A web/desktop app that reads American Sign Language from a webcam and translates it to on-screen text in real time. Implementation uses a hand-tracking library to extract hand-landmark coordinates from each frame, then feeds them into a classifier trained on a public ASL dataset to identify each sign. Suggested build order: live hand tracking on screen, then a classifier for a small set of static signs, then expand the vocabulary and stabilize the output. Target outcomes: (1) real-time hand tracking from webcam; (2) correct classification of at least 5–10 static fingerspelled letters; (3) live translated text as the user signs. Stretch: full A–Z, motion-based signs, and text-to-speech.
A browser-based game where players join a shared room and play in real time. Implementation uses a client-server setup: the server holds the authoritative game state (turns, scores, timers) and broadcasts updates to all players as events occur. Suggested build order: two clients connected to a shared room seeing each other live, then the core game loop (turns, rounds, scoring), then polish and capacity. Target outcomes: (1) two or more players join the same room from separate browsers; (2) one player's actions appear near-instantly for all others; (3) a full round plays start to finish with correct scoring. Stretch: multiple rooms/lobbies, in-game chat, more game modes, and leaderboards.
A tool that takes a domain and produces an attack-surface report built entirely from public data - DNS records, WHOIS registration, subdomain enumeration, and certificate-transparency findings. It mirrors the first step of a real security assessment: mapping what's exposed. Implementation orchestrates several public lookup sources asynchronously, normalizes their inconsistent output, and presents the results in a single readable report. Suggested build order: DNS + WHOIS lookups in a clean report, then add subdomain enumeration and certificate-transparency data, then layer in service discovery and an overall attack-surface score. Target outcomes: (1) accept a domain and return DNS + WHOIS data; (2) enumerate subdomains; (3) present consolidated findings in one clear report. Stretch: subdomain brute-forcing, exposed-service fingerprinting, and attack-surface scoring.
There are more people than ever using RunSignup's API. AI and Vibe coding tools have lowered the barrier so that non-technical business leaders and entrepreneurs alike can create interesting apps that that support their business and increase our overall community. This surge of activity has increased both accidental as well as nefarious attacks on RunSignup's platform.
Vibe coders struggle with understanding authentication methods, respectful rate limiting when calling APIs, error handling, and other basic engineering concepts.
The purpose of this project will be to create a sample application to be used as a reference implementation along with a teaching that presents a set of best practices and how to's that API users can apply to their projects. The topics to be covered would be (sample list, you might come up with better ones):
The output will be a reference application and some type of documentation (document or online reference). Here is something a bit like what I envision that was made for Shopify: v0 starter for Shopify https://v0.app/docs/shopify
Here are some ideas for the reference application:
Interactive Fundraising & Donation Kiosk
This would be an application that can display top fundraisers/rankings of top fundraisers in realtime that an event organizer could display on a connected display (external monitor/TV/LED board).
They could make it display a number of ways, I'm thinking:
A ranking of top fundraisers by dollars raised that is updating as donations are being made on site
A "slideshow" of top fundraisers with details about the top donors per fundraiser, with a QR code that attendees could scan to donate to this fundraiser on site.
A lookup mode where users could search for and donate to a fundraiser via scanning a QR code (likely similar interface to the example above).
"My RunSignup" App
This would be a user-centric application where they would integrate with the APIs that allow user authentication and getting profile data so that users could login to the app and see their upcoming races, their recent results, photos of them found in results, your fundraisers, teams, etc...
Performance Analyzer / Visualizer
This is an app that accesses your profile to and finds all of your performances and plots them on a chart.
So you could see a chart of your times of all your 5k's, all your 10k's, all your Marathon's over time.
Other fun visual ways of highlighting your own data - such as a map dot for everywhere you ran a race - (this could be its own app)
And possibly your fundraising efforts over time
These could just be features in the My RunSignup App
YoY Ticket Event Analyzer
The ability to choose ticket events that you want to analyze across multiple years (since we do not have renewal of ticket events like we do with race events)
So if you had a ticket event with us for the past few years, you can not get the YoY analysis and graphs like you can for RSU. This app would allow you to login via oAuth2 and bring up a list of your Ticket Events. You can select which events you want to analyze (maybe there is a limit - like up to 3 or 5). Then the app would read in ticket purchase data and output cool graphs similar to our Race Dashboard that shows multi years on a single graph. Slices and dices the data and gives insights.