Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
Windows Tipps & SecurityMazda CX-5 im Test: Familien-SUV mit guten Fahreigenschaften(21.09.2026 um 15:30 Uhr)
Unix & Linux ServerSecurity: Mehrere Probleme in pcre2 (SUSE)(21.09.2026 um 16:22 Uhr)
Unix & Linux ServerSecurity: Überschreiben von Dateien in abrt (Red Hat)(21.09.2026 um 16:22 Uhr)
Unix & Linux ServerSecurity: Zwei Probleme in libvirt (Red Hat)(21.09.2026 um 16:22 Uhr)
Windows Tipps & SecurityMazda CX-5 im Test: Familien-SUV mit guten Fahreigenschaften(21.09.2026 um 15:30 Uhr)
Unix & Linux ServerSecurity: Mehrere Probleme in pcre2 (SUSE)(21.09.2026 um 16:22 Uhr)
Unix & Linux ServerSecurity: Überschreiben von Dateien in abrt (Red Hat)(21.09.2026 um 16:22 Uhr)
Unix & Linux ServerSecurity: Zwei Probleme in libvirt (Red Hat)(21.09.2026 um 16:22 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

I Built an AI App That Gives You Superpowers, But Makes Them Useless

This is a submission for the DEV April Fools Challenge What I built I built a full-stack AI app that gives you the superpower you ask for, then ruins it with one tiny condition. You open the site. You rub a magical…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

This is a submission for the DEV April Fools Challenge







What I built



Screens



I built a full-stack AI app that gives you the superpower you ask for, then ruins it with one tiny condition.




  1. You open the site.

  2. You rub a magical lamp.

  3. A genie shows up.

  4. You make a wish.

  5. The app grants it in a way that makes the whole thing basically useless.








  • You can become invisible, but only your internal organs.

  • You can shape-shift, but only into a slightly uglier version of yourself.

  • You can hear other people's thoughts, but only in extinct languages.



So yes, it works.



It just works toward a completely worthless outcome.



Genie



The idea was simple. I wanted to interpret "useless" a little sideways.



Instead of making something broken, I made something polished whose output is useless on purpose.



The app does what it says. The infrastructure is real. The end result is still nonsense.



So I did not build a useless app.


I built an app that mass-produces uselessness.



And because I apparently cannot leave a joke alone once it starts working, I also over-engineered it.





Demo



GIF Demo





Code



The repo includes the app code, infra setup, docs, ADRs, API design, tests, and enough delivery process to make the whole thing feel weirdly official.










Cursed Powers



MIT License
PRs Welcome
HTCPCP Compliant
Terraform
ADRs



Every superpower has a catch™



Cursed Powers is a full-stack web application that combines AI with interactive storytelling. Users rub a magic lamp to summon a genie, make a superpower wish, and receive a hilariously cursed interpretation of their wish powered by AI.


The engineering is production-grade. The usefulness is thoroughly cursed.



Features





  • Interactive Lamp Experience: Animated lamp-rubbing interface that triggers genie summoning


  • Dual AI Providers: Fallback-capable integration with Google Gemini 2.5 Flash and OpenAI GPT-4o-mini


  • Security-First Backend: Rate limiting, abuse detection, request signing, CAPTCHA verification, and content moderation


  • Real-Time Results: WebSocket-ready architecture with progressive result streaming


  • Enterprise Deployment: Production-ready infrastructure with AWS ECS Fargate, CloudFront CDN, WAF, and automated scaling


  • Comprehensive Testing: 192 unit tests (100% API coverage) + 14 E2E browser tests


  • Type-Safe: 100% TypeScript with strict mode across frontend and backend



Architecture




                         ┌──────────────────────────────┐
│ CloudFront CDN │













How I built it



Because the infrastructure is part of the punchline, I wanted to show not just the app, but the machinery behind it.



This project only works as a joke if the output is ridiculous and the implementation is treated with an unreasonable amount of seriousness.






Architecture, unfortunately



Under the magical lamp and cursed wishes, this project runs on a stack that is much more serious than the idea deserves.



That is part of the joke too. This entire system exists to reliably produce unusable superpowers.




                         ┌──────────────────────────────┐
│ CloudFront CDN │
│ + WAF (4 rule groups) │
└──────────────┬───────────────┘

┌──────────────▼─────────────────┐
│ Application Load Balancer │
│ (TLS 1.3, path-based routing)│
└───────┬──────────────┬─────────┘
│ │
/api/* │ │ /*
┌─────────────▼──┐ ┌──────▼────────────┐
│ ECS Fargate │ │ ECS Fargate │
│ Fastify API │ │ Next.js Web │
│ │ │ │
│ ┌──────────┐ │ │ Security Headers │
│ │ Helmet │ │ │ HSTS, CSP, etc. │
│ │ Rate Lim │ │ └───────────────────┘
│ │ Circuit │ │
│ │ Breakers │ │
│ └──────────┘ │
└───────┬────────┘

┌────────────▼────────────┐
│ EFS (Encrypted) │
│ SQLite + WAL mode │
│ Daily backups │
└─────────────────────────┘

┌──────────────┼──────────────┐
│ │ │
┌─────▼─────┐ ┌─────▼─────┐ ┌─────▼──────┐
│ Gemini │ │ OpenAI │ │ OpenAI │
│ 2.5 Flash│ │ GPT-4o │ │ Moderation│
│ (primary) │ │ (backup) │ │ API │
└───────────┘ └───────────┘ └────────────┘






If someone only looked at the infrastructure, they might assume it powers something financially important.



