Developer builds autonomous treasury agent, uses AI code review to catch critical security flaws

·1 views

A developer submitted TreasuryForge to the WeMakeDevs × TrueFoundry Agent Harness Hackathon, an autonomous agent designed to manage a simulated treasury across cash, cryptocurrency, and Indian stock market equities. Built entirely on TrueFoundry's TrueForge platform, the system incorporates computed risk checks, a sandboxed stress-testing environment, and a mandatory human approval gate before any trade executes. A secondary sub-agent periodically audits the primary agent's last 20 decisions and backtests alternative risk thresholds, providing data-driven suggestions to refine trading limits. Before submission, every pull request was reviewed by the Qodo AI code review bot, which uncovered a significant security vulnerability: the wallet server was inadvertently bound to an open network address, creating a potential bypass of the approval gate. The project highlights how autonomous financial agents require rigorous external review beyond the model's own reasoning, particularly when real execution and approval workflows are involved.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

One Developer Rebuilt His Job Search as a Data Pipeline — Here's How

A software developer shared how he restructured his job search by treating it as a staged pipeline rather than a simple to-do list. He defined distinct stages — from sourcing and evaluating roles to tracking outcomes like ghosting, closures, or voluntary rejections — to identify exactly where opportunities were being lost. A scoring system was added at the front end to prioritize roles based on personal fit criteria, ensuring that hard dealbreakers could override otherwise strong matches. This approach reduced wasted effort on low-fit applications and eliminated reliance on memory for follow-ups. The developer argues that separating outcome types and scoring roles upfront provides actionable data that a flat checklist never can.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

vizcrush Launches After Developer Scraps Unverified WASM Performance Claims

Developer tool vizcrush, a set of data visualization primitives built in Rust and compiled to WebAssembly, went open source this week with all 11 packages published on npm. Before launch, the author discovered that a claimed 5–10x WASM performance boost over the JavaScript core had no supporting benchmark data and was contradicted by the repo's own control runs. Only the 32x speed advantage of the JS core over a rival npm downsampling package was backed by actual measurements. Benchmarking also revealed that enabling the SIMD128 compiler flag produced no meaningful runtime improvement for the tested algorithms, prompting a public retraction documented as an architectural decision record in the repository. The project now follows a policy of tying all performance claims directly to verified measurements before publication.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Airflow Scheduling: When to Use Cron Expressions vs. Asset-Based Triggers

Apache Airflow offers two primary scheduling approaches for data pipelines: time-based cron expressions and Asset-based triggers, each suited to different use cases. Cron scheduling runs a DAG at a fixed time regardless of whether upstream data has actually changed, making it predictable but potentially inefficient. Asset-based scheduling, introduced in Airflow 2.4 as Datasets and renamed Assets in Airflow 3.0, triggers a DAG only when dependent data has been successfully updated. Assets use the concepts of inlets and outlets to track what data a task consumes and produces, supporting data lineage, governance, and audit trails. Choosing between the two depends on whether a pipeline's dependencies are better described by time or by the availability of updated data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Vendor-Neutral 2026 Conversational AI Report Reveals Key Trends in Agents and Infrastructure

A free, open-source report built entirely from primary data — including GitHub, Hugging Face, npm/PyPI, job listings, and search trends — maps the state of conversational AI in 2026 across five core layers: interface, orchestration, model, data/memory, and infrastructure. US search interest in 'AI agents' surged nearly 700-fold between early 2023 and 2026, with 'agent' now the dominant term in search data, top repositories, and hiring categories. The Model Context Protocol went from near-zero search volume before late 2024 to tens of thousands of monthly searches within 18 months, rapidly becoming assumed infrastructure in developer tooling. Self-hosting projects like Ollama and llama.cpp lead GitHub star counts, though the report cautions this reflects developer momentum rather than confirmed enterprise adoption. On AI search visibility, 24 of 28 tracked buyer-intent queries now trigger Google AI Overviews, with recommendations drawn heavily from third-party aggregator lists — signaling a shift in how developer tools need to approach discoverability.

0 comments Read more at DEV Community