AWS Kiro Bots Default to Trust Mode, and Crew's Sandbox Leaves ~/.ssh Visible

·3 views

AWS's Kiro team made bots generally available in Kiro Crew on November 5, letting users run named agents that handle ongoing tasks such as issue triage or CI monitoring. The article notes that newly created bots start in Trust mode, which acts without per-action approval, subject to a security policy. Crew's default sandbox setting, auto, hides some credential directories but leaves .aws, .ssh and .kube visible to agent subprocesses, though direct file-tool reads of credential files are blocked. The author advises users to review these defaults before granting bots access to sensitive systems such as CI pipelines.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Bitwarden Collection Management Settings Determine What Admins Can Access

Bitwarden organizations share vault items through collections, which define who can see or manage specific items. A collection-management setting decides whether owners and administrators automatically gain access to every collection or must be granted access explicitly. This distinction matters during incident response, since an admin who manages users may still be unable to read a protected collection. The article also notes that ZoomEye product counts reflect software footprint rather than exposed or misconfigured organizations. It recommends auditing roles, collection membership, group associations, and export capabilities, and revoking access thoroughly after an account compromise.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Self-Hosted n8n Audit Trail: Tracking Workflow Changes, Access, and Runs

A guide published on DEV Community explains how to build an audit trail for self-hosted n8n, since the platform lacks a built-in compliance console. It recommends treating audit records as three append-only streams: workflow version snapshots, access and credential events, and production execution summaries, all written to a Postgres table the operator controls. The article provides a sample table schema and advises storing identifiers, counts, hashes, and status rather than full payloads to keep personal data out of the log. Suggested methods include scheduled workflow exports that record a new entry only when the content hash changes, or Git-based backups mirrored into Postgres. It also recommends logging workflow activations, credential events by ID only, and login events from a reverse proxy or SSO layer.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Senatus Adds Transparent, Criteria-Based Scoring to Its AI Policy Debates

AI Senatus, a platform where AI senators argue policy questions in turns, has made scoring part of each debate rather than a verdict added at the end. Each argument is judged separately on its evidence, its costs, and the people it affects, so that claims are not blended together. The reasoning behind each score is shown alongside it in plain language, letting readers see and challenge how the judgement was reached. Early attempts had rewarded fluent writing over substance, and the separated criteria and shorter explanations were introduced to address this and to keep readability high. The site remains small and attracts readers who tend to finish a single debate, so the team plans shorter debates on narrower questions and tighter scoring explanations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Pure Go HDF5 Library Built Without CGO, Plus a Crash Bug in Its Hyperslab Readers

A developer porting a causal-discovery method from Python to Go needed to read MATLAB data files, but found no reliable Go tools for the HDF5 format they use. Instead of a narrow reader, they began building a full HDF5 library in pure Go, with no C dependencies, and released it publicly about a year ago. The library now supports most core HDF5 structures and filters, validated against the HDF5 C library's test files, while a few features still return explicit errors. A later release addressed a bug, reported as issue #75, where a single altered byte in a small file caused a request for roughly 40 GB of memory. The root cause was that hyperslab readers re-parsed dataset metadata and skipped the bounds check applied to whole-dataset reads.

0 comments Read more at DEV Community