DEV Community: Aliza Ali

5 Ways Your Photos Still Leak Your Location (Even Though Social Media Strips It)

Aliza Ali — Sun, 01 Nov 2026 01:28:23 +0000

"Don't worry, social media strips the location from photos."

That's mostly true for the big platforms. Instagram, Facebook and X re-encode your upload, and the metadata usually gets thrown away along the way. But that's a side effect of their pipeline, not a privacy feature, and it only covers those apps.

Every time a photo leaves your phone some other way, the original file goes with it: GPS coordinates, device model, timestamps, sometimes even your camera's serial number. Here are five everyday ways that happens.

1. "Send as file" in chat apps

Sending a photo normally in WhatsApp or Telegram compresses it, which generally drops the metadata. But choosing "send as document" or "send as file" to keep the quality sends the original, untouched, location included.

People do this constantly for exactly the photos that matter: house listings, ID-adjacent documents, full-resolution shots for a buyer.

2. Email attachments

Email doesn't re-encode anything. Attach a photo from your gallery, and the recipient gets every byte of the original. That includes the exact spot where you were standing when you took it.

3. Cloud share links

Google Drive, Dropbox and OneDrive links serve the original file. Share a folder of photos from your house, your kid's school event or a trip, and anyone with the link can download them with full EXIF intact.

4. Device-to-device sharing

Nearby sharing (Quick Share on Android, AirDrop on iPhone) transfers the original file. AirDrop has an Options toggle in the share sheet to leave the location out, but almost nobody knows it's there.

5. Marketplaces and forums

Some sites re-encode uploads and some don't, and you can't tell from the outside. Selling a sofa? The photo you took in your living room may carry your living room's coordinates.

How to check your own photos (Android)

Open any photo in Google Photos and swipe up. If you see a map, that location is stored in the file and goes wherever the original goes.

Stop new photos from being tagged

Most camera apps let you turn off location tagging:

Pixel Camera: Settings → Save location
Samsung Camera: Settings → Location tags

That protects photos you take from now on. It does nothing for the hundreds already in your gallery.

Clean the ones you already have

That's the gap I built Drop Metadata for Android to fill. Pick a photo or video, and it shows you everything hidden inside, with the GPS location plotted on a map, before anything changes. Then you choose what goes: drop the location but keep the date, clear the camera details, or wipe everything in one tap.

100% on-device: no server, no account, and it works fully offline
Photos and videos: JPEG, PNG, MP4 and MOV
No quality loss: pixels and video frames are copied byte for byte, so nothing is re-encoded

👉 Get Drop Metadata on Google Play

Not on Android? The same engine runs in your browser at dropmetadata.com. I wrote about how it works without uploading anything here.

I'd love your help testing it

The app is new, and real devices find bugs that emulators never will. If you try it, drop a comment with:

Your phone model
What the app found in a photo straight from your camera
Anything that looked wrong, missing or confusing

And if you know another sneaky way photos leak location, share it below. I'll add it to the list.

Your Photos Are Telling On You: I Built a Metadata Remover That Never Uploads Your Files

Aliza Ali — Sat, 31 Oct 2026 12:45:05 +0000

Every photo you take on a phone carries a small dossier inside the file: the exact GPS coordinates where you stood, the device that took it, the software version, the capture time, and sometimes even the camera's serial number. Most people never see any of it, because image viewers don't show it. But anyone you send the original file to can read it in seconds.

That's why I built Drop Metadata, a free tool that strips hidden metadata from photos and videos without ever uploading them.

What's actually hiding in your files

Here's the kind of thing a single phone photo can reveal:

Field	Example
GPS	37.774887, −122.419388
Device	iPhone 15 Pro
Software	iOS 17.2
Captured	2026-01-15 10:30:00
Serial	Camera / lens serial number
C2PA	AI provenance manifest

Post that photo of your new desk setup or your kid's first day of school, and you may have shared your home address along with it.

Drop Metadata removes all of it: GPS coordinates, camera make and model, capture software, timestamps, author and copyright fields, camera and lens serial numbers, XMP editing history, and C2PA content credentials.

Why "no upload" was non-negotiable

Most free "metadata remover" sites work by uploading your file to their server, cleaning it there, and sending it back. That means the very file you're trying to protect, GPS location and all, gets handed to a stranger first.

So the core rule for Drop Metadata was simple: the file never leaves your device.

The file is read straight from disk into browser memory. No network request is made.
Every embedded field is listed by category before anything is removed, so nothing is stripped blindly.
The clean file is rebuilt locally and downloaded straight back to you.

No upload, no account, no server, no copy of your file anywhere. A nice side effect: it's instant, because there's no upload or download round trip.

Zero quality loss

A lot of tools "remove" metadata by re-encoding the whole image, which quietly degrades quality every time. Drop Metadata doesn't touch the pixels.

Metadata lives in its own containers, separate from the image or video data: EXIF and XMP segments in JPEGs, metadata chunks in PNGs, and metadata boxes inside MP4/MOV files. Drop Metadata rewrites only those containers and copies pixel data and video samples byte for byte. Nothing is re-encoded, so the output is visually identical.

It works on video too

Video is the part people forget. Phones embed GPS and device tags inside MP4 and MOV containers as well. Drop Metadata cleans them at the container level, so location and device tags are stripped without re-encoding a single frame, and the file size stays effectively identical.

Supported formats: JPG, PNG, MP4, MOV, any size.

📱 Get the Android app

Most of the photos worth worrying about never touch a laptop. They go straight from your camera roll to a marketplace listing, an email attachment or a "send as file" chat. So I built Drop Metadata for Android to clean them right where they live.

