# I Built an AI App That Gives You Superpowers, Then Makes Them Useless

> My entry for the DEV April Fools Challenge is an AI genie that grants the superpower you ask for, then adds one condition that makes it useless.

- Date: 2026-04-08
- Tags: devchallenge, 418challenge, ai, showdev
- Also on dev.to: [https://dev.to/jimzandueta/i-built-an-ai-app-that-gives-you-superpowers-but-makes-them-useless-kfl](https://dev.to/jimzandueta/i-built-an-ai-app-that-gives-you-superpowers-but-makes-them-useless-kfl)

> This is a submission for the [DEV April Fools Challenge](https://dev.to/devteam/join-our-april-fools-challenge-for-a-chance-at-tea-rrific-prizes-1ofa)

I built a full-stack AI app for the DEV April Fools Challenge. You ask a genie for a superpower, and it grants it with one condition that makes it useless. I wanted to read the challenge's "useless" a little sideways, so I didn't build something broken. The app works; only the powers are useless.

![Screens from the Cursed Powers app, from the lamp to a granted wish.](/blog/i-built-an-ai-app-that-gives-you-superpowers-but-makes-them-useless/1.png)

You can try it at [https://cursed-powers--jimzandueta.replit.app/](https://cursed-powers--jimzandueta.replit.app/). These are a few of the powers it has handed out:

- You can become invisible, but only your internal organs.
- You can shape-shift, but only into a slightly uglier version of yourself.
- You can hear other people's thoughts, but only in extinct languages.

![The genie rising from the lamp.](/blog/i-built-an-ai-app-that-gives-you-superpowers-but-makes-them-useless/2.png)

I made the wish a small ceremony: you rub the lamp, the genie appears, you make your wish, and then you wait for your power. The frontend is Next.js 15 with React, Tailwind CSS v4 and Framer Motion, which handles the lamp and the genie's entrance.

![A short recording of a wish being made and cursed.](/blog/i-built-an-ai-app-that-gives-you-superpowers-but-makes-them-useless/3.gif)

## How I built it

I can't leave a joke alone once it starts working, so I over-engineered this one. The app code, infrastructure setup, docs, architecture decision records, API design and tests are all on GitHub at [https://github.com/jimzandueta/cursed-powers](https://github.com/jimzandueta/cursed-powers).

The backend is Fastify 5 with Drizzle ORM and SQLite, Zod for validation, Pino for logging and Helmet for security headers. It takes each wish, asks the AI for a cursed power, and stores the result. It also serves a gallery and a random wish endpoint, and handles moderation, rate limiting and health checks.

Gemini 2.5 Pro writes the curses. Without a Gemini key, the app uses OpenAI's GPT-4.1-mini instead. If the model call fails, the genie picks from a short list of pre-written curses. The model reads each wish, gives it a curse, and returns a power that is technically valid but practically useless. Holding the model to that structure made the outputs more consistent and easier to read, and funnier.

It all runs on AWS. The diagram comes from the project's README, and its model names are older than the code:

```text
                         ┌──────────────────────────────┐
                         │        CloudFront CDN        │
                         │     + WAF (4 rule groups)    │
                         └──────────────┬───────────────┘
                                        │
                         ┌──────────────▼─────────────────┐
                         │     Application Load Balancer  │
                         │   (TLS 1.3, path-based routing)│
                         └───────┬──────────────┬─────────┘
                                 │              │
                    /api/*       │              │    /*
                   ┌─────────────▼──┐   ┌──────▼────────────┐
                   │   ECS Fargate  │   │   ECS Fargate     │
                   │   Fastify API  │   │   Next.js Web     │
                   │                │   │                   │
                   │  ┌──────────┐  │   │  Security Headers │
                   │  │ Helmet   │  │   │  HSTS, CSP, etc.  │
                   │  │ Rate Lim │  │   └───────────────────┘
                   │  │ Circuit  │  │
                   │  │ Breakers │  │
                   │  └──────────┘  │
                   └───────┬────────┘
                           │
              ┌────────────▼────────────┐
              │    EFS (Encrypted)      │
              │    SQLite + WAL mode    │
              │    Daily backups        │
              └─────────────────────────┘
                           │
            ┌──────────────┼──────────────┐
            │              │              │
      ┌─────▼─────┐ ┌─────▼─────┐ ┌─────▼──────┐
      │  Gemini   │ │  OpenAI   │ │  OpenAI    │
      │  2.5 Flash│ │  GPT-4o   │ │  Moderation│
      │ (primary) │ │  (backup) │ │  API       │
      └───────────┘ └───────────┘ └────────────┘
```

The rest of the project grew to match:

- npm workspaces and Turborepo
- a shared, type-safe schema package
- OpenAPI 3.1
- 9 architecture decision records
- Terraform-managed AWS infrastructure
- CI with typecheck, lint, unit tests, E2E tests and commitlint
- Husky hooks and Conventional Commits enforcement
- a runbook, an incident response guide and a service level agreement

It also has 100% unit test coverage.

![Unit test report showing 100% coverage.](/blog/i-built-an-ai-app-that-gives-you-superpowers-but-makes-them-useless/4.png)

I spent real time on security too. Traffic goes through CloudFront and AWS WAF, requests are rate limited and validated with Zod, and Cloudflare Turnstile handles CAPTCHAs. The API checks each wish against blocked words and prompt-injection patterns before it reaches the model. The AI providers sit behind circuit breakers, and the repo has a guide for reporting vulnerabilities.

The app also speaks HTCPCP, the joke protocol where a server answers `418` because it's a teapot. I entered it for Best Google AI Usage, Best Ode to Larry Masinter and the main DEV April Fools Challenge.