64% of Leaked Credentials From 2022 Still Valid in 2026, Report Finds

·5 views

A report by GitGuardian's State of Secrets Sprawl 2026 highlights a growing problem of credential exposure persisting across security tools and environments. A single API key can travel from a developer's laptop to code repositories, pipeline logs, support tickets, and teammate configs, creating multiple copies with identical access privileges. Security tools such as repo scanners, endpoint agents, and vaults each guard their own territory but no single tool tracks a credential across all the environments it touches. The report found that 28% of secrets incidents occur entirely outside code repositories, in collaboration and productivity platforms where scanners never look. Most alarmingly, over 64% of credentials found exposed in public repositories in 2022 were still active when retested in January 2026.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Fine-Tunes Open LLMs to Support Moroccan Arabic Darija and Arabizi

A developer has released two open-source language models, SILMA-9B-Darija and SILMA-2B-Darija, specifically fine-tuned to handle Moroccan Arabic (Darija) and Arabizi, the Latin-script form of Arabic that uses numbers for certain sounds. The models were trained on a dataset of over 46,000 cleaned Darija instruction and conversation pairs drawn from real Moroccan exchanges and cultural content. Benchmarks run on a 100-question test covering local history, proverbs, and code-switching showed both models outperforming existing Moroccan-dialect alternatives on accuracy and Darija fluency. Unlike standard Arabic models that default to Gulf Arabic or Modern Standard Arabic, the new models retain native Darija vocabulary and handle prompts in both Arabic script and Latin letters. Both models are publicly available on Hugging Face, with the 9B version requiring around 6 GB VRAM and the 2B version running on under 3 GB, making it suitable for consumer devices.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why coding knowledge still matters in the age of AI-generated code

A software developer argues that while AI tools can generate code faster and often cleaner than humans, the critical skills of evaluating correctness, spotting hidden flaws, and understanding trade-offs remain entirely human responsibilities. The author contends that cheap code generation has not eliminated complexity but shifted it — making careful code review more costly and easier to skip, not less important. Developers who cannot read code risk silently accepting poor structural decisions, swallowed errors, or mismatched design patterns embedded in AI output. The piece highlights specific danger zones including debugging, security vulnerabilities, and architecture, where AI-generated solutions can appear locally correct while being globally flawed. The core argument is that coding literacy is no longer about typing speed but about maintaining the judgment needed to verify, challenge, and own what gets built.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

12 critical questions to ask vendors before buying a text-to-SQL tool

A technical guide published on DEV Community outlines 12 evaluation questions buyers should ask text-to-SQL vendors before committing to a purchase. The article argues that product demos are misleading because they typically showcase clean, small schemas, while real-world databases are far more complex and error-prone. Key concerns raised include how vendors measure accuracy, what verification badges actually certify, and whether identical questions phrased differently return consistent results. The piece warns that wrong answers from such tools are especially dangerous because end users, particularly in finance, often cannot distinguish correct outputs from plausible-looking incorrect ones. Buyers are advised to test vendors live during meetings using questions with known answers rather than relying on polished demonstrations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

30-Day AI Self-Review Experiment Missed a Bug a Human Caught in 5 Minutes

A developer ran a 30-day experiment in which an AI model reviewed every pull request it generated, supported by static analysis and linting tools. The setup performed reliably for 29 days, catching minor issues and enforcing coding standards. On day 30, a human engineer identified a race condition in under five minutes — a logic flaw tied to real-world user behavior that the AI had repeatedly overlooked. The bug stemmed from a mismatch between the system's assumptions and actual user actions, something the AI could not detect because it lacked domain context and understanding of intent. The author concluded that AI review works best as a complement to human review, handling repetitive checks while humans focus on logic, design decisions, and user impact.

0 comments Read more at DEV Community