See before you strip. The app lists every field it finds by category, and plots the photo's GPS location on a map, before anything changes.
You choose what goes. Each category has its own switch. Remove the location but keep the date, clear the camera details but keep your copyright, or wipe everything in one tap.
Photos and videos. JPEG, PNG, MP4 and MOV. Video is cleaned at the container level, so no frame is re-encoded.
Fully offline. No server, no account, no sign-up, and it works with no internet connection at all. The Play Store data-safety label says no data collected and none shared.
No quality loss. Pixels and video frames are copied byte for byte, and photo orientation is preserved, so portrait shots stay upright.

A quick reality check on "but social media strips metadata anyway": the big platforms usually do, as a side effect of re-encoding. Email, messaging apps sending files, cloud links, marketplaces and forums usually don't. Cleaning the file before it leaves your phone is the only reliable approach.

👉 Download Drop Metadata on Google Play

🙋 I'm looking for Android testers

The app is brand new, and I'd really appreciate real-world feedback. If you have a few minutes:

Install it and open a photo straight from your camera.
Tell me in the comments which fields it found, and whether anything looked wrong or missing.
Try a video too, and let me know your phone model if anything breaks.

Bug reports are just as welcome as praise.

Try it

👉 dropmetadata.com: drop in a photo and see what it's been saying about you.

I'd love feedback from the DEV community, especially on formats you'd like supported next, or metadata fields you've seen leak that I should check for. Drop a comment below!

SOLSTICE — feed the light, hold back the night (an ode to Alan Turing)

Aliza Ali — Sun, 21 Jun 2026 10:28:05 +0000

This is a submission for the June Solstice Game Jam

What I Built

SOLSTICE is a juicy, single-file browser arcade game about the longest day of the year — and a tribute to Alan Turing, born in June, the man who turned the longest nights of a war toward dawn.

You are a spark of light. Move with your mouse (or finger) and the whole world responds: the sky shifts from blazing noon to deep night, the sun rises and sets with your daylight, particles burst and the music speeds up as the danger climbs.

🌗 Daylight is your health. Gather the sun's motes to keep it burning; touch a shadow and the night creeps in. Let it hit zero and the screen pulses red as night falls.
🌀 The Solstice Turn. At the midpoint the world flips — the longest day becomes the longest night (exactly the prompt's "longest day for half the world, shortest for the other"). The sky goes cold, the sun becomes a moon, and light becomes precious.
🌑 Two bosses. The Longest Night at day 10, and the bigger, faster, bullet-spitting Eclipse King at day 20 — each with a phase-2 rage mode and a codebreaking finisher.
☄ Power-ups & a stockpile-able Nova. Time Warp, Light Magnet, Freeze, Sun Fragment — plus the Sun Nova you can bank ×3 and unleash to wipe the screen.

It connects to the theme on every axis: the solstice (longest day, the Turn), light vs. dark as the core mechanic, and Alan Turing woven into the story and the boss fights.

▶ Play it live: https://stackmasteraliza.github.io/solstice-cipher/

stackmasteraliza.github.io

Video Demo

▶ Watch the demo: https://youtu.be/n6lRqo1CBSo

Code

The whole game is one index.html — no build step, no dependencies, no external assets.

stackmasteraliza / solstice-cipher

SOLSTICE — feed the light, hold back the night. A 20-level arcade game for the June Solstice Game Jam, an ode to Alan Turing.

☀ SOLSTICE

feed the light · hold back the night

A juicy 20-level arcade game for the June Solstice Game Jam — and an ode to Alan Turing.

The longest day of the year, and the dark wants it back. Glide your light, gather the sun's motes, grab power-ups, survive the Solstice Turn, and break two beasts of night.

▶ Play it live · 🎬 Watch the demo · Power-ups · How it's built

✨ Why it's fun

You are a spark of light. Move with the mouse (or your finger) and the whole screen responds — the sky shifts from blazing noon to deep night, the sun rises and sets with your daylight, particles burst, combos chime, and the music speeds up as the danger climbs.

🌗 The light is the game. Daylight is your health bar. Gather motes to keep it burning; touch a shadow and the night…

View on GitHub

How I Built It

Plain HTML5 Canvas + vanilla JavaScript. A few decisions I'm happy with:

One variable drives the whole atmosphere. The sky, the sun's arc, the glow and the star field are all tied to a single value (--night, 0 = blazing noon → 1 = full dark). The game loop just sets it from your remaining daylight and everything follows — the sun literally sinks as you run out of light.
All audio is synthesized live with the Web Audio API — no sound files. There's a kick/hi-hat/bass beat track that speeds up every level, a separate furious minor-key boss track, win/lose stingers, and reactive SFX whose pitch rises with your combo.
20 levels, two bosses, a power-up economy, and four enemy types (normal, fast darters, heavy tanks, and splitters that break in two) — all from a compact entity loop.
Honest Mastermind scoring for the Turing finisher, with correct duplicate-glyph handling (the classic trap), unit-tested against the tricky cases.
Onboarding built in: a guided practice with tooltips the first run, and a boss briefing before each beast, so a new player (or a judge) is taught every mechanic right before they need it.
Accessible & portable: fully keyboard + touch playable; colour and shape pairing for enemies; runs from a single file anywhere.

Prize Category

🎯 Best Ode to Alan Turing.

June is Turing's birth month, so the game is built around the thing he's famous for — code-breaking and the triumph of logic over darkness:

Mechanic: each boss can't just be hit to death. At zero HP it's exposed, and Turing's Bombe reveals a cipher — you "Decode the Dawn" by repeating the sequence to break the night for good. Code-breaking is the finishing move.
Narrative: between-level "transmissions" trace his arc — Bletchley, the Enigma, his persecution for who he loved, "never granted his own daylight." The win screen, DAWN, is a tribute: "For Alan Turing (1912–1954) — who broke the world's hardest cipher and was never allowed his own daylight."
Design: the Enigma rotor motif and the light-vs-shadow (1s and 0s) framing run throughout.

