Browser Direct Uploads: Seven Presigned URL Options That Skip the Proxy Server

·2 views

A developer guide argues that apps serving generated reports should let browsers upload straight to private object storage using server-issued presigned URLs. Under this approach, the application server authenticates the customer, issues a short-lived signed URL, and records the object key, keeping report data off the proxy. The article notes that storage retention and request volume often drive costs more than transfer fees, so teams should track storage, requests, and egress and assign retention classes to each report. It also advises keeping metadata such as report hashes even after blobs are deleted, to ease recovery if a support ticket reopens. A sample Python client demonstrates presigned URL creation with retry handling for rate limits and idempotency keys.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Study finds many Lovable-built apps expose Supabase data on first page load

Researchers at Crissy Field examined 159,041 Lovable projects, of which 34,545 used Supabase. Of 24,664 sites examined more closely, many were already serving database records to visitors without any login. Further read-only requests with the public key surfaced email addresses in thousands of sites, along with more sensitive items such as passport details and chat messages. The authors caution that data appearing on first load is not automatically a confirmed leak, and the roughly 30% figure applies only to the sampled sites, not all Lovable apps. Security advisers stress that anon keys are meant to be public, so the real risk lies in missing or permissive row-level security rules.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why 'Where Is My Parcel?' Can Signal Different Buyer Needs

The phrase 'where is my parcel' is a common after-sale message that can carry very different meanings depending on context. Buyers may be impatient while still inside the delivery window, anxious after it has closed and tracking has stalled, or weighing a return or dispute. Replying only to the literal tracking question fits none of these situations well. Support teams are advised to check order age against the promised window, message history, carrier status, and wording before responding. The reply should then match the situation: a date for nudges, a concrete plan for anxious buyers, and a clear decision point for those considering returns.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Summer Engine, Ziva and Flockbay compared as Godot AI tools for 2026

A developer who builds Flockbay, one of three Godot AI tools, compares it against Ziva and Summer Engine as of October 2026. Ziva is a proprietary plugin for Godot 4.2 and later that works inside the existing editor, with hosted models from $20 a month. Summer Engine is a separate proprietary engine built on a Godot 4.7.2 base, offering hosted AI at $20, $60 or $200 monthly. Flockbay supports Godot 4.6 and later, bundles the official engine, and offers free AI. The two rivals disagree on whether Ziva can actually run and playtest a game, and the article notes that each product's comparison page was written by its own maker.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Python PII Scanner Validates Matches to Cut False Positives in Data Discovery

Knowing where personal data sits is a prerequisite for encrypting, masking, or deleting it, and regulations such as GDPR Article 30 require a record of the categories processed. A plain regex scan tends to flag harmless values like order numbers, timestamps, and SKUs, which makes its reports hard to use. The article presents a Python scanner that samples each column with reservoir sampling, uses regexes to find candidates, and then validates them with checksums and format rules such as Luhn, mod-97 for IBANs, and SSA rules for SSNs. It combines validation results with the column name to assign a per-column confidence score and writes an inventory in JSON and Markdown. The author tests the approach on a synthetic SQLite database and CSV files, and compares the results with Microsoft Presidio.

0 comments Read more at DEV Community