devslab

🌐 devslab.kr · Products, demos & docs · 📬 support@devslab.kr · 🇰🇷 한국어

Published by 데브스랩(DevsLab).

Explore DevsLab: Company and products · Open source and live demos · GitLinq for Windows · Public repositories

We're a Korea-based studio building SaaS products, desktop applications, and open-source developer tools — architecture, full-stack & mobile, AI integration in one team.

MVP to enterprise, we own every stage all the way to your first users.

frontend  Next.js · React · Vue · HTMX · TypeScript · Tailwind
mobile    Ionic · Flutter · Capacitor · Kotlin · Jetpack Compose
desktop   Electron · Go · Wails · React
backend   Node.js · Spring Boot · tRPC · Postgres · Redis · Drizzle
cloud     AWS · Vercel · Cloudflare · CloudType · Supabase
devops    Docker · Grafana · Prometheus · Sentry · Firebase
ai        Anthropic · OpenAI · LangChain · pgvector

Business tools, developer software, and systems we build and operate. The status below follows each product's public introduction.

GitLinq application source is private; downloads, release notes, and issues are public. Daily server commits and direct conflict editing are still in development.

EDS Desktop is distributed through a public release repository while its application source remains private. The installer supports automatic updates; the portable EXE does not.

More about our products and client work.

Browse live demos and documentation for our libraries and tools.

Battle-tested in our own SaaS first, then shared with the community — Spring Boot libraries on Maven Central (kr.devslab), TypeScript packages on npm, standalone tools as GitHub Releases.

• 🛡️ ssrf-guard   — SSRF defense for the JVM. Whitelist + IP-bypass hardening (decimal/hex/octal/IPv6 obfuscation) + redirect re-validation across 9 HTTP-client modules (RestClient · RestTemplate · WebClient · Feign · OkHttp · JDK HttpClient · Apache HttpClient 5). Includes -springai and -langchain4j for LLM-agent tool URL validation — the new SSRF surface for fetch_url-style tools in Spring AI ToolCallback and LangChain4j ToolExecutor agents. Plus GraalVM native-image hints and reactor-netty DNS-time guards for WebClient.

• 🛡️ ssrf-guard-js   — The JS/TS sibling of ssrf-guard, porting the same core security model to Node and edge runtimes: URL-time validation (scheme · host allowlist · port · userinfo · IP-literal), private-network IP classification, LLM/tool-call JSON scanning for hidden URLs, and two guarded fetches — safeFetch (Node: DNS checks + optional undici DNS pinning) and guardedFetch (Cloudflare Workers / browsers: redirect revalidation with allowlist-first policies, incl. sameSitePolicy for crawl-your-own-site flows). Docs at devslab-kr.github.io/ssrf-guard-js.

• 🪶 easy-paging-spring-boot-starter   · — Annotation-driven pagination for Spring Boot + MyBatis. Offset (@AutoPaginate) and cursor/keyset (@KeysetPaginate) in one starter. Reactive companion artifact (-reactive) for WebFlux + R2DBC, identical JSON envelope on the wire. Library major matches Spring Boot major (see versioning policy): 4.x targets Spring Boot 4 / Spring Framework 7 / Jackson 3; the 3.x maintenance branch keeps SB 3.3–3.5 supported with security patches.

• 📜 api-log   — Event-driven API logging for Spring Boot, PostgreSQL JSONB storage. Multi-module: api-log-core plus persistence drivers (-jpa, -r2dbc, -mybatis) — all on the same version line. Library major matches the Spring Boot major it targets (see versioning policy).

• 🧰 devslab-kit   — Spring Boot 4 platform starter — authentication, RBAC + groups + ABAC, multi-tenancy, dynamic menus, audit logging, config sync across environments, and an admin REST API, all from auto-configuration. Full docs at devslab-kit.devslab.kr.

• 🔌 datalinq   — Convention-driven, cross-vendor JDBC data-migration TUI built on TamboUI: drop a folder under sql/, get a menu. SQL Server / MariaDB-MySQL / PostgreSQL bundled (Oracle / H2 / SQLite one driver download away); ETL / SCRIPT / custom HANDLER operations, dry-run by default. A standalone CLI tool (not a Maven library) — install with jbang: jbang app install datalinq@devslab-kr/datalinq.

• ⌨️ kokey   — Wrong-keyboard-layout text restorer. Korean Dubeolsik built in with a full IME automaton (compound vowels/finals, carry-over), plus 7 table-driven layouts — Russian ЙЦУКЕН, Ukrainian, Hebrew, Greek (dead keys), Thai Kedmanee, Arabic (lam-alef), Georgian — with per-script auto-detection (toEn('안녕 привет')), a self-healing data-kokey DOM layer, adapters for Vue / React / Svelte / Solid (KokeyInput components, use:kokey action/directive), heuristic paste auto-correction (fixMistyped, data-kokey-paste), and an in-field suggest button that offers a fix instead of making one (bindSuggest, data-kokey-suggest) — the same button its browser extension puts on every site. Zero-dependency TypeScript, ESM/CJS dual, localized READMEs in 9 languages. Born from rescuing barcode-scanner input typed while the Korean IME was on.

