MKishoreDev/en-peyar

En Peyar gives a focused cultural idea a working product instead of stopping at a basic AI prompt interface. The Flask backend uses a multi-stage naming process that builds a brief, extracts Tamil roots, generates candidates, scores them, and runs a final critique. It supports pure Tamil, Global Tamil, English, and heritage-based naming styles while applying context rules to avoid irrelevant historical references. The frontend adds useful tools such as bilingual English and Tamil content, a 38-district Tamil Nadu explorer, Thirukkural inspiration, domain checks, pronunciation support, brand previews, logo prompts, dark mode, and a locally saved shortlist. The district data, translation files, screenshots, environment template, MIT license, contribution guide, security headers, compression, and Renovate configuration show care beyond the main generator.

The main weakness is reliability around the strong feature set. There are no automated tests or GitHub Actions workflows, and the package test command intentionally fails. Tests should cover malformed AI responses, provider failures, Tamil output rules, translation-key parity, and the public API routes. Browser tests would help protect the generator, map, shortlist, and language switching. The README installation steps also tell users to run npm run dev, but that script does not exist. The actual setup uses Python, Flask, and python app.py, as correctly explained in the contribution guide. The package metadata lists an ISC license while the repository uses MIT, which should be corrected.

Security needs attention before wider use. User keywords and AI-generated fields are inserted into innerHTML without visible sanitization, while the content security policy permits inline scripts and unsafe-eval. That combination creates avoidable cross-site scripting risk. The generation and text-to-speech endpoints also lack rate limiting and input-length controls, and backend error responses can expose internal provider details. Adding output escaping, stricter CSP rules, request limits, generic production errors, and API throttling would make the service safer and control AI costs. The offline claim should also be narrowed or completed because the service worker caches only the homepage, CSS, and two images, not the scripts and data needed for the full experience. These are fixable gaps in an original project with a clear purpose and substantial implementation.