run one of these models in the most unlikely runtime — JavaScript?

Turns out, yes. TII's Falcon-E 3B Instruct running locally via WebGPU compute shaders in Node.js. About 80 lines of code. A ~1GB model download from Hugging Face. After that — fully offline, fully private, zero cost per inference.

No Python. No CUDA. No Docker. No API key. No monthly bill.

Your documents, conversations, and data never leave your machine. That's not a feature toggle — it's the architecture.

Code: https://github.com/nikandr-surkov/bitnet-webgpu-chat.git

NIKANDR'S APPS | YOUTUBE

🦞 I made a 3D lobster walk across a landing page using only CSS

No WebGL. No canvas. No Three.js. Just divs.

24 voxel cubes, each with 6 CSS faces. Walking bob, claw snaps, antenna sway, alternating leg cycle. All keyframe animations.

color-mix() generates light/shadow faces from one color. One JS function stamps out every cube. The rest is pure CSS 3D transforms.

Full OpenClaw landing page built around it. One HTML file. Zero libraries.

CodePen: https://codepen.io/editor/Nikandr-Surkov/pen/019ce825-7c45-795e-a1bf-5edffc130ef5

CSS can do more than you think.

NIKANDR'S APPS | YOUTUBE

🚨 BREAKING: Make any AI understand an entire GitHub repo - with up to 95% fewer tokens

I built a free tool that converts any GitHub repository into a single AI-ready text file in seconds.

Just paste a repo URL → get the full file tree, source code, and a Symbol Index - all formatted for LLMs.

What is Symbol Index?

This is the killer feature. Instead of dumping raw code into OpenClaw/ChatGPT/Claude, GitExtract intelligently analyzes your code and extracts every function, class, method, constant, and type - across 15 languages.

You get a structured map of the entire codebase.

This alone can save you massive token usage. Feed the Symbol Index first → AI understands the architecture → then only feed the specific files it needs. No more pasting 200 files into context.

What you get:
📁 Directory tree
📝 Full source code (concatenated, formatted)
🧠 Symbol Index (functions, classes, methods, constants, types)
📊 Token count estimate

Supports 15 languages: Python, JavaScript, TypeScript, Go, Java, Rust, C, C++, C#, Ruby, PHP, Dart, Elixir, SQL, and TSX.

How to use:
Web UI — paste a URL at gitextract.com
JSON API — GET /api/v1/ingest?url=user/repo

No signup. No API key. No rate limit headaches (we clone repos directly, no GitHub API dependency).

It's completely free. I built this because I was tired of manually copying files into OpenClaw/Claude/ChatGPT context windows.

Try it → https://gitextract.com

NIKANDR'S APPS | YOUTUBE

⚡️ GitExtract Update: Structured JSON Export is here

You asked for it — now GitExtract returns every file as clean, structured JSON.

Instead of one massive text blob, you get this:

[
{"path": "src/app(.)py", "content": "..."},
{"path": "src/utils(.)py", "content": "..."}
]

Each file is a separate object. Your agent can loop through them, pick specific files, or process them one by one. No more parsing text walls.

Why this matters for AI agents:

Before: you had to regex-split the text dump to find individual files.
Now: just iterate over a JSON array. Every file has its path and content ready to go.

This is huge for anyone building AI pipelines, RAG systems, or coding agents that need to process repos file-by-file.

How to get it:

API → GET /api/v1/ingest?url=user/repo&include_json=true
Web → new "Structured JSON" tab on every result page
Download → one click, get the full .json file

Still free. Still no signup. Still no API key.

Try it → https://gitextract.com

NIKANDR'S APPS | YOUTUBE

😰 I canceled my ChatGPT subscription

I still generate images, more than ever. I just stopped paying $20/month for them.

GPT Image 2 (released April 21) runs on every ChatGPT plan AND in the OpenAI API. Same model, two ways to access it.

What $20/month for ChatGPT Plus buys you:
- ~50 image prompts per 3-hour rolling window
- Each image counts against the same 160-message cap as your text chats
- "Thinking mode": slower planning pipeline, Plus-only, genuinely useful for layout-heavy work
- The full bill, even on months you barely use it

What I built instead: a Telegram Mini App on top of GPT Image 2 (via Replicate or your own OpenAI key). Pay-per-image, the same per-image rate OpenAI bills the API:

- Low, 1:1 → $0.006 ($20 = ~3,300 images)
- Medium, 1:1 → $0.053 ($20 = ~370 images)
- High, 1:1 → $0.211 ($20 = ~95 images)

To even hit $20 here you'd have to burn through ~370 medium-quality images in a month. I rarely cross 50. No daily caps, no 3-hour throttling, no peak-time slowdowns, no message budget shared with text chats.

And the controls are nicer than ChatGPT's:
- Aspect ratio picker, quality picker with live $/image before you click
- Up to 8 reference images for image-to-image, addressed in the prompt as ref1...refN for style mixing, character continuity, edits
- Reusable prompt presets, synced across devices via Telegram CloudStorage
- Every result auto-archived to your bot chat. Full restore via "Use prompt"
- Owner-locked via HMAC + your Telegram user id, safe to host publicly

Open-source, self-hosted. Bring your own Replicate or OpenAI key.

