Card Shipment Webhooks: Three Boundaries for Durable HTTPS Delivery, ACK and NACK

·5 views

The article argues that card-shipment webhooks should be accepted once, expanded into a durable per-subscriber queue, and pushed to HTTPS endpoints under rate limits. Delivery is acknowledged only after success is recorded, while permanent failures are moved to a dead-letter state. The author contrasts this with synchronous fan-out, which ties producer latency to the slowest subscriber. The piece stresses a stable event ID and idempotency key, since exactly-once HTTP delivery is not achievable and at-least-once delivery is the realistic goal. It also warns against placing sensitive card data in shipment payloads and advises that recovery scans should repair stranded state rather than act as the main delivery engine.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Linux audit loginuid preserves original login identity after su or sudo

After a user runs su or sudo, an audit event's account name can be misleading because the effective identity changes while the activity still traces to the original session. Linux audit uses the login UID (auid) and a session identifier to record that original login context. Teams that review only the effective UID risk losing this attribution. A missing auid does not prove no user was involved, since it may reflect a process started outside a login session or a collection gap. Verification should include testing login paths in a controlled setting and checking that the collector and normalization pipeline preserve the field.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to build a working app without coding in one weekend

The guide argues that AI tools can now write the code for a beginner, but deciding what to build, spotting problems, and publishing the app remain the human's job. It recommends limiting the first app to one user type and one core task, such as a simple habit tracker page, and putting other ideas on a later list. Readers can choose between browser-based AI app builders, which need no installation, and AI coding assistants, which offer more control, but should stick with a single tool throughout. The method is to write a clear brief, request one screen at a time, paste exact error messages back for fixes, and publish a live link early. The author advises testing the app with three real target users and avoiding common mistakes like adding features too soon, switching tools mid-project, or delaying deployment.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Agent Kit adds a reviewable record to AI-assisted code changes

AI-assisted code edits need a traceable record of the request, the approval, and the checks actually performed. Agent Kit is a project-local toolkit that follows a Plan, Approve, Build, Verify, Hand off sequence to keep that record. The article illustrates this with a small example of adding Copy buttons to onboarding prompts, with scope and acceptance criteria defined up front. At handoff, the same work items are used to report outcomes, distinguishing a completed edit from a passing check and from human acceptance. The author, who maintains the kit, notes the example is illustrative rather than a benchmark or verified behavior across all supported clients.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Test AI Background Music Generators Before Buying

The article argues that choosing background music should rely on a structured trial rather than preview clips, since licensing, editability, and documentation matter as much as sound. It recommends taking one real project, exporting a clean control version without music, and running three shortlisted generators through the same process. Each service's license terms should be checked against the same questions, such as monetization, client work, podcast use, and attribution requirements. The author also advises keeping receipts and checking whether services provide concrete documentation for handling audio matches or disputes. Finally, tracks should be tested for tempo changes, loops, stems, revision workflow, file quality, and playback on phone speakers.

0 comments Read more at DEV Community