Developer builds free plugin to scan Framer code components for security risks

·1 views

A developer has released a free plugin for Framer that scans code components — the .tsx files under Assets — for potential security vulnerabilities. The tool checks for exposed API keys across 15 services, including OpenAI, Stripe, Supabase, and AWS, flagging only genuinely sensitive credentials while ignoring browser-safe keys like Stripe publishable keys to reduce false positives. For Supabase, the plugin decodes JWT tokens to distinguish the safe anon key from the dangerous service_role key, which bypasses row-level security entirely. The plugin also flags imports loaded over plain HTTP or from unrecognised domains, since such dependencies give third-party hosts potential control over site behaviour. A key limitation is that Framer's API does not expose user-authored custom code added via Settings, so that attack surface remains outside the plugin's reach.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Biome: One Rust-Powered Tool Replacing ESLint and Prettier for JS Developers

Biome is a single Rust-based developer tool that combines code formatting and linting, replacing the widely used ESLint and Prettier combination. It operates with one unified configuration file and a shared parser, eliminating conflicts that commonly arise when running two separate tools. The formatter claims approximately 97% compatibility with Prettier, while its linter draws from hundreds of rules inspired by ESLint and TypeScript ESLint. Biome supports multiple languages including JavaScript, TypeScript, JSX, JSON, CSS, HTML, and GraphQL, and can format, lint, and organize imports in one command. Major companies such as Vercel, Cloudflare, Discord, Microsoft, and Google are reported to be using it in production environments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Bug Bounty Hunting in 2026: How Beginners Can Get Paid to Find Security Flaws

Bug bounty hunting has become one of the fastest-growing entry points into cybersecurity, allowing beginners without degrees to legally find and report software vulnerabilities for pay. Platforms like HackerOne, Bugcrowd, and Immunefi connect independent researchers with companies that authorize testing of their websites, apps, and APIs within defined scopes. In 2026, high-value targets include AI and LLM vulnerabilities, broken access controls, race conditions, and business logic flaws. Experts advise starting with unpaid Vulnerability Disclosure Programs to build a track record before competing for bounties, and writing clear, reproducible reports over lengthy vague ones. While AI tools are reshaping the field, platforms are cracking down on low-quality automated submissions, making human judgment a key differentiator for serious hunters.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GitHub Billing Controls Help Teams Track and Manage Rising AI Costs

Organizations using GitHub Copilot Enterprise are facing unexpectedly high AI bills, prompting administrators to investigate cost drivers using GitHub's billing administration portal. The platform allows usage to be broken down by product category, organization, and cost center, helping leaders identify which teams are responsible for increased spending. In one example, a single cost center was found to account for the majority of AI credit usage, averaging around $20,000 per month. To address this, administrators can set tiered budget limits at the organization, cost center, and individual user levels through the Budgets and Alerts page. This approach aims to give finance teams spending predictability while allowing engineering teams to preserve productivity gains from AI tool adoption.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Python Build Standalone Project Offers Portable, Self-Contained Python Distributions

A project called Python Build Standalone provides pre-built Python distributions designed to be highly portable and self-contained. These distributions aim to run across various systems without requiring system-level dependencies or complex installation steps. The project is documented and maintained by Gregory Szorc, with details hosted on his personal documentation site. Such distributions are particularly useful for developers who need to bundle Python in applications or run it in constrained environments. The project gained attention on Hacker News, where it was shared as a technical resource for the Python community.

0 comments Read more at Hacker News