Repo → https://github.com/nikandr-surkov/gpt-image-2-telegram-mini-app

NIKANDR'S APPS | YOUTUBE

🪙 Tolk NFT Blueprint released

A complete, production-ready NFT implementation on TON, written entirely in the new Tolk language.

This is what I wish I'd had when I started learning Tolk: a clone-and-ship reference repo, not another half-finished demo.

What's inside:

- NFT Collection + Item contracts in Tolk 1.2
- TypeScript wrappers with every Tolk quirk handled (address?, RemainingBitsAndRefs, dict encoding)
- 9 Sandbox + Jest tests - deploy, mint, batch, transfer, admin
- Blueprint scripts - TonConnect & mnemonic deploy / mint
- Pinata IPFS metadata recipe with the chicken-and-egg CID workaround
- TEP-62 / TEP-64 / TEP-66 compliant
- Verified on TON mainnet (deployed live)

➡️ Repo: github.com/nikandr-surkov/tolk-nft-blueprint

If it saves you time - drop a ⭐️ on GitHub.

NIKANDR'S APPS | YOUTUBE

💱 Toncoin is now Gram

Pavel Durov announced the rebrand on June 1, reviving the original 2018 name from Telegram's first whitepaper. The transition runs ~3 weeks, with no token swap required.

What changes for builders:

🏷 Token ticker: TON → GRAM. UI labels, payment displays, and exchange listings will roll over during the transition window.
🔗 The TON blockchain name stays the same. Contracts, addresses, RPC endpoints, SDKs — unchanged. This is a token-label change, not a chain migration.
⚡️ Telegram has also taken over as the network's largest validator (~2.2M staked) and cut fees roughly 6x. Cheaper on-chain ops for anyone routing payments or NFT mints through a mini app.

Action item this week: grep your mini app and bot UI for "Toncoin" and ticker references, and plan a copy swap to "Gram" / "GRAM" over the next few weeks. The chain stays TON; only the token name moves.

NIKANDR'S APPS | YOUTUBE

🧠 Claude Fable 5 is here

Anthropic released Claude Fable 5 yesterday - the first publicly available model from the new Mythos tier that sits above Opus. It's positioned for long-running, autonomous coding sessions where previous models lost the thread.

What stands out:

🟢 80.3% on SWE-Bench Pro (Opus 4.8: 69.2%, GPT-5.5: 58.6%, Gemini 3.1 Pro: 54.2%). On Cognition's FrontierCode it hits 29.3% vs Opus 4.8 at 13.4%.
🟢 Built for end-to-end work: planning, tool use, multi-hour runs, self-repair. Better than Sonnet or Opus at owning a whole feature from a single prompt.
🟢 $10/M input, $50/M output. Free in Claude apps until June 22, then paid usage credits.
🟢 Has cybersec/biology guardrails that route some requests to Opus 4.8 instead.

For us building Telegram bots and TON mini apps, the practical upshot: Fable 5 is now the strongest model for refactors, security audits, and "go through my whole repo and fix X" work. Next post: a ready-to-use prompt to audit your project with it.

NIKANDR'S APPS | YOUTUBE

🔍 Audit any project with Fable 5

A drop-in prompt that points Fable 5 at any repo - Telegram bot, TON contract, React app, Go API - makes it identify the stack first, derive the right best-practice checklist for what it found, and web-search the latest guidance when its training might be stale.

You are a senior code reviewer and security engineer auditing this codebase end-to-end. Work through four phases.

Before you start: if a CLAUDE.md, AGENTS.md, or README at the repo root exists, read it. It tells you what the project is and which conventions matter.

# Phase 1 — Map the project
Identify and summarize:
- Languages and framework versions (read manifests: package.json, pyproject.toml, go.mod, Cargo.toml, build.gradle, *.csproj, etc.)
- Build tools, package managers, runtime targets
- Architecture: entry points, layers, external services, data stores, queues, blockchains
- Auth and trust boundaries — who calls what, with what credentials
- Deployment target (cloud, container, edge, on-device, on-chain)

If you spot a stack component whose best practices may have shifted since your training, look up the current "<stack> best practices 2026" and "<stack> common vulnerabilities" before continuing.

# Phase 2 — Derive the checklist
For the stack you found, derive a stack-specific checklist covering:
- Security: input validation, auth, secrets, injection, SSRF, deserialization — the OWASP/ASVS items that actually apply
- Correctness: error handling, concurrency, race conditions, time/locale, off-by-one, unhandled states
- Performance: N+1 queries, missing indexes, unbounded loops, sync-in-async, memory leaks
- Reliability: retries with backoff, idempotency, timeouts, circuit breakers, graceful shutdown
- Maintainability: dead code, duplicated logic that hurts maintenance, type-safety gaps, missing tests on risky paths
- Supply chain: pinned versions and dependencies with known CVEs — run the appropriate audit command for the ecosystem, then verify any old-looking package against the advisory database
- Stack-specific traps — pull from your own knowledge plus the latest guidance from the web for "<framework> security pitfalls" if your knowledge isn't current

# Phase 3 — Review
Think carefully about each finding before writing it. Work semi-formally:
- Premise: "this function reads X from Y and passes it to Z"
- Trace: the concrete path an attacker or operator can take
- Conclusion: what breaks and how confident you are

Don't invent issues. If a check passes, note it. Mark uncertain items NEEDS HUMAN REVIEW with the specific question — include any sources you consulted and what you found.

