Bug Bounty Programs Alone Leave Secret Leaks Unreported, Experts Warn

·1 views

Security professionals are cautioning that bug bounty programs, while useful, should not replace formal Vulnerability Disclosure Policies (VDPs). Bug bounties are selective by design, with limited scopes, opaque triage processes, and payout structures that can discourage researchers from reporting certain vulnerabilities. These gaps create security blind spots, particularly around leaked secrets, where valid reports may be dismissed as out-of-scope or never reach internal security teams. GitGuardian, which runs its own bug bounty program alongside periodic audits, argues that a proper VDP should allow anyone to report issues safely and without unnecessary friction. The article contends that fewer vulnerability reports do not indicate fewer problems, but may instead reflect a false sense of security.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why GitHub Blocks Search Results Beyond Page 10: The Deep Pagination Problem

GitHub's Search API deliberately returns a 422 error when users request results beyond the first 1,000 entries, blocking access to page 11 and beyond with 100 results per page. The restriction exists because of a fundamental database limitation: SQL's OFFSET clause cannot jump directly to a position in a B-tree index and must scan and discard every preceding row one by one. This means fetching page 50,000 of a 20-results-per-page query forces the database to walk through nearly a million rows before returning any data, making query cost proportional to the offset rather than the page size. A real-world test on a 5-million-row PostgreSQL table confirmed the issue, with an OFFSET of 999,980 causing the engine to scan exactly one million rows before delivering just 20 results. GitHub's hard cap is a deliberate safeguard against this performance problem, which can silently affect any application using offset-based pagination on large datasets.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DCAB 0.12.0 adds test case for Word comment 'done' state change in XML metadata

The Document Change Assurance Benchmark (DCAB) version 0.12.0 introduces a new deterministic test case called review.modern_comment_done_state_changed, targeting a specific boundary in WordprocessingML document structure. The case examines how a comment's 'done' status can shift from done='0' to done='1' inside word/commentsExtended.xml without altering any visible text, anchors, or other package members. This distinction matters for document review tools because stored metadata changes may not be reflected in a document's visible content or classic comment data. The release passed continuous integration testing across Python 3.11 to 3.13 and includes validation support via an optional DocFence 0.27 adapter. DCAB now contains 23 paired synthetic test cases, with release artifacts and the full corpus available on GitHub and Hugging Face.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds ephemeral encrypted chat where server never stores messages

A developer has released elm.chat, an open-source encrypted chat application built on Cloudflare Durable Objects and Workers, designed so that no message content is ever stored server-side. Each chat room is a temporary space where encryption keys are derived in the browser using HKDF-SHA-256, keeping the server blind to message content. Messages and files are encrypted with AES-GCM-256 before being relayed through a Durable Object, which handles routing but never persists transcripts. When a new participant joins, chat history is synced directly from already-connected peers rather than loaded from a server, meaning if no peer holds a message, it is permanently lost. The project is licensed under AGPL-3.0, though the developer acknowledges that connection metadata such as IP addresses and timing remain visible to Cloudflare.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Six Prompting Techniques to Get Better Code Outputs From Claude

Developers often get subpar results from Claude not because of the model's limitations, but due to poorly structured prompts, according to a guide published on DEV Community. The article recommends six practical techniques, including specifying precise requirements, using XML tags to separate instructions from code context, and asking Claude to outline its approach before writing any code. Providing real code examples from your codebase helps Claude match existing conventions, while breaking large tasks into sequential stages — plan, implement, review, fix — produces more consistent results. The guide also advises using the /clear command in Claude Code to reset context between unrelated tasks, preventing earlier conversation history from degrading responses on new problems.

0 comments Read more at DEV Community