Not submitting to Best Google AI Usage — no Google AI is used in this build.

Thanks for running the jam — happy solstice! ☀

My 'Incident-to-PR Autopilot' Never Actually Opened the PR. I Finally Finished It.

Aliza Ali — Sun, 07 Jun 2026 18:48:00 +0000

This is a submission for the GitHub Finish-Up-A-Thon Challenge

What I Built

FixForward — an incident-to-PR autopilot powered by GitHub Copilot CLI. One command turns a failing test suite into a verified, ready-to-merge pull request: it detects the failures, classifies them, asks GitHub Copilot for a minimal fix, applies it on a safe branch, re-runs the tests to prove the fix works, and opens a labelled PR — locally or automatically in CI.

It started life as my submission to an earlier GitHub Copilot CLI challenge. It placed well… and then I left it one step short. The tool literally had "PR" in its name, but it stopped at printing a PR description and made you git push and gh pr create by hand. I got busy, and that last mile sat unfinished for months.

This challenge was the push to finally land the plane. FixForward is the tool I actually want sitting in my repos: when a build breaks, a fix PR should just appear.

pip install fixforward

Demo

Diagnosis — FixForward detects the failing tests and classifies them:

Outcome — Copilot's fix, verified green, opened as a labelled PR automatically:

🎥 Watch it open a real PR, live:

And here's the pull request FixForward opened on a clean demo repo — Copilot's fix, the before/after verification table, and the high-confidence label, all generated automatically:

Try it yourself:

# locally: fix a broken build AND open the PR
fixforward run --open-pr --min-confidence 0.7

# in CI: end-to-end, hands-off
fixforward ship --min-confidence 0.6

The repo ships with intentionally-broken Python/Node/Rust demos so you can watch the whole loop, plus a one-click "Demo – Auto-fix a broken build" GitHub Action.

🔗 Repo: https://github.com/stackmasteraliza/fixforward
📦 PyPI: https://pypi.org/project/fixforward/

The Comeback Story

Where it was: FixForward did almost everything it promised — detect, classify, fix, verify, and even generate a polished PR title and body. Then it printed them to the terminal and stopped. The old code literally ended by telling you to finish:

# display.py (v0.1)
"[dim]Review the branch, then push and open a PR.[/]"

There were also no automated tests — ironic for a tool that auto-fixes other people's tests.

What I changed — before → after:

	v0.1 (before)	v0.2 (after)
Detect + classify failures	✅	✅
Copilot generates the fix	✅	✅
Verify tests pass	✅	✅
Write the PR description	✅	✅
Push the branch	❌ you did it	✅ automatic
Open the PR	❌ you did it	✅ `gh pr create`
Label by confidence	❌	✅ high / needs-review / low
Run in CI, hands-off	❌ laptop only	✅ GitHub Action

I gave myself one rule: finish the original promise, don't bolt on unrelated features. Everything in v0.2.0 serves one sentence — go from a red build to a ready-to-merge PR with no human in the loop.

The last mile — a new shipper.py. Pushes the fixforward/auto-* branch and opens the PR via gh pr create, reusing the title/body the tool already generated. The thing the name always promised.
Trust, made explicit. The confidence score was computed but never used. Now every PR is labelled high-confidence / needs-review / low-confidence, --min-confidence refuses to open a PR it doesn't trust, and --auto-merge lets high-confidence fixes squash-merge once CI is green.
Off the laptop — a GitHub Action. A composite Action so a failing build opens its own fix PR:

   - name: FixForward
     if: steps.tests.outcome == 'failure'
     uses: stackmasteraliza/fixforward@v1
     with:
       min-confidence: "0.6"
       github-token: ${{ secrets.GITHUB_TOKEN }}

The proof — tests + CI. Added a unit suite for the confidence/labelling policy and the PR-report generator, plus CI on Python 3.9 / 3.11 / 3.13.

The hard part of "almost done" isn't the missing code — it's that the last 5% is the unglamorous, failure-prone part (auth, remotes, CI permissions) that's easy to defer forever. Finishing FixForward meant treating that last mile as the whole point.

My Experience with GitHub Copilot

Two honest layers, no hand-waving.

Copilot is the engine. FixForward's fix generation is a call to gh copilot — not a wrapper claim, it's the core of copilot.py:

cmd = [
    "gh", "copilot", "--",
    "-p", prompt,                 # failure context + source files
    "--allow-all-tools",
    "--add-dir", str(project_path),
    "--silent",
]

It hands Copilot the classified failures and the relevant source and asks for the smallest change that makes the suite pass. FixForward then applies it and verifies it against real tests — so a Copilot fix only ships if it actually turns the build green.

Copilot helped me finish it, too. The fiddliest part of the last mile was the gh pr create plumbing — long markdown bodies, label creation, base/head branches, and the dozen ways it fails in CI (no remote, no auth, missing scopes) — plus making the parser robust to the agentic CLI's ANSI output and its habit of editing files directly. I worked through those edge cases with Copilot, then verified each path against real gh behaviour.

Built in Python. Fix engine powered by GitHub Copilot CLI. MIT licensed.

NotionOps AI — 4 AI Agents That Run Your Dev Workflow End-to-End

Aliza Ali — Fri, 13 Mar 2026 14:35:46 +0000

This is a submission for the Notion MCP Challenge

What I Built

NotionOps AI is an autonomous workflow engine that connects GitHub, OpenAI, and Notion into a single pipeline for software development teams.

It runs 4 specialized AI agents that automate the daily dev lifecycle:

Agent	What it does
Issue Triage	Fetches open GitHub issues, classifies priority & type with AI, creates Notion tasks
PR Review	Reviews PR diffs, scores code quality 1-10, posts GitHub comments, creates Notion approval gates
Sprint Planner	Selects top tasks from backlog, estimates story points with AI, populates Notion sprint board
Daily Report	Aggregates sprint metrics, generates standup summary, saves report to Notion

The agents chain together into a full pipeline:

GitHub Issues/PRs → OpenAI Agents → Human Review in Notion → Notion Databases

The dashboard provides real-time SSE streaming of agent activity, live stat cards, a kanban sprint board, and a full pipeline visualization.

