A weather app that finds you, then shows you what is overhead. Built in 2017 and hosted on my first personal website, which is no longer up.
This is the one project from that site I cannot put back online, and the reason is worth more than the app was.
What it did
- Browser Geolocation API for position, with an error path for a declined prompt
- Current conditions, forecast, astronomy and webcams from Weather Underground
- A radar image layer centred on the user’s coordinates
- Cloud and precipitation tile overlays on a slippy map
- Fahrenheit/Celsius toggle, tracking high and low separately
- A hand-picked icon per condition — clear, partly cloudy, light rain, lightning, hail, snow
Why it cannot go live
Weather Underground retired its public API in 2019. That endpoint now returns 503, and
every data path in this app — conditions, forecast, and the radar tiles — went through it.
There is a detail here I only found while preparing this page. The app declared an
openWeatherMapKey variable, which suggested a second provider and a possible fallback. It is
never referenced anywhere in the file. I evidently started migrating to OpenWeatherMap in 2017
and stopped, and I would not have known that without going back and reading it properly nine
years later.
So bringing this back is not a configuration problem, it is a port to a current provider. That is a contained piece of work rather than a rewrite, and it is on the list.
Cleaning it up anyway
Even without a working app, the repository needed attention before going public. It contained, in the working tree:
| Credential | Where |
|---|---|
| Google Maps API key | inline in index.html |
| Weather Underground key | a variable, and inlined directly into the radar tile URL |
| OpenWeatherMap app IDs | live code and commented-out code |
| Mapbox access token | commented-out tile layer experiments |
Plus a stray javascript/backup file whose only purpose was holding older copies of the same
keys, and a Google Analytics property.
All of it is now out of the source. Google Maps loads at runtime from a gitignored
config.js, with a config.example.js committed in its place.
Two honest caveats. Removing a key from the working tree does not revoke it — these are still in the git history and had to be rotated at each provider separately. And this was always a browser-side app: the key reaches the client no matter where it is stored, so the real answer for a public build is a referrer-restricted key or a small proxy, not a better hiding place.