Dev builds FastAPI security layer with audits, tests, and exception handling

·1 views

A developer working on a FastAPI application dedicated an entire phase of development to security hardening rather than adding new features. The work included a manual security audit of the API to check for data leaks, a global exception handler to prevent internal error details from being exposed, and a five-test pytest suite to make manual checks repeatable and permanent. Additional steps covered adding a public health endpoint for monitoring, enforcing pagination on unbounded list queries, and scanning git history for accidentally committed secrets. The audit found zero leaks in the application itself, with most bugs traced to terminal commands and configuration errors rather than the codebase. The phase reflects a deliberate approach of observing and verifying existing behavior before making any changes.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Yield on Cost: The Dividend Metric That Matters More Than Current Yield

While current yield — annual dividend divided by today's price — is the most commonly cited dividend metric, investors who reinvest dividends should focus instead on yield on cost, which measures annual dividend income against the original amount invested. An open-source JavaScript library called dividend-math includes a DRIP calculator that simulates dividend reinvestment year by year, accounting for share accumulation, price growth, and dividend growth. Over a 15–20 year horizon, the combination of rising dividends and reinvested shares can push yield on cost to two or three times the starting yield, even if current yield appears flat. This happens because the denominator in yield on cost is fixed at historical cost, while both dividend income and share count continue to grow. The library is MIT-licensed, available on npm, and powers several pages on dividendpayoutcalculator.com, with all formulas covered by unit tests to avoid calculation errors.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why HEIC Files Silently Break Browser Image Tools and How to Fix It

HEIC, the default photo format on iPhones, uses HEVC encoding that is patent-encumbered, meaning Chrome, Firefox, and Edge cannot decode it — only Safari can, since Apple licenses HEVC platform-wide. This creates a hidden bug where browser-based image tools fail silently with no error or preview when a HEIC file is uploaded. Common workarounds like renaming the file extension do not help, as decoders check the file's actual bytes rather than its name. Developers are also warned that iOS files frequently arrive with an empty file.type value, causing validation logic to incorrectly reject valid photos. The recommended fix involves detecting HEIC via its binary header and lazy-loading a WebAssembly-based decoder like heic2any only when needed, avoiding unnecessary bundle bloat for the majority of users.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Admits His 'Fully Verified' App Generator Skips Testing Its Own Parser

A developer built a tool called appgen that converts a plain-English sentence into a running, dependency-free Python application without using a language model, completing the process in roughly 2 milliseconds. The tool's README claimed 100% verification across 810 domain-feature-family test cells, but the developer later acknowledged this figure is misleading. The 810-cell sweep tests only the code-generation components downstream of user input, entirely bypassing the hand-written keyword parser that processes the original sentence. The developer did conduct a separate experiment to evaluate the parser as an intent classifier, but noted that fair measurement was difficult since he authored the test phrases himself. The post serves as a candid self-correction, distinguishing between what the verification actually covers and what a typical reader would assume it covers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Should unsigned web requests be treated as suspicious? Experts debate the tradeoff

As request-signing standards emerge for automated internet traffic, developers are debating how to handle unsigned requests. One perspective argues that an unsigned request carries no claim at all — it has not lied — and that most legitimate internet traffic remains unsigned. The concern is that penalizing unsigned traffic could stall adoption by creating a chicken-and-egg problem where no one signs because there is no benefit, and there is no benefit because no one signs. A proposed middle ground suggests rewarding verified, signed traffic with faster access and higher limits rather than punishing the absence of a signature. The debate remains open, with some acknowledging that a purely reward-based approach may be too slow to drive meaningful adoption of new signing standards.

0 comments Read more at DEV Community