Key design decision: The PR Review agent creates human-in-the-loop approval gates in Notion when it finds low-quality PRs (score < 6). AI never takes destructive action without human sign-off.

Screenshots

Dashboard

Pipeline Running

AI Agent Output

Tasks View	Sprint Board	Reports

Notion Integration

Tasks Database	Sprint Board	Agent Reports

Video Demo

Show us the code

stackmasteraliza / notionops-ai

Autonomous AI workflow engine — 4 Gemini-powered agents that triage GitHub issues, review PRs, plan sprints, and generate standups, all coordinated through Notion.

NotionOps AI — Software Dev Pipeline That Runs Itself 🤖

Notion MCP Challenge Submission — An autonomous AI workflow engine that closes the loop between GitHub, OpenAI, human judgment, and Notion — in real time.

What It Does

Most dev teams have a painful daily ritual: check GitHub for new issues, triage them manually, review PRs, update Notion, plan the sprint, write the standup. NotionOps AI eliminates every step of that with four specialized AI agents and a real-time neon dashboard.

GitHub Issues/PRs  →  OpenAI Agents  →  Human Review Gate  →  Notion (Tasks · Sprint · Reports)
        ↑                                           |
        └───────────── feedback loop ───────────────┘

One click. The pipeline runs itself.

Demo Video

Four AI Agents

Agent	What it does	Output
🔍 Issue Triage	Fetches all open GitHub issues, classifies each as Bug/Feature/Issue with High/Medium/Low priority	Notion task per issue + triage report
👀 PR Review	Reviews every open PR, scores code

…

View on GitHub

How I Used Notion MCP

Notion is the central coordination layer between AI agents and humans. Four databases drive the entire workflow:

1. Tasks Database
AI-triaged GitHub issues land here with structured metadata (priority, type, status, agent notes, GitHub URL). This is the single source of truth — the Sprint Planner reads from it, and humans can override AI classifications directly in Notion.

2. Approvals Database
When the PR Review agent finds a problematic PR, it creates an approval page with its recommendation. Team members review and approve/reject directly in Notion. This is the human-in-the-loop gate — downstream agents respect these decisions.

3. Sprint Database
The Sprint Planner reads pending tasks from Notion, uses AI to estimate complexity and assign Fibonacci story points, then writes selected tasks back with Backlog/In Progress/Done status tracking. The dashboard renders this as a live kanban board.

4. Reports Database
Daily standup summaries are generated from sprint data and stored as rich-text report pages. This creates an automatic paper trail of team velocity and AI-generated insights over time.

The key unlock: agents write structured data into Notion, humans make decisions in a familiar interface, and downstream agents read those decisions to continue the workflow. No context switching between GitHub, AI tools, and project management — it all flows through Notion.

Tech Stack

Runtime: Node.js + TypeScript
AI: OpenAI via OpenRouter (structured JSON outputs)
APIs: Notion API, GitHub REST API (Octokit)
Server: Express.js with Server-Sent Events
Frontend: Vanilla HTML/CSS/JS (zero framework dependencies)

About Me

I'm Aliza Ali — a developer who loves building AI-powered tools that solve real workflow problems. If you liked this project, check out my other challenge submission:

FixForward: One Command to Go from Broken Build to Ready-to-Merge PR — A CLI autopilot that detects failing tests, classifies bugs, generates fixes via GitHub Copilot CLI, and creates verified PRs. One command. Three ecosystems. Zero manual patching.

Want to know more? Visit alizaali.com

Auto-Generate Swagger Docs in Laravel — Zero Annotations, Zero Config

Aliza Ali — Wed, 18 Feb 2026 17:55:16 +0000

Writing Swagger Annotations Is Pain. What If You Didn't Have To?

Be honest — how many times have you:

Skipped API documentation because @OA\Get annotations are a nightmare?
Spent more time writing Swagger comments than actual business logic?
Shipped an API with zero docs because "we'll add them later" (you didn't)?
Manually maintained a Postman collection that's always 3 endpoints behind?

What if your Laravel app could scan your controllers, read your FormRequest rules, and generate a complete Swagger UI automatically?

No @OA\ annotations. No YAML files. No config. Just your existing code.

Introducing: Laravel API Response Builder

composer require stackmasteraliza/laravel-api-response

v4.7.0 | Laravel 10, 11 & 12 | PHP 8.1+ | MIT License
GitHub | Packagist

The all-in-one Laravel API toolkit:

Auto-generated Swagger/OpenAPI docs — no annotations
One-click export to Postman & Insomnia
Standardized JSON responses
WebSocket testing built-in
API versioning out of the box

Zero configuration required.

Installation (30 Seconds)

composer require stackmasteraliza/laravel-api-response

That's it. No config publishing. No migrations. No setup wizards.

Your Swagger docs are already live at /api-docs.

Auto-Generated Swagger Docs (The Main Event)

This is why you're here. You don't write a single @OA\ annotation.

The package scans your controllers, detects response methods like ApiResponse::success() and ApiResponse::created(), reads your FormRequest validation rules, and generates a complete OpenAPI 3.0 specification — automatically.

