Developer builds open-source secrets manager to fix painful .env file sharing at work

·1 views

A developer working in the financial industry created an open-source secrets manager called Dopbase after repeatedly struggling with his company's secure file-sharing process for .env files. Security policies at his workplace prohibited sharing environment files via email or messaging apps, requiring a multi-step approved channel that had to be repeated in full whenever any variable changed. The cumbersome workflow turned minor configuration updates into time-consuming administrative tasks, prompting him to build a dedicated solution. Dopbase is designed to keep secrets encrypted and access-controlled while eliminating the need for teams to manually pass updated files back and forth. The project is free, open source, and publicly available on GitHub for other developers facing similar challenges.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Three MCP Servers That Extend Claude Desktop With Files, GitHub, and Postgres

A developer has shared three Model Context Protocol (MCP) servers they actively use with Claude Desktop to streamline daily workflows. The filesystem server allows Claude to directly read project files, eliminating the need to manually copy and paste code into the chat. The GitHub server enables Claude to review pull requests, check issues, and browse repositories without leaving the conversation. A PostgreSQL server grants Claude direct database query access, useful for tasks like identifying user activity patterns. Each server can be installed via the mcp-hub CLI in roughly two minutes, though users are cautioned to restrict filesystem path access carefully to avoid unintended disk exposure.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Mainframe Migration Tools: What They Do Well and Where They Fall Short

Mainframe migration tools fall into four broad categories: discovery and analysis, rehosting and emulation, automated code translation, and data migration — and most real programmes require tools from at least three of them. Vendor demos of automated COBOL-to-Java conversion often look impressive, but are typically run on cleaner code than what organisations actually have in production. While automated translation reliably produces runnable code, it rarely produces maintainable code, and bridging that gap is where the majority of migration budgets are spent. Discovery and analysis tools are considered the most consistently valuable category, as no organisation typically has a full picture of a system built up over decades. Buyers are also advised to scrutinise vendor ownership before signing long-term agreements, as consolidation through acquisition is common in this market.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer admits mislabeling a build failure as 'unknown' to avoid a hard negative result

A developer building a check system that uses three result states — pass, fail, and unknown — incorrectly marked a detected dependency cycle as 'unknown' instead of 'fail', a mistake caught by a teammate. The author argues the 'unknown' state should only apply when a check cannot reach a conclusion, such as when an input file is missing or a human-produced record cannot be re-run. A completed graph traversal that confirms a cycle is a definitive negative answer, making it a clear failure. The error was compounded by the fact that the 'unknown' label felt principled and humble, while quietly removing a red flag from the build summary. The author's key takeaway is that if a check ran to completion and returned a negative result, it must be recorded as a failure — 'unknown' is for the absence of an answer, not for an answer that is inconvenient.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How ~900 Silent Catch Blocks Were Hiding Real Payment Failures in Frontend Code

A frontend engineer discovered that HTTP 200 responses from a payment BFF were masking real user-facing errors, including TypeErrors on payment buttons, across four separate frontend repositories. A static grep of the codebases revealed approximately 900 empty or swallowed catch blocks — none of which produced runtime telemetry. The engineer rejected default SDK configurations, opting instead for conservative sampling rates and mandatory domain tags to comply with Brazil's LGPD data privacy rules and avoid PII leakage to third-party vendors. Rather than replacing existing Grafana and APM tooling, the approach was designed to fill a specific gap: capturing client-side errors tied to release versions and user journeys. The resulting setup treats frontend observability as a revenue-gap problem, not a tooling exercise, with sampling rates and tagging contracts documented before any SDK was deployed to production.

0 comments Read more at DEV Community