CISA Publishes Honest Post-Incident Review After 844 MB GitHub Data Leak

·1 views

On May 14, 2026, a security researcher discovered 844 MB of sensitive CISA-related data exposed in a public GitHub repository, which was taken down within 26 hours. Two months after the incident, CISA published a public post-mortem detailing what went wrong and what its response teams did well — a rare move for a national cybersecurity agency. The report outlines six key lessons: treat external reports seriously, scan repositories continuously for secrets, build dedicated leak-response playbooks, simplify researcher reporting channels, strengthen development guardrails, and pre-test credential rotation. The researcher who reported the leak noted the notification reached CISA through an unnecessarily complex chain involving CERT/CC, personal contacts, and a journalist, highlighting gaps in disclosure pathways. CISA's transparency is being held up as a model for how organizations should handle and openly learn from security incidents rather than burying them.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer fixes null-body crash in Formbricks survey SDK flagged by Sentry

A production crash in the Formbricks open-source survey SDK was automatically detected and reported by Sentry as issue FORMBRICKS-CLOUD-3VE. The bug caused an uncaught TypeError in visitors' browsers when the SDK's makeRequest helper attempted to read properties off a null HTTP response body. The same flaw existed in two separate packages — @formbricks/js-core and @formbricks/surveys — leaving the error path entirely unguarded against null or non-JSON responses. Developer Lewis Awe patched both instances by wrapping response.json() calls to handle SyntaxErrors and adding null-safe checks before accessing response properties. Because Formbricks does not accept unsolicited community pull requests, the fix was opened and merged on a personal fork as part of DEV's Summer Bug Smash challenge powered by Sentry.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Video AI APIs silently return durations shorter than requested, developers warned

A software developer has highlighted a systemic issue with video generation APIs, where requesting a specific clip duration — such as 10 seconds — often results in a shorter rendered file with no warning or error returned. The root cause lies in how latent video diffusion models compress frames internally, meaning only certain frame counts are mathematically valid given each model's frame rate and block size. When a requested duration does not align with these legal frame counts, the model silently rounds down to the nearest valid length. This discrepancy becomes a practical problem when multiple clips are assembled into a timeline, causing cumulative sync errors with audio or music. The developer recommends that engineers building on such APIs enumerate valid durations at build time and treat duration as a constrained value rather than a free input.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Swarm Runtime Lets Teams Scale from API Gateway to Multi-Agent AI Without Rewrites

A Rust-based AI runtime called Swarm is designed to eliminate the perceived trade-off between using a lightweight API gateway and a full agent orchestration framework. The tool allows engineering teams to start with a simple OpenAI-compatible proxy and progressively enable more advanced capabilities — such as multi-provider routing, stateful sessions, MCP tool execution, and multi-agent workflows — by changing configuration flags rather than rebuilding infrastructure. Developer teams typically scale their LLM stacks through predictable stages, and Swarm structures these as six configurable 'rungs,' each adding functionality without replacing the underlying runtime. The project is built in pure Rust and aims to avoid the common pattern of patching together separate microservices, vector stores, and evaluation scripts as requirements grow. By keeping the architecture unified, Swarm targets teams that want a production-grade binary at any stage of AI adoption without committing to a full agent framework from day one.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Klick.tools Launches No-Signup QR Code and URL Shortener Platform with Open API

A developer has launched klick.tools, a free web utility platform offering a QR code generator and URL shortener that requires no account creation or email verification. The QR tool supports seven content types, custom styling, and WCAG contrast checking, with all rendering done client-side so no data leaves the user's device. The URL shortener allows link creation in seconds, tracks click statistics, and lets users update destination URLs without reprinting materials. A REST API backs both tools, enabling anonymous use with IP-based rate limiting or authenticated use via API key for higher quotas and full link management. The platform is hosted in Germany, collects no IP logs, sets no tracking cookies, and was designed with GDPR compliance as a core requirement from the outset.

0 comments Read more at DEV Community