AI Coding Tools Routinely Ship Broken Access Controls, Open-Source Scanner Aims to Prove Fixes Work

·1 views

A common security flaw in AI-generated code allows any user to access another user's private data simply by changing an ID in a URL, because AI tools default to using service-role keys that bypass row-level security. This vulnerability has been observed repeatedly in apps built with tools like Lovable, Bolt, v0, Cursor, and Claude Code. An open-source scanner called auditai-scanner was built specifically to detect and verify fixes for this flaw, going beyond flagging potential issues by reproducing them in a sandboxed environment with synthetic test users. Rather than relying on the same AI model to both write and evaluate a fix, the tool independently confirms whether a cross-tenant data leak is actually closed before marking a finding as resolved. The project also generates a regression test from each reproduction, ensuring the vulnerability cannot be silently reintroduced in future code changes.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Bol's dev team shares hard lessons from migrating Backstage platform to pnpm

Developers at Dutch retailer bol migrated their internal Backstage developer platform from Yarn 4 to pnpm after five years, seeking better support for parallel Git worktree workflows used with coding agents. While the initial switch — pinning pnpm, replacing commands, and committing a new lockfile — was straightforward, CI pipelines repeatedly downloaded all 4,226 packages from scratch despite a cache being in place. The root cause was a mismatch between where pnpm wrote its store and where GitLab expected to find it, resolved by explicitly setting the store directory within the CI configuration. A further issue emerged when the cached archive ballooned to 1.42 GB across roughly 601,000 files because node_modules trees were included unnecessarily; dropping those reduced cache size by about 72%. The team concluded that package manager migrations surface hidden architectural assumptions, particularly around cache paths and what is actually worth caching.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Frontend Developers Need Stateful Mock APIs Over Static Ones

Frontend developers often rely on static mock APIs like JSONPlaceholder during backend development, but these tools fail to persist data across requests, causing issues such as newly created items vanishing after a page refresh. Static mock servers simply echo responses without storing any state, meaning POST, PUT, PATCH, and DELETE operations have no lasting effect on subsequent GET calls. This limitation breaks modern frontend patterns like query caching, optimistic UI updates, and reactive state management. Stateful mock APIs address this by maintaining a per-session overlay layer that merges mutations with baseline seed data, simulating real backend behavior. Tools built on this architecture allow developers to test full CRUD flows, conditional UI states, and multi-step navigation without needing an actual database.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How One Developer Ships a Real Mobile App Using an Entirely Free Tech Stack

A developer has built and deployed a fully functional mobile app with real users without incurring any monthly infrastructure costs. The stack combines Expo for mobile builds, Supabase for database and authentication, Render for background jobs, and Vercel for landing page hosting — all on free tiers. Each service comes with limitations, such as Supabase pausing idle projects after seven days and Render services experiencing slow cold starts after 15 minutes of inactivity. The developer works around these constraints using scheduled pings and strategic build timing rather than paid upgrades. The setup demonstrates that, as of 2026, free tiers from major cloud platforms are generous enough to support a production-grade mobile app from launch onward.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Agentless Home Server Orchestrator with 100 Pre-Built Stacks and Local AI

A developer has released NjordDeploy, an open-source, agentless deployment orchestrator designed for self-hosted home lab setups on devices like Raspberry Pi and Proxmox. The tool runs entirely from a control machine over SSH, leaving no background agents or daemons on the target server, preserving its full resources for user applications. It includes over 100 production-ready service templates, supports both Docker and rootless Podman, and generates configurations using a fully local AI engine powered by Ollama. NjordDeploy evolved from an earlier project called PiSelfhosting and was built to address common pain points such as port conflicts, bloated management platforms, and cloud-dependent DevOps tools. All deployments produce standard docker-compose files, ensuring no vendor lock-in even if the tool itself is discontinued.

0 comments Read more at DEV Community