Developer Documents 8 Undisclosed M-Pesa STK Push Behaviors That Can Break Payment Systems

·2 views

A developer building an open-source mobile money gateway conducted systematic tests on Safaricom's Daraja STK Push API between September 18–23, 2025, using the sandbox environment. A critical finding reveals that the API password is merely Base64-encoded — not hashed — meaning anyone who accesses a request body, debug log, or APM trace can recover the passkey, and no documented revocation endpoint exists. Error code 500.001.1001, widely interpreted as 'transaction does not exist,' was observed returning unreliably even for confirmed live transactions, making it an unsafe basis for payment status decisions. The AccountReference field chosen by the caller is neither idempotency-safe nor echoed back in the response, meaning duplicate submissions can generate two separate payment prompts for a single order. The developer recommends treating request bodies as secret-bearing, building idempotency into the caller's own system, and treating ambiguous error codes as 'unknown — retry later' rather than definitive failures.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Power BI Data Modelling: From Flat Tables to Star Schema Explained

Data modelling in Power BI involves organizing tables, defining relationships, and establishing rules that govern how data is stored, filtered, and queried. A flat table structure, where all data exists in a single table, leads to significant redundancy, bloated file sizes, and poor performance. The star schema is the industry-recommended design pattern, featuring a central fact table surrounded by descriptive dimension tables. In a retail example, a FactSales table holds transactional data linked via foreign keys to dimension tables like DimDate, DimCustomer, DimProduct, and DimStore. A well-designed data model improves analytics accuracy and simplifies DAX calculations in business intelligence solutions.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Opinion: Why the Tech Industry Needs More Humanities-Trained Professionals

A recently published opinion piece argues that the technology sector needs humanists more than ever. The article, hosted on passo.uno, makes the case for integrating humanities expertise into tech environments. It gained traction on Hacker News, accumulating 14 points and at least one comment. The piece reflects a broader ongoing debate about the role of liberal arts and humanistic thinking in shaping responsible and effective technology development.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Tutorial unifies Python, PHP, Prometheus, Loki and OpenTelemetry into one Docker Compose stack

A DEV Community tutorial series has culminated in a single Docker Compose configuration that integrates all previously built observability components, including Python and PHP mini-apps, Prometheus, Loki, and Grafana. The key addition in this final article is an OpenTelemetry Collector, which acts as a central intermediary to receive distributed traces from both applications via the OTLP protocol. Previously, apps exported spans directly to the console for testing; now they forward telemetry to the collector, which handles routing to any backend without requiring changes to individual applications. The setup uses a debug exporter to confirm the full pipeline works end-to-end, while noting that a dedicated tracing backend like Grafana Tempo or Jaeger would be needed for visual span exploration. The author positions this as a natural next step for developers looking to deepen their observability practice beyond this introductory series.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Reciprocal Rank Fusion Combines Vector and Keyword Search for Better RAG Retrieval

Retrieval-Augmented Generation (RAG) systems often struggle because vector search excels at semantic similarity but fails on exact tokens like error codes, while keyword search does the opposite. Reciprocal Rank Fusion (RRF), a technique introduced in a 2009 paper by Cormack, Clarke, and Buettcher, solves this by ignoring raw scores entirely and combining results based solely on document rankings from each search method. The core formula assigns each document a fused score by summing the inverse of a constant k plus its rank across all result lists, making scores from incompatible systems directly comparable. A damping constant of k=60 is the widely accepted default, ensuring top-ranked results carry more weight without completely overshadowing lower-ranked ones. Because RRF only requires ordered lists rather than raw scores, it can be applied to any combination of rankers, including dense retrievers, lexical indexes, and rerankers simultaneously.

0 comments Read more at DEV Community