Recall
Save anything. Recall connects it, tags it, and resurfaces it when it matters.
Overview
An AI-powered bookmark manager: save any link from the web app or a Chrome extension, get it auto-tagged, and have it resurface later via a daily digest instead of disappearing into a folder you never open again.
Why I built it
Bookmark folders are where links go to die. Saving something is easy, finding it again three weeks later isn't. Recall auto-tags on save and proactively resurfaces old saves instead of waiting to be searched.
Architecture
Next.js 16 app on Vercel, PostgreSQL + Prisma via Supabase, Upstash Redis for caching and rate limiting, Gemini 2.5 Flash for tagging and the "Surprise me" resurfacing feature, plus a Chrome MV3 extension (Manifest V3) for one-click saving from any page, including a bookmarklet fallback.
Challenges
Bookmark ingestion accepts arbitrary URLs, including ones scraped for Open Graph metadata, and both are SSRF vectors. Hardened the ingestion API against private network ranges, cloud metadata endpoints (169.254.169.254 and friends), and IPv4-mapped IPv6 addresses, covering both the user-supplied URL and the OG-scraper's outbound requests. Separately, every mutation (delete, collection membership, tag edits) needed to feel instant: built a fully optimistic UI with snapshot-based rollback on failure and a server-reconciliation pass that clears stale client state on revalidation, with no loading spinners anywhere in the app.
Outcome
Live with real users via the web app and Chrome extension. 10 stars on GitHub. Shipped a full auth flow (including PKCE-based password reset), an admin dashboard, collections with optimistic UI, AI auto-tagging, and a daily digest email with unsubscribe handling.