Visit /api-docs and you get:

Beautiful, modern Swagger UI with dark/light theme toggle
Every endpoint documented with correct HTTP methods
Request body schemas auto-generated from your FormRequest rules
Response schemas matching your actual response structure
Try-it-out functionality — test endpoints right from the browser

How It Detects Everything

// The package sees this in your controller...
public function store(StoreUserRequest $request)
{
    $user = User::create($request->validated());
    return ApiResponse::created($user, 'User created');
}

// ...reads your FormRequest rules...
class StoreUserRequest extends FormRequest
{
    public function rules(): array
    {
        return [
            'name' => 'required|string|max:255',
            'email' => 'required|email|unique:users',
            'password' => 'required|min:8',
        ];
    }
}

Result: A fully documented POST endpoint in Swagger with request body schema, required fields, validation types, and a 201 Created response — all without you writing a single doc comment.

Want Even More Control? Use PHP Attributes

use Stackmasteraliza\ApiResponse\Attributes\ApiEndpoint;
use Stackmasteraliza\ApiResponse\Attributes\ApiRequestBody;

#[ApiEndpoint(
    summary: 'Create a new user',
    description: 'Register a new user account',
    tags: ['Users']
)]
#[ApiRequestBody(
    properties: ['name' => 'string', 'email' => 'string', 'password' => 'string'],
    required: ['name', 'email', 'password']
)]
public function store(StoreUserRequest $request): JsonResponse
{
    $user = User::create($request->validated());
    return ApiResponse::created($user, 'User created');
}

Attributes are optional — use them only when you want to add summaries, descriptions, or override auto-detected schemas.

Export to Postman & Insomnia (One Click)

From the Swagger UI, export your entire API documentation:

Format	Use Case
Postman	Import directly into Postman
Insomnia	Import directly into Insomnia
JSON	CI/CD pipelines, SDK generation
YAML	Human-readable specs

Your Postman collection is always in sync with your code. No manual maintenance.

API Versioning in Swagger UI

API_DOCS_VERSIONING=true

The package auto-detects api/v1/*, api/v2/* patterns and adds a version switcher in the Swagger UI. Each version gets its own OpenAPI spec. Your frontend team can browse docs for any version.

WebSocket Testing (Yes, In Swagger)

Test WebSocket connections directly from the Swagger UI. Send messages, subscribe to channels, see real-time responses — with pre-built templates for Subscribe, Unsubscribe, Ping, and Client Events.

No Postman. No wscat. Just click and test.

But Wait — It's Also a Complete Response Builder

The Facade Way

use Stackmasteraliza\ApiResponse\Facades\ApiResponse;

class UserController extends Controller
{
    public function index()
    {
        $users = User::paginate(15);
        return ApiResponse::success($users, 'Users retrieved');
    }

    public function store(StoreUserRequest $request)
    {
        $user = User::create($request->validated());
        return ApiResponse::created($user, 'User created');
    }

    public function destroy(User $user)
    {
        $user->delete();
        return ApiResponse::noContent();
    }
}

Or Use the Trait

use Stackmasteraliza\ApiResponse\Traits\HasApiResponse;

class UserController extends Controller
{
    use HasApiResponse;

    public function index()
    {
        return $this->success(User::paginate(15), 'Users retrieved');
    }
}

Both give you perfectly consistent responses:

{
    "status_code": 200,
    "success": true,
    "message": "Users retrieved",
    "data": [
        { "id": 1, "name": "John Doe" },
        { "id": 2, "name": "Jane Doe" }
    ],
    "meta": {
        "current_page": 1,
        "per_page": 15,
        "total": 50,
        "last_page": 4,
        "from": 1,
        "to": 15,
        "links": {
            "first": "http://example.com/api/users?page=1",
            "next": "http://example.com/api/users?page=2"
        }
    }
}

Pagination metadata is automatically detected and included. No extra code.

Every Error Response You'll Ever Need

ApiResponse::badRequest('Invalid input');           // 400
ApiResponse::unauthorized('Token expired');          // 401
ApiResponse::forbidden('Admin only');                // 403
ApiResponse::notFound('User not found');             // 404
ApiResponse::conflict('Email already exists');       // 409
ApiResponse::validationError($errors);               // 422
ApiResponse::tooManyRequests('Slow down', 60);       // 429
ApiResponse::serverError('Something broke');          // 500
ApiResponse::serviceUnavailable('Back soon');         // 503

Consistent structure every time:

{
    "status_code": 422,
    "success": false,
    "message": "Validation failed",
    "errors": {
        "email": ["The email field is required."],
        "password": ["The password must be at least 8 characters."]
    }
}

Exception Handling That Just Works

Drop this into your bootstrap/app.php (Laravel 11+):

use Stackmasteraliza\ApiResponse\Exceptions\ApiExceptionHandler;

->withExceptions(function (Exceptions $exceptions) {
    $exceptions->render(function (Throwable $e, Request $request) {
        return (new ApiExceptionHandler())->handle($e, $request);
    });
})

Now every exception — ValidationException, ModelNotFoundException, AuthenticationException — returns a clean, consistent JSON response. No more HTML error pages in your API.

Testing Helpers

Write expressive API tests:

$response = $this->getJson('/api/users');

$response->assertApiSuccess()
         ->assertApiStatusCode(200)
         ->assertApiMessage('Users retrieved')
         ->assertApiHasData()
         ->assertApiPaginated();

Customize Everything

Publish the config and make it yours:

php artisan vendor:publish --tag=api-response-config

Change response keys, pagination keys, default messages, theme colors, branding — everything is configurable.

