GitChat — Chat for GitHub developers

1. 1

   Sign-in

   The user signs in to the app with GitHub OAuth.

2. 2

   Linking the extension

   From the popup, “Connect” opens a page that creates a Sanctum token and a single-use ticket valid for two minutes.

3. 3

   Ticket exchange

   A content script reads the ticket from a meta tag; the service worker exchanges it for the token. The ticket never travels in a URL.

4. 4

   GitChat tab

   On a GitHub page, the extension works out the scope — issue before repository, team before organisation — and adds the tab.

5. 5

   Access check

   The side panel calls the API; Laravel re-checks permissions with GitHub. A repository admin creates the channel, others join it.

6. 6

   Messages

   The open thread is polled every three seconds, the extension every minute; channels whose public status isn’t established are redacted.

The main entities, their key fields and their relations.

Languages

PHP 8.4, JavaScript, TypeScript (Playwright)

Framework

Laravel 12, Socialite, Sanctum

Front end

Blade, Alpine.js, Tailwind 4, Vite 8, Chart.js, Prism

Extension

Manifest V3, esbuild; storage, activeTab, sidePanel and alarms permissions; optional notifications; Firefox build

Database

MariaDB in production, MySQL 8 in development, SQLite in CI

Queues and scheduler

Database queue, systemd worker on the default and mail queues, 11 scheduled tasks

Real time

HTTP polling: 3 s for the open thread, 15–30 s for web notifications, 1 min for the extension

Authentication

GitHub OAuth; Sanctum token with 7 abilities, valid 30 days, handed over by a single-use ticket; old tokens revoked

Payments

Stripe or Lemon Squeezy, swappable; deduplicated webhooks

E-mail

Resend; campaigns split into jobs at two sends per second

Hosting

Apache and PHP-FPM, scripted deployment with a database backup before every migration

CI/CD

3 workflows: tests on a self-hosted runner, extension zip rebuild, hourly external probe

Tests

PHPUnit 11 (118 files, about 830 tests), Playwright (6 specs), node --test for the extension (68 tests)

Quality

Pint, pre-push hook, Dependabot, automatic versioning

Monitoring

Sentry, PostHog, protected /health (503 on failure), two heartbeats, cron watchdog, Discord alerts

Languages (UI)

English, French, Dutch (web and extension)

Security

SSRF-safe URL fetching (HTTPS, public IPs, checked redirects), CSP and HSTS, 8 rate limiters

• GitHub channels

  Per repository, issue or PR, organisation and team, plus direct messages.

• Conversation

  Reactions, mentions, replies, editing, attachments and GIFs.

• Link previews

  19 card types: repository, issue, gist, discussion, compare, YouTube…

• Notifications

  Native in the extension, plus a daily e-mail digest of unread messages.

• Per-seat subscriptions

  With a swappable payment provider.

• Self-service GDPR

  Account export and deletion.

1. Silent scheduler

   ProblemThe schedule file returned a closure Laravel 11 never called: no scheduled task ran, and nothing reported it.

   FixTasks declared through the Schedule facade, and a test that locks their list.

2. False green health

   ProblemThe /up route answers 200 even when the database is down.

   FixA /health route that puts the verdict in the HTTP status, and two heartbeats that tell an idle worker from a dead one.

3. Fake nightly successes

   ProblemThree sync jobs logged “synced” while doing nothing, as the scheduler had no user token.

   FixJobs removed in favour of live reads with the signed-in user’s token.

4. Irregular GitHub Actions cadence

   ProblemAn hourly scheduled probe ran only four times in sixteen hours.

   FixA cron watchdog, outside Laravel, that only alerts on state changes.

5. Previews cut off after ten

   ProblemWith a limit of 10 per minute, later cards fell back to plain links.

   FixLimit raised to 60 per minute, as responses were already cached.

1. December 2024 First commit
2. May 2026 Public pages, i18n, command palette
3. June 2026 SSRF, upload and webhook hardening
4. August 2026 Chrome extension and repository channels
5. September 2026 Issue and PR channels, external monitoring
6. October 2026 Firefox build, native notifications

550

commits, 520 of them mine

227

released versions

~900

tests (PHP and extension)

3

languages

Taken from the project’s source code and Git history on 8 October 2026. No usage or revenue figures are published.