Agent PR's Cache Key Omits Tenant ID, Risking Cross-Tenant Data Leakage

·1 views

A pull request meant to reduce latency by skipping duplicate model calls was reviewed and found to contain serious caching flaws. The cache key is derived only from the prompt text, so tenants sending identical prompts would share cached responses. Failed or empty upstream results were also stored and reused, and the cache had no size limit, expiry, or eviction. The original test suite only covered the happy path and passed despite these defects. The reviewer proposed a corrected key that includes the tenant, model, and prompt, along with isolation and failure tests that expose the original bugs.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds Local AI Tool to Extract Invoice Details and Draft Payment Reminders

A developer has built Smart Invoice Assistant, a small web app that uses a locally running AI model to pull key details from invoices. The tool extracts the client name, invoice number, amount, currency, and due date from pasted invoice text. It can also generate polite payment reminder drafts that users can copy for later use. The app runs on Node.js with the Ollama service and the open-weight Qwen 2.5 3B model on the user's own machine, rather than relying on a paid external AI API. The project is an early local-only version, and the developer plans to add PDF upload, invoice history, and better error handling.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Firefox on Mac: How It Differs from Safari and Chrome

A guide outlines how Firefox on macOS compares with Safari and Chrome. Safari offers tighter integration with iCloud Keychain, macOS proxy settings, Apple Watch unlock, and a more polished Reader Mode. Firefox matches Safari on Picture-in-Picture and dark mode, and it still supports Manifest V2 extensions, which permit fuller ad blocking than Chrome's shift to MV3. Firefox runs natively on Apple Silicon and can be installed from mozilla.org or Homebrew, with memory use generally lower than Chrome. The article also notes that switching browsers requires moving passwords out of Keychain or using a cross-platform password manager, and that Firefox containers and session management offer features Safari lacks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Open-Source Invoice Assistant Runs AI Locally to Manage Freelancer Expenses

A developer has built InvoiceMate AI, a local-first assistant that helps freelancers, developers, consultants, and small business owners manage invoices and receipts. The tool uses local OCR and an open-weight language model via Ollama to extract vendor names, dates, totals, taxes, and categories without paid API requests. Extracted data is checked by validation logic and reviewed by the user before being saved to local SQLite storage. The project, built with React, TypeScript, Python, and FastAPI, is designed to work offline after initial setup and is open to community contributions on GitHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI agent's model comparison experiment flawed by unverified runtime model identity

An AI agent set out to test whether a different model would understand its decision-making document the same way. The second reader, running on a model from another company, matched four of seven questions and all five protected values. However, the reader could not confirm its actual runtime model, relying instead on an outdated name in its setup file. The reader also saw extra lines because its search pulled in terms from other sections, so the result cannot isolate the model as the cause. The author concludes the result is one unconfirmed sample and that the model variable was never measured.

0 comments Read more at DEV Community