VulCode

Rust: what we build with it and why

We write Rust where a bug costs the most: a hosting platform's core, a messenger's cryptography, a licence server and tools that run for years on other people's machines.

All technologies

Rust in real screenshots

The projects on this page on the screens from the portfolio and the case studies, each with a short description and the way to the full one.

Invoices and corrections in the Flaem panel: documents sent to KSeF with their status

Flaem: the platform core

Panel API, store, billing, KSeF and node orchestration.

A group chat in Plazer: messages, a poll, a voice note and a thread on the side

Plazer: the MLS core

Group encryption per RFC 9420, also compiled to WebAssembly.

When Rust, and when something else

A technology has to fit the place the code will run and the team that will take it over. The final choice is made in the quote, together with you.

We pick Rust

A core with money and permissions

The API, store, billing and KSeF in the Flaem core are in Rust. An error or a missing value is part of the type here, so the code has to handle it explicitly before it reaches a server.

One cryptography for every app

Plazer's core with MLS encryption is one Rust library: the browser gets it as WebAssembly, native apps through UniFFI. The protocol has one implementation, not a separate one in every language.

Queries checked at compile time

In the Flaem core, sqlx checks SQL queries against the database schema at build time. A typo in a column name or a wrong type shows up before deployment, not in production.

Code that reads data from strangers

A licence server with Ed25519 tokens and a messenger protocol accept data from anyone on the network. Safe Rust rules out buffer overflows and use-after-free, so that whole class of holes is gone from the code.

Terminal tools

vulp handles many repositories from one terminal, with a ratatui interface. The program is one binary: the user installs nothing else, and the tool starts at once.

Light desktop apps

Gyred in Dioxus and studio in Tauri use the system web view instead of bundling their own. A program open all day leaves memory to other apps, and the heavier work is done by Rust code.

This is how we write it in our services

We pick something else

A company site or landing page

We build a company site in TypeScript and React with prerendering: the content is in the first HTML, and any web developer can later fix a text or a section. Rust adds nothing here and narrows the circle of people who can work on the site.

A prototype to test an idea

When the data model changes every day, the Rust compiler makes you fix every dependent place on every change. We write the prototype in TypeScript and move to Rust what proves itself.

A panel with dozens of screens

The Flaem panel is in React and TypeScript on top of a Rust API. The interface changes most often, and the React ecosystem has ready libraries for forms, tables and charts.

An agent on thousands of machines

The Flaem VPS agent and container daemon are in Go. An agent mostly needs networking, timeouts and retries, and simple Go code builds faster and is easier to take over.

A Discord bot or an ops script

The VulCode bot and the diagnostic scripts are in Python. A fix is an edit to a file on the server, with no build and no new release.

An add-on to someone else's system

The host system loads add-ons in its own language: we write a WHMCS module in PHP, a Minecraft plugin in Java and an SCP: Secret Laboratory plugin in C#. Rust has no way in there.

Rust compared, point by point

Each need on a row of its own, with what each of the two columns gives you on it side by side.

NeedRustTypeScript on Node

A long-running service handling money

First choice
Good, with more test discipline

Cryptography in the browser

WebAssembly from the same code
JS libraries, separate code for native

A quick company site

Overkill
First choice

A terminal tool

One binary, no runtime
Needs Node on the user's machine

Heavy computation in a service

Every CPU core, and data races do not compile
They block the event loop, a separate worker is needed

People to maintain the code

Fewer developers, documentation and tests needed
The easiest to staff

The first version

A slower start, fewer fixes after launch
A faster start, more testing along the way

Rust in all our code

How many lines we have written in Rust, and what part of everything we have written that is. We count the lines added in the commits of our repositories, language by language.

995,825
lines written in Rust
18.5%
of all the lines we have written
11
repositories with Rust code
2nd
place among 26 languages

The libraries these projects stand on

From the dependency files of our repositories. With each, one sentence on what we use it for.

The Flaem operator dashboard: sales, monthly revenue and live nodes
On call in the Flaem phone app: alarms with action buttons and the ticket queue
  • tokio, axum, tonic

    The HTTP and gRPC server in the Flaem core.

  • sqlx

    PostgreSQL queries checked at compile time.

  • mls-rs

    The MLS protocol in the Plazer core.

  • ed25519-dalek, aes-gcm, argon2

    Signatures, encryption and passwords.

  • ratatui, clap, git2

    The terminal interface and git operations in vulp.

  • Tauri, Dioxus

    Desktop apps.

Our changes to other people's Rust projects

10 merged changes in 6 repositories. The maintainers of these projects reviewed our code and merged it into theirs.

Week by week

The languages of our changes

Other technologies, and where their code runs

Each has its own page with projects on real screens and a comparison with the alternatives.

Websites and web apps

What you see in a browser, and its back end.

Mobile apps

Native Android and iOS clients.

Desktop apps

Programs for Windows, macOS and Linux without a browser inside.

Back end and infrastructure

Cores, server agents and real-time services.

Bots and automation

Discord, scripts and monitoring.

Questions about Rust

Answers about Rust, our projects and the numbers on this page.

A project in Rust?

Describe what you want to build. We reply within an hour and tell you plainly whether this technology is a good choice.