// config/api-response.php
'keys' => [
    'success'     => 'success',
    'message'     => 'message',
    'data'        => 'data',
    'errors'      => 'errors',
    'meta'        => 'meta',
    'status_code' => 'status_code',
],

Extend With Custom Macros

Need custom response types? The package is macroable:

ApiResponse::macro('banned', function (string $reason = 'Account suspended') {
    return $this->error($reason, 403);
});

// Then use it anywhere
return ApiResponse::banned('Your account has been suspended');

Why Developers Are Switching

Before	After
Writing `@OA\` annotations for hours	Auto-generated Swagger docs from code
Postman collections always outdated	One-click Postman/Insomnia export
No WebSocket documentation	Built-in WebSocket tester in Swagger
Inconsistent response formats	One standardized JSON structure
Custom exception handlers	Built-in error handling
Copy-paste response code	One-liner fluent methods

Quick Start Recap

# 1. Install
composer require stackmasteraliza/laravel-api-response

# 2. Use in controllers
# (Facade or Trait — your choice)

# 3. Visit /api-docs
# Your documentation is already there

Supports Laravel 10, 11, and 12 | PHP 8.1+

Let's Connect

If this package saves you time, give it a star on GitHub and share it with your team.

Got questions, ideas, or feature requests? Drop a comment below or open an issue on GitHub.

Follow me for more Laravel packages and PHP tips:

Dev.to: @stackmasteraliza
GitHub: @stackmasteraliza

Happy coding!
— Aliza Ali (@stackmasteraliza)

FixForward: One Command to Go from Broken Build to Ready-to-Merge PR

Aliza Ali — Sun, 15 Feb 2026 14:54:11 +0000

GitHub Copilot CLI Challenge Submission

This is my submission for the GitHub Copilot CLI Challenge.

What I Built

Every developer knows the pain: your build breaks, your tests fail, and suddenly you're down a rabbit hole of stack traces, file-hopping, and manual patching. I've been there one too many times, so I built FixForward — a CLI autopilot that takes you from broken tests to a verified, ready-to-merge PR in a single command.

pip install fixforward
fixforward run

That's it. One command.

FixForward detects your test framework, runs the suite, parses the failures, classifies each one, asks GitHub Copilot CLI to generate a minimal fix, applies it on a safe branch, re-runs your tests to verify the fix actually works, and generates a PR description with a confidence score. The entire pipeline is automated, and the entire tool is powered by Copilot CLI under the hood.

Demo

Here is FixForward running against a real broken Python project. It detects the failing test, classifies the bug as an assertion failure, generates a one-line fix via Copilot CLI, patches the file, re-runs the tests, and reports 95% confidence — all without leaving the terminal:

The Pipeline: How It Works

FixForward is not a wrapper around a single Copilot prompt. It's a full incident response pipeline with 8 distinct stages:

tests fail → parse output → classify failure → Copilot generates fix
     → apply on safe branch → re-run tests → confidence score → PR report

1. Detect — Scans for pytest.ini, package.json, or Cargo.toml to identify your ecosystem automatically. No config files, no setup.

2. Run Tests — Executes your test suite (pytest, npm test, or cargo test) and captures full raw output.

3. Parse — Custom parsers extract individual failures with file paths, line numbers, error messages, and tracebacks. This isn't regex on the whole blob — there are dedicated parsers for pytest, Jest/Mocha, and cargo test that understand each format's quirks.

4. Classify — Categorizes every failure using heuristic pattern matching:

Category	Examples	Confidence
`syntax_error`	`SyntaxError`, `IndentationError`, `Unexpected token`	95%
`dependency`	`ModuleNotFoundError`, `Cannot find module`	90%
`api_change`	`AttributeError`, `TypeError` (wrong args)	85%
`assertion`	`AssertionError`, `assert_eq!`, `expect().toEqual()`	85%
`env_mismatch`	Version conflicts, missing commands	80%
`lint`	Flake8, ESLint, Clippy warnings	75%
`flaky_test`	Timeouts, connection refused, intermittent	60%

5. Generate Patch — Sends structured failure context + relevant source files to GitHub Copilot CLI (gh copilot -p) for a minimal fix. Copilot reads the actual code, understands the bug, and generates the smallest possible change.

6. Apply — Creates a fixforward/auto-* branch, writes the patched files, and commits. Your working branch is never touched.

7. Verify — Re-runs the entire test suite on the fix branch and computes a before/after confidence score.

8. Report — Generates a Markdown PR title and body with what changed, why, and the verification results.

Screenshots

Full Autopilot Run

The complete pipeline from broken tests to verified fix:

Diagnose Mode

Use fixforward diagnose to inspect failures without applying any changes:

Dependency Detection

FixForward recognizes when the fix isn't a code change but a missing package:

Multi-Ecosystem: Node.js Support

Same pipeline, different ecosystem. Jest failures parsed and classified automatically:

Three Ecosystems, One Interface

Ecosystem	Test Command	What Gets Parsed
Python	`pytest --tb=long -v`	Failures, tracebacks, assertion details, collection errors
Node.js	`npm test`	Jest and Mocha output, suite-level failures, missing modules
Rust	`cargo test`	Panics, `assert_eq!` failures, test summaries

I didn't just support one language and call it a day. Each ecosystem has its own parser that understands the specific output format — pytest tracebacks look nothing like Jest failures, and cargo test panics are their own thing entirely. FixForward handles all of them.

Safety First

I spent a lot of time thinking about what could go wrong. When you're auto-applying code patches, you better not destroy someone's working tree. FixForward has several layers of protection:

Never touches your working branch — all fixes go on fixforward/auto-* branches
Stashes dirty state — uncommitted changes are saved and restored on rollback
Patch preview — see the exact diff before confirming
Dry-run mode — fixforward run --dry-run diagnoses without touching anything
One-command rollback — fixforward rollback undoes everything cleanly
State persistence — rollback info stored at ~/.fixforward/state.json

I wanted this to be a tool you could trust running in your repo without hesitation.

My Experience with GitHub Copilot CLI

Copilot CLI is not just a helper in this project — it is the engine. FixForward uses gh copilot -p at its core to generate the actual code fixes. Here's what that looks like internally:

gh copilot -- -p "I have a python project with failing tests.
  The test test_divide in test_app.py fails with AssertionError:
  assert 3.333 == 3. Generate a minimal fix..." \
  --allow-all-tools --add-dir ./project --silent

Copilot reads the source files through --add-dir, understands the test context, and generates the smallest code change. FixForward then parses Copilot's response (which can come in several formats — code blocks, file headers, inline diffs), extracts the patched files, and applies them.

