DEV.to MCP Tool Logs Fake Edits When Unchanged Values Are Resubmitted

·1 views

A developer discovered a logic flaw in an MCP server tool called update_article, built for interacting with the DEV.to publishing platform. An earlier fix had added a guard to block API calls when no fields were provided, but the guard only checks whether a field was passed — not whether its value differs from what already exists on the live post. As a result, if a caller submits a value identical to the current content, both a GET and a PUT request still fire against the live article. The audit log then records the field as changed, even though before and after values are byte-identical, making genuine edits indistinguishable from no-op submissions. The developer confirmed the issue through a stubbed reproduction test and noted it undermines the audit trail's core purpose of proving what actually changed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Documents HTML Dashboard Build Focusing on Accessibility and Structure

A developer shared progress on a Fullstack Roadmap project, detailing the construction of a structured dashboard using layered HTML containers. The project incorporated key UI components such as a sidebar for navigation, a form for filtering module progress, and cards for organized content presentation. A major focus was placed on accessibility, specifically the correct use of ARIA attributes: aria-label for describing visual-only elements and aria-current for identifying the active page. The developer noted that most bugs encountered during the project were related to improper or missing ARIA implementations. The post emphasizes that using familiar tools intelligently, rather than chasing new ones, can yield strong results, and invites fellow beginners to reflect on the importance of accessibility in user experience.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Developers Can Use Internet Scanning Tools to Spot Accidentally Exposed APIs

Misconfigured firewalls or overlooked load balancer settings can inadvertently expose internal APIs and development environments to the public internet, creating serious security risks. Tools like ScanSearch function as search engines for internet-connected devices and services, allowing developers to query for exposed endpoints, open ports, and HTTP responses at scale. Developers can use such tools to verify that internal services remain inaccessible externally, detect misconfigurations like exposed Git repositories or environment files, and map unintended public-facing assets. A common vulnerability involves API documentation endpoints — such as Swagger UI at paths like /api-docs — being publicly accessible without authentication, potentially giving attackers a full blueprint of an API. Proactively searching for these exposures using targeted queries helps development teams identify and remediate risks before malicious actors can exploit them.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Proposes Two-Tier LLM Routing to Cut Costs Without Sacrificing Output Quality

A software developer has outlined a two-tier LLM pipeline that routes tasks to a cheaper model by default and falls back to a more capable, costlier model only when the output fails a deterministic check. The key design principle is that no language model is allowed to judge its own or a peer's output — validation is handled exclusively by objective tools such as test suites, JSON schema validators, or regex checks. Every routing decision is logged to a JSONL audit file, making the system's behavior traceable and measurable over time. The pipeline is built to be provider-agnostic, compatible with any service that supports the OpenAI-compatible chat API. The author notes the article was prepared as part of outreach for MonkeyCode, a platform that provided free model access used during development.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Apache STeVe v3: How the ASF Rebuilt Its Member Voting System from Scratch

The Apache Software Foundation (ASF), which governs some of open source's most critical projects, recently ran its annual Members' Meeting election on a fully rebuilt version of its voting platform, Apache STeVe v3. The system allows roughly 800 ASF members to elect a Board of Directors and admit new members without any corporate or vendor influence over the process. Built on modern tools including Python's asfquart framework, Bootstrap, and SortableJS, the new version was developed as a standard open-source Apache project with public code and community-driven decisions. A key feature of STeVe v3 is its privacy architecture: every vote is encrypted using Argon2 key derivation and Fernet symmetric encryption, ensuring no ballot can be linked to an individual voter — even by the system's own administrators. The tally process intentionally takes 15 to 60 minutes due to the computational cost of reversing the encryption, a deliberate design choice that strengthens security as hardware improves over time.

0 comments Read more at DEV Community