https://pandalabs.cc/blog/ The PandaLabs blog: long-form posts on personal work — capturing, reviewing, following through — with Panda Assistant in practice. en Fri, 25 Sep 2026 00:00:00 GMT https://pandalabs.cc/blog/community-v1/ https://pandalabs.cc/blog/community-v1/ Fri, 25 Sep 2026 00:00:00 GMT An open-source identity service you can self-host. Your users’ data stays on your own servers. <p>Building a product means building login: sign-up, password reset, two-factor. Every product needs it, it is hard to get right, and the cost of getting it wrong is high. PandaAuth turns it into a standalone service — your product connects through standard protocols (OIDC / OAuth 2.0), and sign-in, authorization and token management are handled in one place.</p> <p>It is self-hosted: deployed on your own servers, with user data in your own database.</p> <h2>Who it is for</h2> <p>Developers and teams building products that need login; data-sensitive businesses that would rather not hand user passwords to a third-party sign-in service; anyone who can run Docker and is willing to maintain their own infrastructure. There is no hosted edition — deployment and maintenance are on you. That is the price, and the premise, of keeping your data yours.</p> <h2>What it has</h2> <p>Standard protocols: OIDC authorization code + PKCE, client credentials, refresh tokens. Mature libraries exist in every major language — integration does not lock your stack.</p> <p>An admin console for users, clients and audit logs; admin write operations support two-factor.</p> <p>Self-service MFA: users enable Passkey, TOTP or recovery codes themselves, no admin required.</p> <p>Account security: email confirmation, email change, password recovery. Changing a password invalidates old sessions.</p> <p>A .NET SDK: a minimal client that persists no tokens, with a machine-to-machine (M2M) sample.</p> <h2>Security, done for real</h2> <p>Passwords are hashed with Argon2id (OWASP baseline parameters) — a database leak is not a password leak.</p> <p>Access tokens expire in 10 minutes with refresh-token rotation, keeping the leak window small.</p> <p>Sign-in rate limiting, audit logs, signing-key rotation and enforced HTTPS are on by default.</p> <p>The code is MIT open source. Security does not rely on a black box.</p> <h2>Where to get it</h2> <p>GitHub: github.com/PandaLabs2026 (five repositories: server / share / sdk / admin / me).</p> <p>This release: github.com/PandaLabs2026/panda-auth-server/releases/tag/v1.0.0.</p> <p>Product site (docs and live status): auth.pandalabs.cn.</p> <p>PandaAuth just set out. If you have it running, the feedback we want most is from real use: what feels off, what is missing, where you put it to work — write to hello@pandalabs.cc, and we read every message. Product direction and priorities live on the roadmap page of the product site (auth.pandalabs.cn/roadmap).</p> https://pandalabs.cc/blog/why-panda-assistant/ https://pandalabs.cc/blog/why-panda-assistant/ Mon, 21 Sep 2026 00:00:00 GMT The honest answer: we built it for ourselves first. And why Panpan proposes but never decides. <p>People often ask: there are already so many note apps and task managers — why build another one? The most honest answer: we didn't build it for a "market gap". We built it for ourselves. The earliest version of this product was simply the workflow we used every day.</p> <h2>A predicament we couldn't explain</h2> <p>We kept noticing the same predicament, in others and in ourselves: ideas scattered across chats and sticky notes, promises scattered across meetings and group threads — and at the end of a busy day, no clear answer to "what did I actually move forward today?" We tried stronger willpower, more elaborate filing systems, more tools. Nothing lasted. Eventually it clicked: what was missing wasn't discipline, but a path that catches the fragments, untangles them, and moves them forward.</p> <h2>Why "propose and confirm"</h2> <p>Our first sketches were far more "fully automatic": auto-sorting, auto-scheduling, auto-summarizing. It quickly felt wrong — the work is yours, and once the AI decides for you, you stop being the owner of it. So Panpan, the AI assistant in Panda Assistant, has a strictly bounded role: organize and propose. It turns your voice, text and attachments into notes, tasks and proposals, and nothing is saved until you approve. AI organizes and proposes; you decide. That isn't a technical compromise — it's the philosophy of this product.</p> <h2>Why the panda</h2> <p>When naming the brand, we considered plenty of names that sounded "faster" or "smarter". We chose the panda. A panda is slow — but every one of its steps counts. We want you to work the same way: not chased by productivity metrics, but with every step today moving forward what you truly care about.</p> <h2>Built for ourselves first</h2> <p>The first users of Panda Assistant were us: long-press to talk and capture an idea on the commute, hand meeting promises to Panpan to organize, and at month's end read the review the AI drafts from that month's real records. It became a tool we couldn't do without before we dared to invite you in. It is currently in a closed, invite-only beta — every batch of invitations is a "please come find what's wrong".</p> <h2>What's next</h2> <p>Since then, the identity work behind our own products has become PandaAuth — sign-on, authorization and audit, integrated once and reused across the ecosystem — with Oasis, the operations platform for your business, on the way. Personal work, trusted identity and business operations: the three things PandaLabs intends to build well. The reason is still the one line on our site: serious work deserves serious tools.</p>