Dev Tutorial: Pullfrog and Ollama Cloud Enable Low-Cost AI Code Reviews on GitHub

·3 views

A developer has published a guide detailing how to connect Pullfrog, a GitHub Actions-based coding agent, to DeepSeek V4.1 Flash served via Ollama Cloud for automated pull request code reviews. The setup is designed to run repeatedly at near-flat cost, with Ollama Cloud pricing at $0.15 per million input tokens and $0.60 per million output tokens. A key factor in choosing Ollama Cloud was its Zero Data Retention policy, which ensures that code sent for review is neither stored nor used for model training. Configuration involves linking Pullfrog to Ollama's OpenAI-compatible API endpoint using a few environment variables, after which reviews trigger automatically on pull request opens or @pullfrog mentions. In testing, the system surfaced real issues such as undeclared runtime dependencies and comments inconsistent with upstream library status.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Guide outlines how to build security-audited AI chat interfaces in TypeScript

A technical guide published on DEV Community details how frontend engineers can build production-grade AI chat applications in TypeScript that meet enterprise security standards. The article addresses growing threats such as prompt injection attacks, PII leakage, and supply chain vulnerabilities, which have raised the security bar for AI-facing interfaces in 2024. It walks through a full development lifecycle using Vercel's assistant-ui library alongside a Next.js backend-for-frontend proxy, ensuring LLM API keys are never exposed directly to the browser. Key steps covered include strict TypeScript configuration, dependency hygiene with pnpm, context sanitization, PII redaction, and automated security scanning. The guide targets compliance with frameworks such as OWASP Top 10 for AI, SOC 2, and ISO 27001.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Obsidian Emerges as a Go-To Local Knowledge Base for AI Agents in 2026

Obsidian, a local markdown-based note-taking app, is gaining traction in 2026 as a personal knowledge management tool that integrates directly with AI agents like Claude Code. The app stores notes as plain Markdown files on the user's device, requires no cloud dependency, and has been free for commercial use since early 2025, making it attractive for privacy-sensitive workflows. AI plugins such as Smart Connections use Retrieval-Augmented Generation to let users query their entire note vault, while tools like Ollama enable fully offline AI interaction without data leaving the device. In January 2026, Obsidian CEO Steph Ango published the MIT-licensed 'obsidian-skills' repository on GitHub, which teaches AI agents to understand Obsidian's formatting conventions and quickly accumulated over 13,000 stars. A related open-source plugin, claude-obsidian, builds on this foundation by automatically generating linked wiki pages per source and maintaining context across sessions, reflecting a broader shift toward AI-augmented personal knowledge bases.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

WebAssembly Explained: Real-World Uses, Limits, and When to Skip It

WebAssembly (WASM) is a binary instruction format that serves as a compilation target for languages like C, Rust, and Go, allowing code to run in browsers at near-native speeds. It outperforms JavaScript for compute-heavy tasks such as numerical processing, cryptography, and media encoding, but offers no advantage for DOM manipulation or tasks already optimized by JavaScript's JIT compiler. Practical applications include running FFmpeg for in-browser video processing, executing SQLite databases locally, and encoding modern image formats like AVIF using codec libraries not yet natively supported by browsers. However, WASM comes with trade-offs: frequent calls across the JS/WASM boundary add overhead, large file sizes (FFmpeg's core weighs around 30MB) require careful lazy loading and caching strategies, and enabling multithreading demands specific HTTP security headers that can break third-party scripts. Developers are advised to treat WASM as a targeted tool for specific performance bottlenecks rather than a universal replacement for JavaScript.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Critical WordPress Flaw CVE-2026-87902 Exploited Within Hours of Patch Release

A critical path traversal vulnerability in WordPress core, tracked as CVE-2026-87902 with a CVSS v4.0 score of 9.2, was publicly patched on September 22, 2026. Security firm Patchstack observed unauthenticated attackers probing vulnerable sites and attempting PHP file writes on the same day the patch was released, with traffic volume surging tenfold by the following day. The flaw allows local file inclusion and can escalate to remote code execution in environments where specific theme directory structures, pearcmd.php, and certain PHP configurations are present. Successful exploitation requires several conditions to align, including the existence of a page- prefixed directory under an active theme and write permissions to target directories. WordPress site administrators are urged to update immediately to version 7.1.2 or the patched release for their active branch.

0 comments Read more at DEV Community