AgenticJobs Bug Let Anyone Hijack Accounts via Magic Link Rendered in Browser

·1 views

A security flaw in the AgenticJobs job board platform allowed any visitor to obtain a valid magic-link sign-in for any email address they typed, without owning that address. The bug stemmed from an SMTP configuration field that was declared in code but never backed by an actual mail-sending library, meaning the app always fell through to a dev-only fallback that rendered the login link directly in the browser. Because the magic-link endpoint also auto-created accounts, an attacker could silently take over or create any account with no prior access required. The issue was discovered accidentally when a Resend API call rejected a test address, prompting a closer audit of the authentication flow. Version 0.3.0 patches the flaw by wiring up real email delivery via Resend, ensuring credentials never appear in a browser response under any circumstances.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AI Trading Agent Sets Stop-Loss in 44 Seconds, Then Goes Absent for the Full Session

An AI trading agent known as 'Afu', running on the open-source DuDuClaw platform, completed its entire pre-market analysis for Day 22 of a 30-day experiment within just 44 seconds on the morning of that trading day. The agent correctly recalculated a stop-loss for ETF 00919 at 32.06, a task it had missed the previous day, by simply reapplying its standard formula to the latest closing price. However, scheduled mid-session monitoring checks at 10:30 a.m. and 12:30 p.m. produced no log entries, meaning the agent was effectively absent throughout the trading session. The ETF closed at 32.58, never approaching the stop-loss threshold, so the lack of oversight had no immediate financial consequence. The experiment highlights a key gap in the agent's design: it can execute a disciplined pre-market routine but has so far failed to sustain that discipline across a full trading day.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Browser Reaction Tests Vary and How to Get Consistent Results

Browser-based reaction time tests are affected by factors like display refresh rate, input latency, and device setup, making single results unreliable. Experts suggest focusing on personal performance trends rather than treating any one score as a definitive measure of reaction speed. To improve consistency, users should stick to the same device, browser, and input method across multiple test sessions and compare median scores over time. A free tool called ReflexPeak has been built around this philosophy, offering browser-based reaction, memory, and focus tests that store results locally for personal benchmarking. The key takeaway is that such tools are best used as personal performance exercises, not as medical or neurological assessments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Shadow Agent Problem: Why AI Agents Need Action-Layer Governance

As AI agents become more common in enterprise environments, developers can deploy them using personal API keys with access to sensitive internal tools — often without security reviews or centralized oversight. Unlike traditional Shadow IT, these agents do not merely access data; they can autonomously trigger payments, modify infrastructure, and automate decisions at machine speed. Existing identity and access management controls address who can connect to systems but fail to evaluate whether a specific action should be permitted in real time. Experts argue that governance must shift to the execution layer, where a policy engine intercepts and evaluates every high-impact action before it takes effect. This architectural approach removes the need to catalog every agent in advance, instead focusing oversight on the actions agents perform.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Exposed Gemini API Key Costs Developer Hundreds of Dollars, Shuts Down AI App

A solo developer's AI language-learning app, RadioShadow, was suspended overnight after an exposed Gemini API key was scraped by an unauthorized bot within minutes of a deployment. The bot ran high-frequency automated requests that racked up nearly HK$300 in charges in a single day, triggering Google's automated security systems to freeze the entire project. The developer responded by deleting the compromised key, routing all AI calls through server-side Next.js route handlers with rate limiting, and setting up strict billing alerts. RadioShadow is a web app that helps language learners overcome the intermediate plateau by combining live global radio streams with real-time AI transcription, translation, and pronunciation feedback. The incident highlights a critical security lesson: API keys should never be exposed in client-facing code, even temporarily during testing.

0 comments Read more at DEV Community