AI Coding Tools Like Cursor Can Introduce Dangerous CORS Vulnerability in APIs

·1 views

AI-powered code editors such as Cursor often fix CORS errors by reflecting the request's Origin header back to the browser while also enabling credentials, a pattern classified under CWE-942. This approach silently allows any website to make authenticated requests to an API using a victim's session cookies. The flaw goes undetected during local development because the reflection works seamlessly across all ports and preview URLs, masking the security risk. It typically surfaces only during a security audit or penetration test. Developers are advised to replace origin reflection with a hardcoded allowlist of trusted domains checked against each incoming request.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why OpenSearch Multi-Tenant Architectures Fail at Scale and How to Fix Them

Most search applications are inherently multi-tenant, whether built for SaaS customers, e-commerce sellers, or fintech users, but architectures that work smoothly at small scale often break down at hundreds of thousands of tenants. The standard log-analytics approach of large shards and daily index rollovers optimizes for write throughput but forces every user query to fan out across dozens of shards, overwhelming coordination overhead. The opposite strategy of giving each tenant a dedicated index delivers clean isolation but causes cluster metadata to balloon, eventually choking master nodes as tenant counts reach tens of thousands. Neither conventional playbook was designed for high-volume, per-tenant query workloads that sit at the intersection of logging and search. The article argues that reaching million-tenant scale on Amazon OpenSearch Service requires moving beyond both defaults toward hybrid architectural patterns that balance shard efficiency with tenant isolation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Classic Search Engines Still Matter in the Age of AI and LLMs

A software engineer with two decades of search experience, including work on Amazon CloudSearch and OpenSearch Service, argues that lexical search remains essential despite the rise of AI and large language models. Traditional search engines rely on inverted indexes, which map terms across billions of documents to deliver ranked results in milliseconds — a process far more sophisticated than simple word matching. Relevance ranking techniques such as BM25, TF-IDF, and field boosting represent decades of refinement that modern AI commentary often dismisses too quickly. The author warns that treating classic search as obsolete can lead to real production failures, since databases were never designed to handle relevance scoring at search-engine scale. Understanding how traditional search actually works, the piece contends, is a prerequisite for making sense of what genuinely changes when AI enters the picture.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

18-Part Series on AI and Team Structure Concludes With Core Argument Stated Plainly

A long-running essay series on the DEV Community platform has wrapped up with its 18th installment, titled 'The Hestia,' which explicitly states the central thesis the previous posts had been building toward. The series argued that companies are layering AI onto outdated processes rather than rethinking how teams should function when implementation speed is no longer a bottleneck. Across its run, the series examined topics including accountability, role obsolescence, decision-making structures, knowledge transfer, and how understanding spreads across organizations. The final essay uses the ancient Greek symbol of the hearth fire — carried from one settlement to another rather than started anew — as a metaphor for continuity of intent and shared responsibility. The closing piece ties together threads on representation, trust, and the limits of any single room or team in making decisions that hold meaning beyond it.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Veteran Crypto Developer Documents First Sherlock Audit Contest Attempt With Raw Honesty

An 18-year software developer with eight years in crypto has publicly shared their experience signing up for their first Sherlock audit contest, a competitive bug-bounty style platform where auditors called Watsons compete for severity-based prize pools. The developer, who built an open-source AI smart contract auditing tool called spectr-ai, acknowledges that writing secure code professionally does not translate directly to competing on a public leaderboard. Rather than aiming to win, they set a modest first goal of submitting two fully defensible valid issues, the minimum typically needed to advance beyond the entry tier. Their preparation involved studying past Sherlock contest reports to understand judging patterns, with recurring findings including rounding errors, access control flaws, and oracle assumptions that fail on Layer 2 networks. They also outlined a structured methodology using local AI models to generate specific attack-path hypotheses, with a personal rule that no submission goes in without a working Foundry proof of concept.

0 comments Read more at DEV Community