SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

AI-Built Apps Compile Fine but Fail Security Checks Half the Time, Studies Show

0
·1 views

A 2026 Veracode report analyzing code from over 100 AI models found that while AI-generated code achieves near-perfect syntax compliance, it passes security tests only 56% of the time on average when no security prompting or human review is involved. The findings are based on raw model outputs without guardrails, meaning the results reflect code that ships without any security oversight — a pattern common in small business app development. Two real-world cases illustrate the risk: a 2025 scan of 1,645 projects on Lovable's showcase found roughly 10% exposed sensitive user data due to missing or misconfigured database security rules. In Supabase-backed apps, the vulnerability stems not from a public API key — which is by design — but from absent Row Level Security policies that should restrict what data any given user can access. The core concern is not that AI code is inherently insecure, but that apps built quickly with AI assistants and never reviewed by security professionals are quietly going live with exploitable gaps.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

27B LLM Squeezed Under 6GB via Ternary Quantization, But CPU Speed Disappoints

A developer tested Prism's Ternary-Bonsai-2-27B, a ternary-quantized large language model that compresses a 27-billion-parameter model into under 6GB, on a budget Hetzner VPS with no GPU. The model uses an aggressive PTQ1_0 format where each weight is reduced to one of three values, requiring Prism's custom llama.cpp fork since the format is not yet supported upstream. While Simon Willison had reported 20–44 tokens per second on Apple Silicon with Metal acceleration, the CPU-only test on the VPS yielded just 2–3 tokens per second. At that speed, the model is viable for background batch processing but impractical for real-time interactive use. The tester also noted an unexplained throughput variance of up to 40 percent between server restarts with no configuration changes.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why AI Systems Need New Observability Metrics Beyond Latency and Uptime

Traditional software monitoring tools are inadequate for AI-native systems because they measure technical success rather than output quality, missing failures like hallucinations, biased responses, or unsafe content. A technically successful HTTP 200 response can mask serious problems such as fabricated information, ignored retrieval context, or policy violations. Large language models introduce non-deterministic behavior, meaning identical inputs can produce varied outputs and quality can degrade silently after model or prompt updates. Experts advocate for a dual observability strategy that combines conventional infrastructure metrics with AI-specific Service Level Indicators (SLIs) measuring trustworthiness, relevance, and safety. Without these specialized SLIs, organizations risk deploying AI systems that appear operationally healthy but are fundamentally unreliable or harmful in real-world use.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

URL Encoding Pitfalls: Why %20, +, and Special Characters Break APIs

URLs are composed of distinct parts — scheme, host, path, query string, and fragment — each with its own encoding rules, and treating them as uniform text is a common source of bugs. Characters like &, #, =, and ? carry structural meaning in URLs, so user-supplied data containing these must be properly encoded before being inserted into a URL component. A frequent source of confusion is that spaces can be represented as either %20 or + depending on context: standard percent-encoding uses %20, while HTML form encoding uses +, and a literal plus sign must be encoded as %2B to avoid being misread as a space. JavaScript developers often misuse encodeURI() and encodeURIComponent(), where the former preserves URL-structural characters and is unsafe for encoding individual values, while the latter correctly encodes characters like & and = within a single component. Using dedicated APIs such as URLSearchParams and the URL constructor is generally the safer and clearer approach for building URLs with dynamic query parameters.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer audits 2 months of Claude Code sessions, finds $1,675 in API costs and 117 risky deletes

A developer building an AI safety tool called Paveo replayed 59 days of their own Claude Code sessions to stress-test the product before releasing it publicly. Across 106 sessions and over 8,000 model calls, the usage would have cost $1,674.75 at standard API rates, with one single session reaching $452.92. A starter safety policy, when applied retroactively to all tool calls, would have blocked 670 actions, including 117 recursive force-delete commands and 3 forced git cleans. The developer notes that not every blocked command would have been a genuine mistake, but argues that a false refusal is preferable to an unrecoverable data loss. Paveo, which runs locally without any network access and supports multiple AI coding tools, is set to become publicly available this week.

0 comments Read more at DEV Community
AI-Built Apps Compile Fine but Fail Security Checks Half the Time, Studies Show · ShortSingh