Deny-by-Default Manifest Helps Secure AI-Generated Services on Free Servers

·1 views

Developers using free AI coding tools and free server tiers often deploy generated code without reviewing its permissions or resource access, creating unintended security gaps. A deny-by-default server contract approach requires explicitly declaring which ports, file paths, environment variables, and network hosts a service may use before deployment. The manifest format shown covers filesystem access, outbound network calls, environment variable restrictions, and CPU and memory ceilings in a single JSON file. A companion static analysis script reads the contract and fails the preflight check if the source code contains banned module imports or undeclared file access. The article, prepared as part of MonkeyCode product outreach, argues that the contract should be written and committed by the developer rather than generated by the AI model itself.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds Daily German Word WhatsApp Bot After Week of Automation Hurdles

A developer set out to create a simple WhatsApp Channel that posts one German vocabulary word each morning, but the project quickly grew complex due to WhatsApp's session management challenges. The initially chosen library, whatsapp-web.js, required a full Chromium browser profile to maintain login sessions, making cloud deployment impractical and causing repeated authentication failures. Hosting platforms added further complications, with Railway banning userbot-style automations and Render suffering from unreliable session restoration bugs. The breakthrough came from switching to the Baileys library, which communicates with WhatsApp over a WebSocket without needing a browser, reducing session data from 43MB to a few small JSON files. This single change resolved both the hosting and session problems, allowing the bot to run reliably on a free-tier server with credentials stored in a MongoDB Atlas cluster.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Cron Has No Native Biweekly Option — But a Day-of-Month Trick Fills the Gap

Standard 5-field cron syntax has no built-in support for 'every 2 weeks,' leaving developers who need biweekly scheduling without an obvious solution. A common mistake is using expressions like '0 0 * * 1', which fires every Monday rather than every other Monday. A practical workaround combines day-of-month ranges with a weekday filter — for example, '0 0 1-7,15-21 * 1' reliably triggers once a fortnight on Mondays at midnight. However, windows ending near day 28 should be avoided as they can disappear in shorter months like February. For more complex biweekly logic, developers are advised to use a weekly cron trigger paired with a wrapper script, or switch to schedulers like APScheduler that support calendar-based intervals natively.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Programming Language Creators and Their Quirky Personal Homepages

A blog post on breck.lol explores the personal websites of notable programming language creators. The piece highlights the distinctive and often unconventional design choices these developers make for their own homepages. It drew modest attention on Hacker News, earning 9 points and 2 comments. The article offers an informal look at how the minds behind influential languages choose to present themselves online.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

What Are Serverless Cold Starts and How Do They Slow Your App Down

In serverless computing, a cold start is the latency that occurs when a cloud function is triggered after being idle, forcing the provider to spin up a container, load the code, and initialize the environment before executing. Unlike traditional servers running continuously, serverless functions only consume resources during execution, making them cost-efficient but vulnerable to unpredictable startup delays. These delays become problematic in real-world scenarios such as sudden traffic surges or infrequently accessed features, where users may experience multi-second lag spikes. A common mitigation technique involves placing resource-heavy operations like database connections in the global scope of the function, so they run only once during initialization and are reused across subsequent warm requests. Developers must balance the cost savings of serverless architecture against the user experience impact of cold starts by optimizing code structure, reducing deployment package size, and selecting appropriate runtime environments.

0 comments Read more at DEV Community