# Phase 4 — Report

For each finding:
[SEVERITY] path/file:LINE — title
What: one-sentence description
Impact: what an attacker or operator can do
Fix: concrete change (include code if short)

Severities:
- CRITICAL — funds loss, RCE, account takeover, data corruption
- HIGH — realistic exploit, data exposure, DoS
- MEDIUM — unlikely preconditions or limited impact
- LOW — defense-in-depth, hygiene, maintainability

End the report with:
1. Detected stack — one paragraph from Phase 1
2. Top 3 to fix this week — best impact-to-effort
3. Checked and clean — categories that passed
4. Sources — any URLs you consulted for current best practices

Run the whole thing in one pass.

NIKANDR'S APPS | YOUTUBE

I CAN BUILD THE BEST APP FOR YOU!... NOW ON FIVERR!

A lot of people message me on Telegram about custom Telegram Mini App development.

Some are serious. Some are just exploring. Some want a custom build but prefer paying with fiat instead of crypto.

So I’m testing Fiverr as a cleaner entry point for new projects.

It gives buyers:

🟢 clear packages
🟢 clear scope
🟢 clear delivery timelines
🟢 a familiar fiat payment flow

And it gives me a better way to filter serious requests while seeing what teams are building and experimenting with right now.

The focus is still the same:

Telegram Mini Apps, TON wallet integration, Telegram Stars payments, Web3 payments, games, referral systems, admin panels, and full-stack Next.js apps.

I’ll keep this open while I’m testing the channel, but I won’t take many custom builds at the same time.

Tell me about your project idea: https://www.fiverr.com/s/jjNkq6w

NIKANDR'S APPS | YOUTUBE

💪 I made something I'm genuinely proud of!

A while back I started building a deep cybersecurity course - honestly, just for myself, my team, and a few friends. I wanted one place that explained how security actually works at the level the biggest companies operate at: not surface-level tips, but the real architectures and the real breaches behind them.

It took me a huge amount of time. And once it was done, it felt wrong to keep it locked away. So I decided to open it up to everyone.

The first part is free on YouTube ⬇️ A full 2-hour course on how the internet really works - and how hackers exploit every layer of it (networking, DNS, TLS, the whole attack surface):
➡️ https://www.youtube.com/watch?v=2ppV7rpv2XY

The premium series lives on my site - 3 in-depth videos (~5.7 hours) on how Google, Apple, Microsoft, and Cloudflare defend billions of users: Zero Trust, passkeys, privacy engineering, threat detection, AI security, and the software supply chain.

Here's why I think this matters right now: in the AI era, almost anyone can get AI to write the code. That part is being commoditized fast. What AI can't hand you is the deep understanding of how these systems break and how they're defended - the judgment to look at a system and see where it fails. That knowledge is what stays valuable when everything else gets automated. This course is built to give you exactly that.

🎁 It's currently 50% off - $49 instead of $99, lifetime access
https://nikandr.com/cybersecurity

If you watch the free one and it clicks for you, the premium series is the natural next step 🙌

NIKANDR'S APPS | YOUTUBE

🗝 Just dropped a new free video - 2+ hours, and I really think it's the best thing out there right now on how login actually works (and why passwords are dying).

This is part 2 of my free cybersecurity series. The first was how the internet works under the hood. This one goes straight for the front door of your whole digital life: authentication.

It kicks off with the MGM hack - a casino empire shut down for days, ~$100M gone, and it didn't take some genius exploit. It took one phone call to the help desk. That's the whole shift right there: attackers don't break in anymore. They just log in.

From there I take you through everything, from zero, no experience needed:

- how passwords are really stored and cracked
- why the password rules you were taught are actually wrong now
- MFA, and why some of it is way weaker than you think
- where your fingerprint actually goes
- passkeys - the thing finally killing the password
- how "Sign in with Google", sessions, cookies and SSO work
- and how today's attackers (deepfakes included) walk right past all of it

➡️ Watch it free: https://www.youtube.com/watch?v=QsTEJgiuLZk

My take hasn't changed: in the AI era anyone can get a model to write code. The part that stays valuable is actually understanding how this stuff breaks and how it's defended. That's what I'm trying to give you here.

🎁 And if you want the deep end - how Google, Apple, Microsoft & Cloudflare defend billions of identities, real architectures, real breach breakdowns - the premium course is still 50% off ($49), lifetime access:
https://nikandr.com/cybersecurity

NIKANDR'S APPS | YOUTUBE