Custom AppSec Prompt Found 1 Authorization Gap Across 174 Routes in Multi-Tenant SaaS

·3 views

A developer built a structured prompt framework to guide AI-assisted security audits, focusing on falsifiable invariants and requiring file-and-line evidence before flagging any issue. Over two days, the approach was applied to six open-source repositories, complementing static scanners like Semgrep rather than replacing them. In one multi-tenant SaaS audit, Semgrep returned 23 findings with zero authorization issues, while the AI-driven method checked all 174 authenticated routes against a single ownership invariant and identified one confirmed gap. The exercise also surfaced confirmed issues in Formbricks and Dub, both of which were accepted by maintainers and logged for fixes. The author's key takeaway is that static scanners detect what is present, while semantic hunting is needed to find security controls that are entirely absent.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds browser-based image converter that keeps files off servers

A developer built ImagArt AI, a free image conversion tool that processes files entirely within the user's browser without uploading them to any remote server. The tool uses built-in browser APIs such as Canvas, toBlob(), and toDataURL() to decode, resize, and re-encode images to JPG, PNG, or WebP formats. It supports batch uploads and ZIP export, with all processing handled by the user's own device CPU. The motivation was to address privacy concerns with mainstream free converters, which typically require files to be sent to external servers. The developer noted that while the client-side approach eliminates server costs and privacy trade-offs, processing very large batches of high-resolution images can strain performance without careful use of Web Workers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Filtering Out Unstable Audio Clips Fixes Hoarse TTS Style Synthesis

A text-to-speech system that builds emotional style vectors from a small set of representative audio clips was producing consistently hoarse output due to low-quality clips being included in the selection. Because only five clips are used per style, even one rough clip contributes 20% weight to the average style vector, pulling it toward abnormal acoustic regions. The developer identified two key audio quality factors — jitter (unstable vocal cord vibration) and octave jumps (sudden F0 pitch shifts) — and built a scoring function to measure both. Clips are now ranked by a combined stability score, with octave jumps weighted twice as heavily as jitter due to their greater perceptual impact. Replacing the naive first-five selection with this stability-based filter eliminated the hoarseness entirely across all synthesized output.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Probability Theory Unifies All Major Deep Generative Model Families

A technical explainer published on DEV Community argues that generative models are best understood through probability theory rather than as isolated architectures. The article frames generative modeling around three core problems: how to represent high-dimensional distributions, how to train a model distribution to match real data, and how to reason backward from observations to hidden variables. This unified lens, the author contends, connects autoregressive models, VAEs, GANs, flow-based models, and diffusion models despite their architectural differences. Unlike discriminative models that learn conditional mappings for prediction, generative models aim to approximate the full probability structure underlying the data. The piece also links generative modeling to classical inverse problems, where the goal is inferring likely causes from observed outputs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Missing --cdp flag silently launches a second Chrome, mimicking a logged-out session

A developer debugging a scheduled automation job discovered that omitting the --cdp flag in agent-browser caused the tool to silently launch a fresh, unauthenticated Chrome instance instead of attaching to an existing logged-in one. The automation still ran successfully by all exit-code checks, but returned a logged-out page because it was operating in a brand-new browser profile with no stored session. This made the issue appear identical to a genuine session expiry, leading to misdiagnosis. The key diagnostic tell is the log line 'launched browser' — its presence confirms the tool is not attached to the user's actual Chrome profile. A reliable fix involves verifying the correct Chrome process is bound to the expected debugging port by inspecting its user data directory via the system process list.

0 comments Read more at DEV Community