CSP Builder offers visual tool to generate Content Security Policy headers instantly

·3 views

CSP Builder is a free, browser-based tool designed to help developers create valid Content Security Policy headers without memorizing complex directive syntax. It is part of the DevTools collection, which includes over 200 browser utilities, and requires no installation or account signup. Users configure CSP directives such as script-src and img-src through a form interface that validates inputs and previews the final header string in real time. The tool supports both enforcement mode and report-only mode, allowing developers to safely test policies on live sites before fully applying them. Because it runs entirely in the browser, no policy data is transmitted externally, making it a privacy-focused option for security reviews or retrofitting CSP onto existing applications.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer releases tiny framework-agnostic permission-checking library for mismatched backend strings

A frontend developer built and open-sourced a lightweight JavaScript library called permission-access after repeatedly struggling with backend permission strings that didn't match what the UI expected on an internal admin dashboard. The core problem was that backend endpoints used names like Orders.GetAll_GET instead of semantic labels like orders.read, forcing developers to hardcode brittle strings across dozens of UI components. The library introduces an optional actionMap that lets the UI ask semantic questions about permissions without depending on backend naming conventions. It has zero runtime dependencies, works independently of any framework, and includes optional React bindings via a PermissionsProvider and usePermissions hook. The project is at v0.1.x, has not been widely battle-tested, and is available on npm and GitHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Open-Source Telemetry API Targets eVTOL Prototyping Data Chaos

A developer has released aero-telemetry v0.1.0, a lightweight open-source API built with FastAPI and Pydantic to standardize flight test data ingestion for eVTOL and drone prototyping. The tool allows teams to ingest sensor data — including battery state, GPS, IMU, and motor RPM — via HTTP, with built-in validation that catches out-of-range readings before they corrupt datasets. It uses SQLite by default with SQLAlchemy 2.0 async support, making it runnable on a laptop without any configuration, and includes 26 pytest tests covering CRUD operations and edge cases. The project is licensed under Apache-2.0 and targets eVTOL startups, drone fleet operators, and graduate researchers who need structured flight data without enterprise-grade overhead. Planned features include PostgreSQL support, WebSocket streaming for real-time telemetry, and Grafana dashboard integration.

0 comments Read more at DEV Community

ProgrammingHacker News ·

pgrust achieves full compliance with PostgreSQL regression test suite

pgrust, a Rust-based implementation of the PostgreSQL protocol, has passed 100% of PostgreSQL's official regression tests. This milestone marks a significant achievement in compatibility for the project, demonstrating that it can handle the full breadth of standard PostgreSQL queries and behaviors. The announcement was shared via the developer's blog and gained attention on Hacker News. Passing the regression suite suggests pgrust is now capable of serving as a reliable, spec-compliant alternative or complement to the standard PostgreSQL stack.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Setup Automation Confirms Steps Ran, Not That a Repo Is Actually Ready

Developer tooling platform Ota argues that successfully running a setup command like 'npm install' does not mean a repository is in a usable or trusted state. The company distinguishes between setup automation, which confirms a sequence of steps completed, and readiness verification, which confirms the environment is correctly configured and safe to execute. Without an explicit verification layer, two developers running identical setup commands can end up in different functional states, leading to lost debugging time. The gap becomes more critical for AI agents, which cannot rely on intuition to detect misconfigured runtimes, missing services, or unresolved environment variables. Ota proposes that repos adopt a machine-readable execution contract separating the phases of preparation, verification, and readiness before any task execution begins.

0 comments Read more at DEV Community