Building the Copilot response parser was one of the trickier parts. Copilot doesn't always respond in the same format, so I built multiple parsing strategies:

Fenced code blocks with FILE: markers
Filename headers (### file.js, file.js, backtick file.js) followed by code blocks
Language-tagged blocks matched to project files
Fuzzy file matching against the project tree (skipping node_modules)

If one strategy fails, the next one kicks in. This makes FixForward resilient to Copilot's varying output formats.

I also used Copilot CLI extensively during development — for scaffolding parsers, debugging edge cases in Jest output handling, and figuring out the right subprocess patterns for capturing test output across platforms.

Try It Yourself

The repo includes ready-made broken demo projects:

git clone https://github.com/stackmasteraliza/fixforward.git
cd fixforward

# Python: division bug (a / b should be a // b)
fixforward run --path demo/broken_python

# Node.js: truncation bug ("..." becomes "..")
fixforward diagnose --path demo/broken_node

# Rust: off-by-one in clamp()
fixforward diagnose --path demo/broken_rust

# Safe mode: see the diagnosis without changing anything
fixforward run --path demo/broken_python --dry-run

Install from PyPI:

pip install fixforward

Architecture

fixforward/
├── cli.py          # argparse CLI: run, diagnose, rollback
├── detector.py     # Ecosystem detection + test runner
├── classifier.py   # Regex heuristic failure classification
├── copilot.py      # GitHub Copilot CLI integration
├── patcher.py      # Safe branch creation + file patching
├── verifier.py     # Test re-run + confidence scoring
├── reporter.py     # PR title/body generation
├── display.py      # Rich-based terminal UI
├── state.py        # Rollback state persistence
└── parsers/
    ├── pytest_parser.py   # pytest output parser
    ├── npm_parser.py      # Jest/Mocha output parser
    └── cargo_parser.py    # cargo test output parser

Only one dependency: rich. Everything else is Python standard library.

I built Spotify Wrapped for Git using GitHub Copilot CLI

Aliza Ali — Sun, 15 Feb 2026 06:37:15 +0000

This is a submission for the GitHub Copilot CLI Challenge

What I Built

git-wrapped — Spotify Wrapped, but for your Git history.

Every December, Spotify tells you what kind of listener you are. I wanted the same thing for coding. What if your terminal could tell you that you're a Night Owl who codes at 2 AM, or a Code Surgeon who deletes more than they write?

git-wrapped is a Python CLI tool that analyzes any Git repository and generates a beautiful, colorful terminal report. No browser, no dashboard, no account — just run a command and see your year in code.

The Full Feature Set

The Numbers — Total commits, files changed, lines added/deleted, net line impact, active days
Activity Heatmap — A GitHub-style contribution calendar rendered entirely in your terminal using Unicode block characters
When You Code — Hour-of-day and day-of-week bar charts showing your coding rhythm
Top Files — Leaderboard of your most frequently modified files
Languages — Programming language breakdown with percentage bars
Streaks & Records — Longest streak, current streak, busiest single day, best month
Coder DNA — A personality assessment based on your commit patterns: Night Owl, Early Bird, Weekend Warrior, Streak Master, Feature Machine, Code Surgeon, or Balanced Builder
Fun Facts — Holiday commits, longest/shortest commit messages, contributor count, productivity stats
Compare Mode — Year-over-year comparison (--compare 2024 2025) with delta percentages and personality shift tracking
Share Card — A copy-pasteable plain text card for sharing on social media (--share)
JSON Export — Dump raw stats as JSON for further analysis or integrations

Why I Built This

I spend a lot of time in the terminal. I wanted something that celebrates the work developers do — not just the PRs that get merged, but the late-night debugging sessions, the weekend side projects, the 14-day commit streaks that nobody notices.

git-wrapped makes that visible. And it's fun.

Demo

GitHub repo: stackmasteraliza/git-wrapped

Try it yourself

# Install from PyPI
pip install git-wrapped

# Or install from source
git clone https://github.com/stackmasteraliza/git-wrapped.git
cd git-wrapped
pip install -e .

# Run on any repo
git-wrapped

# Analyze a specific year
git-wrapped --year 2025

# Compare two years
git-wrapped --compare 2024 2025

# Generate a share card
git-wrapped --share

Tech Stack

Python 3.8+ — Core language
Rich — Terminal formatting (panels, tables, progress bars, styled text)
Git log parsing — Custom parser using --numstat and --format for file-level stats
Zero external API calls — Everything runs locally, your data never leaves your machine

One external dependency. That's it.

My Experience with GitHub Copilot CLI

GitHub Copilot CLI was my pair programmer for this entire project. Instead of tab-switching between Stack Overflow, Git docs, and Rich documentation, I stayed in my terminal and asked Copilot directly.

Here's exactly how I used it at each stage of development:

1. Understanding git log format

The first challenge was figuring out how to extract structured data from git log. I asked Copilot CLI to explain the --format flags, and it gave me a clear breakdown of every placeholder — %H for hash, %an for author name, %aI for ISO date, %s for subject line — plus how --numstat adds per-file insertion/deletion stats and how >>> delimiters can separate commits for reliable parsing.

This saved me from trial-and-error with Git's dense documentation.

2. Calculating commit streaks

Computing the longest daily commit streak was trickier than expected. I needed to handle gaps, deduplicate dates, and track both the longest historical streak and the current active one.

