AI-Generated Login Routes Routinely Skip Rate Limiting, Leaving Apps Exposed

·1 views

A developer auditing 50 AI-generated login endpoints found that none included rate limiting, leaving them vulnerable to brute-force and credential-stuffing attacks. Tools like Cursor and Claude Code produce functionally correct authentication logic but omit rate-limiting middleware, which is a cross-cutting concern that sits outside the scope of a basic login route prompt. The gap stems from training data that predominantly shows login routes in isolation, without the surrounding infrastructure that enforces request throttling. The oversight maps to CWE-307, a known weakness covering improper restriction of excessive authentication attempts. Adding IP-based rate limiting requires just one package install and four lines of middleware configuration, though experts recommend pairing it with account-level lockouts for stronger production security.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Multi-Agent AI Workflows Keep Breaking in Production

A growing number of organizations are deploying multi-agent AI systems, with 57% already running multi-step workflows and 81% planning to expand into more complex use cases by 2026. However, the three dominant coordination patterns — sequential handoffs, group chat, and orchestrator-led collaboration — are consistently failing when moved from design to production. Core problems include agents lacking visibility into each other's reasoning, duplicated analysis, orphaned failures, and the inability to share state across different AI runtimes like Bedrock, Cursor, and Claude Managed Agents. Without centralized coordination memory and durable session tracking, every agent pair effectively has to rebuild context-sharing from scratch. Engineers who have found success are investing in shared session stores, event-based handoffs, and cross-runtime visibility layers as foundational infrastructure rather than afterthoughts.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five Contract Clauses That Matter More Than Price When Signing Vendor Deals

Most vendor negotiations concentrate on upfront pricing, but several other contract terms carry greater long-term consequences for buyers. Auto-renewal clauses with narrow cancellation windows can lock companies into unwanted renewals, often at higher rates, if deadlines are missed. Contracts that lack annual price-increase caps leave buyers exposed to unchecked rate hikes at renewal, when switching costs make it harder to push back. Data portability provisions and post-cancellation retention windows are rarely negotiated at signing but become critical when a company tries to exit a vendor relationship. Service level agreements and liability caps also deserve scrutiny, as weak remedies for downtime or data breaches can leave buyers with little recourse when real damage occurs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Moonshot AI Launches Kimi K3: 2.8T Parameter Open MoE Model With 1M Token Context

Moonshot AI has released Kimi K3, an open Mixture-of-Experts large language model with 2.8 trillion parameters and support for a one-million-token context window. The model introduces Kimi Delta Attention, a hybrid linear attention mechanism that enables up to 6.3 times faster decoding on long-context tasks. A second architectural innovation called Attention Residuals selectively reuses representations across network layers, reportedly boosting training efficiency by around 25 percent. Kimi K3 also features Stable LatentMoE with Quantile Balancing, a new expert-routing approach that achieves approximately 2.5 times better scaling efficiency compared to its predecessor, Kimi K2. In published benchmarks, the model outperforms competing systems in 6 of 35 categories, though it still trails in certain areas such as FrontierSWE and HLE-Full.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five Solidity scanner false positives that waste audit time and how to fix them

Static analysis tools used in Solidity smart contract audits frequently generate false positives that consume auditor time and can damage credibility if they appear in final reports. A heuristic scanner published on DEV Community identifies five recurring patterns that fool naive detectors, including safe fee-on-transfer delta checks being flagged as donation attacks and permissionless sweep functions misread as unprotected fund drains. Other common misfires include loose regex patterns matching variable names that contain reserved words like 'reserve' as substrings, and stack-variable assignments being misclassified as post-external-call storage writes. The author argues each false positive should be fixed at the rule level by teaching the scanner contextual awareness, such as recognising before/after balance deltas or checking whether a transfer destination is caller-controlled. The piece emphasises that muting rules is not a solution, and that when genuine uncertainty exists, auditors should retain a finding for human review rather than risk suppressing a real vulnerability.

0 comments Read more at DEV Community