- Backend: Koa + @koa/router serving the HIBP-style /range/:prefix k-anonymity
API, backed by Postgres via pg, with migrate/seed scripts run through tsx.
- Frontend: React + wouter, bundled with webpack (dev server + prod build),
thin client that hashes passwords locally and only sends the hash prefix.
- Import package: CLI to bulk-load a wordlist or hash list into the database,
plus a separate script to pull the full dataset from the HIBP range API.
Both support parallelism (worker threads for wordlist hashing, concurrency
limiter for DB/HTTP fan-out).
- Dev tooling: docker compose for a local Postgres, .env.local/.env.example,
DATABASE_URL support as an alternative to discrete PG* vars.