I asked Copilot CLI for approaches and it gave me multiple solutions — a Python version using datetime.timedelta to detect consecutive days, and even a Bash one-liner. I adapted the Python approach directly into my analyzer:

# Copilot helped me arrive at this pattern
sorted_dates = sorted(set(commit_dates))
streak, max_streak = 1, 1
for i in range(1, len(sorted_dates)):
    if (sorted_dates[i] - sorted_dates[i-1]).days == 1:
        streak += 1
        max_streak = max(max_streak, streak)
    else:
        streak = 1

3. Grouping commits by hour of day

For the "When You Code" charts, I needed to count commits grouped by hour. Copilot CLI gave me multiple shell approaches — from simple cut pipelines to awk loops — which helped me understand the data shape before writing the Python version.

Seeing the shell approach first made the Python implementation obvious.

4. Rendering the terminal heatmap

This was the hardest visual to get right. A GitHub-style contribution heatmap, but in the terminal, using colored Unicode blocks.

I asked Copilot CLI how to render a colored heatmap using Python's Rich library, and it showed me two approaches:

A Table-based approach using Rich's Table with colored cells
A block character approach mapping values to █ characters with ANSI colors

I ended up combining both — using Rich's Console for color management and block characters for the grid cells:

colors = ["bright_black", "dark_green", "green", "bright_green"]
char = "█"
for week in range(weeks):
    for day in range(7):
        intensity = get_intensity(data[week][day])
        output += f"[{colors[intensity]}]{char}[/]"

The Impact

Without Copilot CLI, each of these problems would have meant opening a browser, scanning docs, finding a relevant example, adapting it, and testing. That cycle breaks flow.

With Copilot CLI, the cycle was: ask a question → get a working answer → adapt and move on. I stayed in my terminal the entire time. The cognitive load dropped and I could focus on making the output feel delightful instead of fighting implementation details.

It felt less like using a tool and more like pair programming with someone who has every man page memorized.

Challenges & Discoveries

The heatmap was the hardest part. Terminals don't have pixels — you're working with a character grid where each "cell" is a text character. Getting the heatmap to look like GitHub's contribution graph required careful math: mapping 52 weeks × 7 days into a grid, choosing the right Unicode block characters, and picking green shades that look good across different terminal themes.

Personality detection was surprisingly fun. The "Coder DNA" feature assigns you a personality based on your commit patterns. Calibrating the thresholds (e.g., "30% of commits after 10 PM = Night Owl") required running it against a bunch of real repos to make sure the labels felt accurate and fun, not arbitrary.

Rich is incredible. Python's Rich library does the heavy lifting for all the terminal visuals — panels, tables, progress bars, colored text. It's the reason git-wrapped looks polished without needing a web UI.

What Makes This Special

For developers:

See your coding habits visualized in seconds
Discover patterns you didn't know you had (turns out I code most on Thursdays)
A fun conversation starter in team standups

For teams:

Run it on shared repos to see team-wide patterns
Compare year-over-year to track how the team's rhythm evolves

For the community:

Fully open source — fork it, extend it, make it yours
Single dependency — easy to install anywhere
Privacy-first — everything runs locally, no data leaves your machine

Built with Python, Rich, and a lot of late-night commits. Powered by GitHub Copilot CLI.

GitHub Repository: stackmasteraliza/git-wrapped

DEV Community: Aliza Ali

5 Ways Your Photos Still Leak Your Location (Even Though Social Media Strips It)

1. "Send as file" in chat apps

2. Email attachments

3. Cloud share links

4. Device-to-device sharing

5. Marketplaces and forums

How to check your own photos (Android)

Stop new photos from being tagged

Clean the ones you already have

I'd love your help testing it

Your Photos Are Telling On You: I Built a Metadata Remover That Never Uploads Your Files

What's actually hiding in your files

Why "no upload" was non-negotiable

Zero quality loss

It works on video too

📱 Get the Android app

🙋 I'm looking for Android testers

Try it

SOLSTICE — feed the light, hold back the night (an ode to Alan Turing)

What I Built

Video Demo

Code

stackmasteraliza / solstice-cipher

SOLSTICE — feed the light, hold back the night. A 20-level arcade game for the June Solstice Game Jam, an ode to Alan Turing.

☀ SOLSTICE

feed the light · hold back the night

✨ Why it's fun

How I Built It

Prize Category

My 'Incident-to-PR Autopilot' Never Actually Opened the PR. I Finally Finished It.

What I Built

Demo

The Comeback Story

My Experience with GitHub Copilot

NotionOps AI — 4 AI Agents That Run Your Dev Workflow End-to-End

What I Built

Screenshots

Video Demo

Show us the code

stackmasteraliza / notionops-ai

Autonomous AI workflow engine — 4 Gemini-powered agents that triage GitHub issues, review PRs, plan sprints, and generate standups, all coordinated through Notion.

NotionOps AI — Software Dev Pipeline That Runs Itself 🤖

What It Does

Demo Video

Four AI Agents

How I Used Notion MCP

Tech Stack

About Me

Auto-Generate Swagger Docs in Laravel — Zero Annotations, Zero Config

Writing Swagger Annotations Is Pain. What If You Didn't Have To?

Introducing: Laravel API Response Builder

Installation (30 Seconds)

Auto-Generated Swagger Docs (The Main Event)

How It Detects Everything

Want Even More Control? Use PHP Attributes

Export to Postman & Insomnia (One Click)

API Versioning in Swagger UI

WebSocket Testing (Yes, In Swagger)

But Wait — It's Also a Complete Response Builder

The Facade Way

Or Use the Trait

Every Error Response You'll Ever Need

Exception Handling That Just Works

Testing Helpers

Customize Everything

Extend With Custom Macros

Why Developers Are Switching

Quick Start Recap

Links

Let's Connect

FixForward: One Command to Go from Broken Build to Ready-to-Merge PR

What I Built

Demo

The Pipeline: How It Works

Screenshots

Full Autopilot Run

Diagnose Mode

Dependency Detection

Multi-Ecosystem: Node.js Support