• 🔢 numkey   — Numeric input formatting for "it's a string, but it's a number" fields: live thousands grouping with a caret that stays put, one-keystroke deletion across separators, leading-zero cleanup, full-width digit normalization, automatic right-align + inputmode, blur-only min/max, and a string-first canonical value model (money-safe — never IEEE 754). Korean amount UX built in: live 한글 병기 (1500000 → "150만"), 만/억 shorthand entry (3만5천 → 35,000, IME-safe), and a hidden-input canonical sync so classic JSP/PHP form POSTs submit clean numbers. Opt-in locale formatting via Intl (separators and group sizes — Indian lakh/crore 12,34,56,789 included); one CDN script tag with data-numkey auto-init — no build step — plus adapters for Vue 3 / React / Svelte / Solid (NumkeyInput components, use:numkey action/directive). Accounting negatives ((1,234)) paste correctly. kokey's sibling in the "-key" input family. Live demo at devslab-kr.github.io/numkey.

• 📅 vue-date-rail   — Horizontal infinite-scroll date rail (day / month strip) picker for Vue 3 — the calendar-strip pattern delivery, booking, and scheduling apps use instead of a calendar popup. Infinite scroll with scroll-position compensation (no jump when past dates prepend), headless useDateRail() core, Intl-based i18n (any BCP 47 locale, no locale files), min/max + disabled dates, a marker slot for event dots, desktop wheel/drag scrolling, CSS-variable theming, and Tailwind-ready unstyled + data-* state attributes. Battle-tested in our dental-logistics mobile app first. Live demo at devslab-kr.github.io/vue-date-rail.

• 📏 editor-ruler   — Word-like horizontal ruler for web rich-text editors — the control every general-purpose WYSIWYG (Froala · TinyMCE · CKEditor 5 · Quill) ships without: left/right margin + first-line indent drag handles (hanging indent included), cm/in/px scales switchable at runtime, one undo boundary per gesture, keyboard-accessible ARIA slider handles, CSS-variable theming. API stable since 1.0. Guide lines with snapping, a vertical ruler (with a reservable gutter so toggling never reflows the content), and browser-language UI (ko/en) work on every adapter; Word-style whole-table indent and column-width markers come with the direct-DOM adapters. Editor-agnostic zero-dependency core (@devslab/editor-ruler) + four per-editor adapters — -froala and -summernote (direct-DOM plugins, both with table support), -tiptap (v2/v3 extension), and -ckeditor5 (model-attribute plugin) — all with one-undo-step drags. CDN script-tag ready (EditorRuler global). Live playground at devslab-kr.github.io/editor-ruler.

• 🌐 locale-match   — Locale negotiation that will not hand a Simplified Chinese reader your Traditional text. A bare zh is silent about the one thing that matters, and a mainland browser sends zh-CN,zh;q=0.9 — so refusing the precise tag hands the match to the vague one right behind it. Both traps are pinned by tests here. Script guards classify a tag as supported / unsupported / unspecified for one base language, under a two-tier rule: a single declared value (?lang=, a cookie) may leave the script unstated; an entry inside a ranked list may not. Chinese is built in and installed automatically from your own supported list; any other script-split language (Serbian, Mongolian, Punjabi, Kurdish, Uzbek) is a few lines with defineScriptGuard. The matcher also takes the sideways step strict RFC 4647 refuses, so pt-PT reaches your pt-BR instead of falling to English. Zero dependencies, ESM + CJS + a CDN-ready IIFE build, and bindings for React (hydration-safe), Vue 3, and Nuxt (resolves during SSR, so the page never changes language after it paints). Live playground at devslab-kr.github.io/locale-match.

• 🧪 devslab-examples — Runnable Spring Boot demos for easy-paging, ssrf-guard, and api-log (19 demos: 4 easy-paging SB4 + 4 easy-paging SB3 maintenance + 8 ssrf-guard across HTTP clients, LLM frameworks, and GraalVM native-image + 3 api-log persistence backends — JPA / R2DBC / MyBatis; bilingual READMEs). Clone, ./gradlew bootRun, curl. Smoke tests included.

• 🖥️ devslab-kit-admin-ui — Vue 3 + PrimeVue admin console for devslab-kit, connected to its admin REST API.

Questions, ideas, sharing your application? Bilingual community in devslab-examples Discussions — same folks who write the libraries.

• XunyaTech — Cybersecurity-first managed IT for growing businesses

• 📬 support@devslab.kr
• 🌐 devslab.kr — available in 14 languages

_{© DevsLab · Built in Seoul}