It does not.



It powers a genie that grants wishes badly.






Frontend



On the surface, the app needed to feel magical before it felt stupid.



The frontend uses:




  • Next.js 15

  • React

  • Tailwind CSS v4

  • Framer Motion



I did not want this to feel like a generic AI textbox with a lamp pasted on top. I wanted it to feel a little ceremonial: arrive, rub the lamp, summon the genie, make a wish, then wait for the system to ruin it with confidence.



So the frontend is responsible for the parts that make the joke land:




  • lamp animation

  • genie reveal

  • wish input flow

  • result rendering

  • validation

  • API integration

  • request handling

  • enough theatricality to make the whole thing feel intentional






Backend



Once the frontend sets the mood, the backend does the deeply unserious serious work.



The backend uses:




  • Fastify 5

  • Drizzle ORM

  • SQLite

  • Zod

  • Pino

  • Helmet

  • @fastify/rate-limit

  • Cloudflare Turnstile verification



It handles:




  • wish submission and validation

  • AI orchestration

  • cursed power generation

  • result retrieval

  • gallery and random wish endpoints

  • health checks

  • moderation

  • rate limiting

  • request validation

  • diagnostics



Honestly, the backend is more serious than the premise deserves.



That was deliberate.



If the output is nonsense, the system producing that nonsense should still be solid.






Google AI / Gemini usage



At the center of all this is the actual wish-ruining engine.



Gemini is the main model behind the app.



I used:





  • Google Gemini 2.5 Flash as the primary model


  • OpenAI GPT-4o-mini as the fallback provider


  • OpenAI Moderation in the safety pipeline



The AI flow is not just "say something random and funny." It follows a simple structure:



wish → interpret → curse → return a technically valid but practically useless power



That constraint helped a lot. The outputs became more consistent, easier to read, and usually much funnier.



The genie is not denying your wish.


The genie is honoring it as maliciously as possible.






Ridiculous over-engineering, on purpose



At this point, the second joke becomes obvious:



the implementation is wildly disproportionate to the value of the product.



So naturally, this cursed superpower generator includes:




  • npm workspaces + Turborepo

  • a shared type-safe schema package

  • OpenAPI 3.1

  • 9 architecture decision records

  • Terraform-managed AWS infrastructure

  • CloudFront CDN

  • AWS WAF

  • an Application Load Balancer with TLS 1.3


  • ECS Fargate for both web and API

  • encrypted EFS-backed SQLite in WAL mode

  • multi-stage Dockerfiles


  • docker-compose for local development


  • CI with typecheck, lint, unit tests, E2E tests, and commitlint

  • a tag-triggered release pipeline


  • Husky pre-commit, commit-msg, and pre-push hooks


  • Conventional Commits enforcement

  • a deep health check endpoint

  • a runbook

  • an incident response guide

  • a service level agreement

  • HTCPCP compliance



A lot of joke projects stop at the concept.



I wanted this one to keep going until the engineering itself became part of the punchline.



Did I mention it also has 100% unit test coverage?



Unit Test






Security, because apparently even cursed wishes need governance



And since I was already making terrible but committed decisions, I also spent real time on security.



That includes:




  • CloudFront + AWS WAF


  • Helmet security headers

  • rate limiting


  • Cloudflare Turnstile CAPTCHA support


  • Zod schema validation

  • AI provider circuit breakers

  • content moderation


  • CORS configuration

  • proxy awareness for real client IP handling

  • vulnerability reporting documentation

  • dependency monitoring through CI and GitHub alerts



Is this more security planning than most genie interactions require?


Yes.



Was I going to stop because of that?


Obviously not.






Teapot compliance



Is 418 and teapot a super power?






Prize category



I would like to be considered for:




  • Best Google AI Usage

  • Best Ode to Larry Masinter

  • the main DEV April Fools Challenge






This app is not useless because it is broken.



It is useless because it is very good at producing unusable results.



That is the whole bit.



Some people use software to solve meaningful problems.



I used software to build a scalable platform for granting wishes badly.



The system is stable.


The infrastructure is serious.


The output is useless.



That is exactly what I set out to build.

Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten I Built an AI App That Gives You Superpowers, But Makes Them Useless

Thematisch verwandte Begriffe: Built, That, Gives, Superpowers · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-94216 | A vulnerability was determined in ST Engineering iDirect Evolution and V…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick