Booking.com Customer Data Exposed via Third-Party Vendor Breach

·6 views

Booking.com confirmed this week that unauthorized parties accessed reservation data for a subset of customers through a compromised third-party service in its booking workflow. Exposed information included full names, postal addresses, email addresses, phone numbers, and booking dates. The company stated its core platform was not directly compromised, with the breach traced entirely to an external vendor. The incident highlights a broader cybersecurity pattern where well-secured platforms remain vulnerable through third-party tools such as notification providers, payment aggregators, and customer-success services. Security experts warn that vendor-chain risks — including overly broad API token scopes and unvalidated webhooks — are routinely underaddressed in standard annual penetration tests.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Chrome Extension Replaces Website Ads with Artworks from Major Public Museums

A developer has released a Chrome extension called Ads Art that substitutes visible advertisements on websites with artworks sourced from two renowned public institutions. The extension draws images from the Art Institute of Chicago and The Metropolitan Museum of Art. It operates locally on the user's computer using a collection of JavaScript scripts. The project is open source, with its code publicly available on GitHub for anyone to explore or contribute to.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How json_shield Was Built to Be Understood by AI Code Assistants

A Dart package called json_shield has been engineered with AI coding assistants in mind, recognizing that tools like Copilot and Cursor now generate much of the code that consumes open-source packages. The package's author identifies four key artifacts — README, example directory, doc comments, and pubspec.yaml description — that IDE retrieval systems index and feed into AI prompts. Each artifact follows strict rules, such as removing vague adjectives, providing exact input/output examples, and explicitly stating what the package cannot do, to prevent AI models from hallucinating unsupported features. Inline documentation comments are written to specify exception types and failure modes, nudging AI assistants toward correct error-handling patterns rather than generic ones. The approach reflects a broader shift in package development, where authors must now optimize their code and documentation for both human developers and the AI agents assisting them.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Free API lets course providers issue tamper-proof certificates with one HTTP call

Novadyne has released Attestify, a free API that allows course providers and training programs to issue cryptographically signed completion certificates without requiring an account or API key. Each certificate is backed by a server-side record and an Ed25519 digital signature, making any alteration instantly detectable during verification. Recipients receive a permanent public verification URL that anyone — including employers — can open without creating an account or installing an app. The API integrates with automation tools like n8n and supports batch issuance for multiple recipients in a single request. Attestify positions itself as a lightweight alternative to full credentialing platforms, focusing solely on free, programmatic certificate issuance and public verification.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Tutorial: How to Build a Full CRUD API in Go Using Only the Standard Library

A developer tutorial published on DEV Community walks through building a complete CRUD API in Go without any third-party packages. The guide extends a previously built task API by adding PUT and DELETE HTTP method handlers alongside existing GET and POST functionality. Tasks are stored in memory using a Go slice, keeping the setup simple and database-free. The tutorial covers how the server matches incoming requests by HTTP method and updates or removes tasks based on a matching ID in the request body. By the end, readers are expected to understand how backend APIs manage resources through the four core CRUD operations.

0 comments Read more at DEV Community