CS Student Built a GitHub Actions Security Scanner — It Found 12 Bugs in Itself

·1 views

A University of Adelaide cybersecurity undergraduate developed 'ghast', a taint-analysis scanner designed to detect supply-chain vulnerabilities in GitHub Actions CI/CD workflows. After running the tool across roughly 200 open-source repositories and about 1,800 workflow files, the scanner returned zero confirmed exploitable vulnerabilities. However, manual review of every high-severity finding revealed twelve bugs within the scanner itself, stemming from flawed logic, incorrect assumptions about how GitHub's platform works, and overly broad pattern matching. One misconfigured rule alone accounted for 97% of all medium-severity findings, flagging correctly written, documented-safe code as dangerous. The developer published the experience as a detailed post-mortem, arguing that building and then stress-testing a security tool is one of the most effective ways to expose gaps in one's own understanding.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Launches SeedSQL to Auto-Generate Relational SQL Test Data with Key Integrity

A developer has built SeedSQL, a free web tool designed to simplify the creation of realistic mock data for complex relational database schemas. The tool addresses common pain points such as foreign key mismatches, format errors, and the time-consuming task of writing manual seed scripts. SeedSQL automatically maps parent-child table dependencies, ensuring referential integrity across linked tables like users, orders, and payments. Users can export generated data as SQL insert scripts or CSV files compatible with PostgreSQL and MySQL. The free tier supports up to 1,000 rows and includes localization features for country-specific data formats.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agents Can Help Automate Shopify, But Production Failures Are Costly

A developer and e-commerce consultant shares hard-won lessons from deploying AI agents on Shopify, warning that real-world results often fall short of the marketing promise. One client spent $5,000 in LLM credits on a product description agent that repeatedly hallucinated features unrelated to their store. In a separate case, an inventory automation agent misread Shopify's API and accidentally zeroed out stock across entire product categories. Customer service bots built with frameworks like CrewAI have also been observed entering endless clarification loops, burning API costs while failing to resolve basic refund requests. The author concludes that AI works best for repetitive, low-stakes tasks like drafting bulk product descriptions, but requires strict guardrails, human review, and robust error-handling before it can be trusted in production.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five Common Data Leakage Traps That Make ML Models Look Better Than They Are

Data leakage is one of the most frequent reasons machine learning results appear stronger than they actually are, yet few practitioners check for it systematically. The five main culprits include duplicate or near-duplicate rows shared across training and test sets, temporal look-ahead leakage from random splits on time-series data, and features that inadvertently encode the target variable. A real-world demonstration using the EEG Eye State dataset showed a model's AUC score collapsing from 0.971 to 0.546 simply by switching from a random split to a time-respecting one. To address this, the author developed two open-source Python tools — LeakHound, which detects all five leak types and reports honest versus inflated scores, and safesplit, which prevents leakage by enabling group-aware, time-aware, and sequence-aware data splitting.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI Agent Reports Are Not Proof: The Case for Independent Artifact Verification

A software engineering post argues that session reports generated by AI agents are self-descriptions, not independently verifiable evidence. The author contends that approving a report — even with multiple reviewers — only means one observation has been read multiple times, not independently confirmed. The post cites a real example where a test suite was reported stable and approved twice, yet a fresh rerun against the actual files on disk revealed two failures in sixteen runs. The recommended practice is to check the exact worktree, read the actual diff, run the declared command, and preserve its output for others to inspect. The core principle is that a report serves as a map to the artifact, not a substitute for re-running and directly observing it.

0 comments Read more at DEV Community