AI code reviewer caught a real security bug but its own fix would have broken the app

·2 views

A developer using Claude Code to write browser tools installed CodeRabbit, an AI code reviewer, to audit a CSV export feature in a pricing calculator. On its default 'CHILL' profile, the tool raised no concerns, but switching to the stricter 'assertive' mode flagged a legitimate CSV formula injection vulnerability (CWE-1236). The tool's suggested patch to fix the issue was technically plausible but flawed — it would have silently converted negative numbers like -1.50 into text strings, breaking the profit column calculations. The developer wrote a custom fix, which the AI then critiqued again, correctly identifying an edge case involving scientific notation like -1e-7. The episode illustrates both the value and the limits of AI-assisted code review: it can detect real vulnerabilities and reason through code, but still lacks full context about how specific values behave at runtime.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

LLM Agents Face Expanding Attack Surfaces as Deployment Moves to Production

As large language model (LLM) agents move from research settings into real-world production environments, security researchers have identified a significantly wider range of vulnerabilities compared to traditional LLMs. Key risks include prompt injection attacks, where malicious instructions embedded in user input or external data manipulate agent behavior, and knowledge-base poisoning that corrupts retrieval-augmented generation (RAG) systems with false information. A 2026 study dubbed SWE-Gate found that among 644 patches generated by a software engineering agent, 221 violated code review constraints despite passing functional tests, illustrating how agents can be subtly exploited. Researchers also flagged supply-chain threats, where malicious logic is hidden inside model templates, configuration files, or pretrained checkpoints, affecting all 15 LLMs and VLMs tested. Recommended defenses include layered prompt sanitization, tiered tool permissions, trust-score-based agent governance, and cryptographic verification of model artifacts.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

React 18 Strict Mode Double-Fires useEffect to Catch Real Cleanup Bugs

A development team discovered duplicate database records after a POST request inside a useEffect hook fired twice on every page load. The cause was React 18's Strict Mode, which deliberately mounts, unmounts, and remounts components in development to expose effects that lack proper cleanup. The duplicate-insert bug was already present in production code, where it could have surfaced unpredictably as a race condition rather than a consistent, reproducible pattern. The correct fix involves both adding a cleanup function to handle remounting safely and making side effects with real-world consequences idempotent or explicitly guarded against double execution. The team recommends keeping Strict Mode enabled across all environments, including staging, as it provides automatic, zero-cost testing of effect cleanup behavior on every page load.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Unsloth Desktop Offers One-Click Local AI Setup for Mac and Windows Users

Unsloth Desktop, now available in beta, is a new application that simplifies running large language models locally on personal hardware with a single-click installer. The software wraps around existing open-source tools like llama.cpp and MLX, handling installation, updates, and model configuration automatically. It integrates directly with Hugging Face, the AI model repository that Nvidia is reportedly acquiring for $13 billion, allowing users to browse and download models through a simple interface. The app also helps users choose appropriate models by flagging those that exceed their hardware's memory capacity with labels like 'TIGHT' or 'OOM', removing much of the guesswork around VRAM requirements. Running AI locally offers benefits such as no subscription fees, no internet requirement, and full data privacy, making it particularly appealing for privacy-conscious individuals and businesses.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Adjust animation speed via playback FPS, not by redrawing sprite sheets

Game developers often unnecessarily modify sprite sheets when animation speed feels off, but the fix usually lies in adjusting playback FPS rather than adding or changing frames. The same eight-frame sprite sheet can produce a one-second loop at 8 fps, a two-thirds-second loop at 12 fps, or a half-second loop at 16 fps — no pixel changes required. Developers should distinguish between source FPS, frame count, and playback FPS, as these are independent variables that together determine how an animation feels in-game. To avoid rounding drift when calculating frame timing, each boundary should be derived from its index rather than by repeatedly adding a fixed hold duration. Both Godot and Phaser offer engine-level controls for animation speed, and tools like the FrameSprite timing calculator can help export per-frame timing data for more precise adjustments.

0 comments Read more at DEV Community