Audit of 50 AI-coded Projects Reveals 4 Recurring Security Flaws in Cursor and Claude Output

·1 views

A developer who audited 50 projects built using Cursor and Claude identified four recurring security and performance issues in AI-generated code. The most common problems included missing tenant isolation in database queries, insecure webhook token comparisons, network calls placed inside active database transactions, and the use of floating-point numbers for currency calculations. The developer attributes these flaws to AI coding tools prioritizing functional code over production-ready, secure code, especially during long chat sessions where system prompts are forgotten. To address this, they released an open-source tool called secure-code, which injects security and performance constraints into Cursor, Claude, and Copilot configuration files via a single terminal command. The project supports TypeScript, Python, Go, Rust, and several other languages, and is available under the MIT license on GitHub.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

oxlint outpaces ESLint by 13x on Vue core, even with type-aware rules enabled

A developer benchmarked ESLint and oxlint against Vue's core repository — 445 TypeScript files totalling around 150,000 lines — using both syntactic and type-aware rule sets. ESLint completed the plain syntactic pass in 4.4 seconds and climbed to 12 seconds when type-aware rules were enabled, requiring the TypeScript compiler to run first. oxlint, a Rust-based linter built by VoidZero — the company founded by Vue and Vite creator Evan You — finished the syntactic pass in just 0.24 seconds, with its internal engine time recorded at 75 milliseconds. When oxlint's own type-aware mode was enabled via the --type-aware flag, it completed the same class of analysis in 0.9 seconds, roughly 13 times faster than ESLint's equivalent pass. The author noted that while the rule sets are not identical between the two tools, the results challenge the assumption that oxlint's speed comes from skipping expensive checks rather than from genuine performance gains.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a deprecated cryptographic key exposed a flaw in schema validation design

A developer encountered a validation failure after adding a retired signing key whose scheme was no longer in the accepted set. Rather than widening the live set or discarding the old key, the solution was to introduce a separate 'schemes_retired' field, keeping the two sets distinct by capability rather than by time. The published specification was updated by retiring the old claim and adding a new scoped one alongside it, preserving an auditable record of the change. A pre-existing audit tool flagged the retired key as a violation, but this was logged as a known gap rather than silently patched, to avoid masking an underlying design flaw. The episode highlighted how naming conventions and set boundaries that appear cosmetic can carry real downstream consequences for counters, audits, and published guarantees.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why a Single Accuracy Score Can't Measure Bot Detection's Real Cost

Bot detection systems that report high overall accuracy can still cause significant harm by wrongly blocking legitimate users, a problem known as false positives. The consequences vary sharply by route — a blocked checkout interrupts revenue, while a failed password reset locks out a real customer. Because most traffic on consumer-facing apps is legitimate, a detector can appear 99.7% accurate while still mishandling thousands of genuine requests daily. Experts recommend evaluating three separate metrics — precision, recall, and false-positive rate — rather than relying on a single aggregate score. Different enforcement actions such as hard blocks, challenges, and monitoring should each be governed by different thresholds based on the cost of each type of error.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agent Authentication in 2026 Requires Layered Stack, Not a Single Protocol

As AI agents grow more complex, experts warn that no single protocol can handle their full authentication needs. A 2026 IETF Internet-Draft proposed a multi-layer architecture covering agent credentials, delegated user authority, workload identity, authorization, and audit trails. Google separately announced the open Agentic Resource Discovery (ARD) specification to help agents find and verify agentic capabilities without relying on hard-coded endpoints. Together, ARD, Web Bot Auth, OAuth, and workload identity standards each address distinct gaps in the agent identity chain. Collapsing these layers into a single API key, experts note, eliminates the audit trail and exposes systems to serious security risks.

0 comments Read more at DEV Community