AI Coding Tools Routinely Introduce Security Flaws, Code Scans Reveal

·1 views

Popular AI coding assistants like GitHub Copilot, Cursor, and Bolt are generating code with serious security vulnerabilities, according to findings from scans using nine security engines. Because these tools are trained on public repositories — which frequently contain security mistakes — they reproduce common flaws such as hardcoded API keys, open CORS settings, unpinned dependencies, and missing input validation. Researchers found that every AI-generated project they scanned contained at least one exposed credential or token committed directly to source code. The AI tools are not intentionally flawed; they function as pattern matchers that replicate whatever practices dominate their training data, including insecure ones. Developers are advised to use environment variables for secrets, pin dependency versions, restrict CORS to specific domains, and employ scanning tools like Gitleaks, Semgrep, and OSV-Scanner to catch these issues before deployment.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Rizzzler v1.2 Brings Security Fixes, Shared Config Registry, and Better Analytics

Rizzzler, an open-source customizable profile platform, has released version 1.2 following developer feedback that identified security gaps and architectural weaknesses. The update introduces a shared customization registry, ensuring the client and server remain in sync and eliminating duplicated configuration between the frontend and backend. Server-side validation now rejects any unregistered customization values, closing a loophole that allowed manually crafted requests to store invalid data. Storage efficiency has been improved by capping profile image uploads at 2 MB and automatically deleting unverified accounts that remain inactive for 15 days. The admin dashboard has also been significantly expanded to track visitor metrics, user activity, device data, and referral sources.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Set Up SPF, DKIM, and DMARC to Fix Email Deliverability Issues

Email authentication relies on three DNS-based mechanisms — SPF, DKIM, and DMARC — that together verify sender identity and protect domains from spoofing. SPF specifies which servers are authorised to send mail for a domain, DKIM cryptographically signs messages to confirm they were not tampered with, and DMARC sets the policy for handling failures while generating reports. Common setup mistakes include publishing duplicate SPF records, proxying DKIM CNAME entries through Cloudflare, and jumping straight to a strict DMARC rejection policy before monitoring legitimate mail flows. Experts recommend starting DMARC in monitoring mode (p=none) for a few weeks to identify all sending sources before escalating to quarantine and then reject. Since 2024, both Gmail and Yahoo require a valid DMARC record for bulk senders, making proper configuration essential for inbox delivery.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI Infrastructure's Real Bottleneck Is Memory Bandwidth, Not Raw Compute

The true constraint in AI infrastructure is not processing power but the physical layer — chips, power, cooling, and data centers — which analysts argue represents the more investable side of the AI boom. Running a large language model involves two distinct tasks: prefill, which processes input tokens in parallel and suits GPUs well, and decode, which generates output tokens sequentially and is bottlenecked by memory bandwidth. During decode, the chip must read an entire model's weights from memory to produce each single token, making memory speed the limiting factor rather than raw computation. Power availability has emerged as an equally critical constraint, since grid capacity cannot be rapidly expanded regardless of capital, making performance-per-watt a core business metric for data center operators. Groq is cited as a notable example of a company that identified and targeted this memory-bandwidth bottleneck rather than competing on conventional compute metrics.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google Launches Gemini 3.6 Flash and 3.5 Flash-Lite with Distinct Use Cases

Google made Gemini 3.6 Flash and Gemini 3.5 Flash-Lite generally available on July 21, 2026, as two distinct tiers within its Gemini API lineup. Both models support a 1-million-token context window, up to 64K output tokens, and built-in tools including Computer Use. Gemini 3.6 Flash is designed for coding, multimodal reasoning, and complex agent workflows, while the more affordable Flash-Lite targets high-volume tasks like extraction, classification, and request routing. Developers migrating existing applications must remove deprecated parameters such as temperature, top_p, and top_k, as the new models no longer accept them. Google recommends routing workloads by task type rather than treating either model as a universal replacement for previous versions.

0 comments Read more at DEV Community