Botpress Staff Credential Used to Read Bot Configs in 16 Workspaces

·3 views

For 39 minutes on October 21, an attacker using a Botpress employee's API credential read bot configurations across 16 customer workspaces and altered integration settings in two others. Because bot configs can contain AI provider keys, messaging tokens and CRM credentials, Botpress is advising affected customers to treat every credential stored in those bots as exposed. The intrusion began in mid-October through an authentication proxy in front of internal tools, which Botpress fixed and secured on October 21. Botpress said the attacker appeared motivated by reselling AI usage, running many accounts to consume AI credits, and it reported no ransom demand or published customer data. The company publicly disclosed the incident on November 6.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Comparer deux versions d'un contrat PDF mot à mot avec Python

Un PDF ne conserve pas d'historique des modifications, ce qui oblige à comparer directement les deux fichiers pour repérer les changements. L'article examine trois méthodes : comparaison des pages rendues pixel par pixel, comparaison du texte extrait ligne par ligne, et comparaison mot par mot. Sur une paire de contrats de test, le diff mot par mot identifie les mêmes cinq modifications même lorsque le texte est recomposé avec une autre mise en page, contrairement aux deux autres méthodes. L'auteur présente un script Python d'environ 120 lignes utilisant PyMuPDF et difflib, qui récupère les coordonnées de chaque mot modifié et réécrit les changements sous forme de commentaires dans le PDF. Il indique aussi qu'un logiciel de bureau, PDF Editor d'osFoundry, applique la même logique de comparaison mot par mot.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Senior Craft Depends on Context and Process, Not Just Code Output

An essay argues that the 'vibe coding' approach of prompting AI for finished code fails because it demands results without first establishing identity and context. The author frames a Be, Do, Have sequence that maps onto Context, Process, and Content, arguing that results depend on the upstream layers. Typical vibe-coding prompts, such as requests to build a login page or fix a race condition, are described as jumping straight to the final output. The piece contrasts this with a structured workflow in which the agent's role and phase-bound constraints are defined before any code is written. It concludes that clean, verifiable output emerges naturally only when the upstream context and process are locked in place.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Ten Claude Skills a Freelancer Actually Uses Weekly for Client Work

A freelancer and consultant who has tested Claude skills over a year argues that most skill folders go unused and proposes a rule: only build a skill for a task done at least twice a week. The author identifies three common failures: overly broad descriptions, missing business context, and building for imagined tasks. They recommend first creating a shared context file covering the user's offer, clients, proof, goals, and preferred tone. The article then lists ten skills that survived this filter, including a client brief builder, proposal generator, and scope creep checker, with a summary table of inputs and outputs. A copyable SKILL.md template and a paid resource pack are also offered.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

PostgreSQL's SET SESSION AUTHORIZATION alters both session and current user identities

PostgreSQL tracks two identities per session: the authenticated session user and the current user used for permission checks. SET SESSION AUTHORIZATION can change both, which is useful for controlled administrative tasks but risky in pooled or diagnostic contexts. Only superuser sessions may switch the session user to an arbitrary name, while other sessions are limited to their own authenticated name, and DEFAULT or RESET restore the original identity. The command cannot run inside a SECURITY DEFINER function and affects which roles later SET ROLE commands can assume, so reviews checking only current_user may miss it. The guidance recommends separate database roles, resetting session state before connection reuse, and verifying session_user, current_user, and current_setting('role') in tests.

0 comments Read more at DEV Community