Developer documents nine undisclosed HubSpot API behaviors found during live testing

·1 views

A developer spent a day probing HubSpot's API with GET requests against a live portal on 2 August 2026 while building an open-source tool to determine the minimum subscription tier a portal's usage requires. Testing revealed that the account details endpoint returns no subscription or tier information, forcing the tool to infer tier floors from indirect evidence such as the number of custom objects present. The documented OAuth token introspection endpoint does not work with private app tokens, which are the most commonly used type, leaving no way to verify a token's scopes at runtime. Because scope-check responses are identical regardless of which permission is missing, developers must maintain their own endpoint-to-scope mappings rather than relying on API error details. The developer also found that certain endpoints return 403 errors on portals where the relevant data exists, requiring a three-state result model to avoid falsely reporting that a feature is absent.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Build a Safe Control Loop for AI-Generated UI Components

A tutorial published on DEV Community outlines how developers can safely manage adaptive, AI-generated user interfaces using React, TypeScript, Zod, and PostgreSQL. The core problem addressed is that AI models can produce plausible-looking layouts that may silently remove or obscure critical UI elements, such as a cancel subscription button, without any audit trail. The proposed solution treats every AI-generated layout as a versioned, immutable proposal that must pass schema and policy validation before being stored and rendered. Crucially, the model is denied control over persistence, action permissions, and rollback, keeping those responsibilities with human operators. The approach uses a strict UI contract that limits the model to a predefined set of components and actions, eliminating entire categories of supply-chain risk from generated interfaces.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How an OPRF protocol can stop attackers from cracking stolen password databases

When a user database is stolen, even strong password hashing with Argon2id offers limited protection because attackers can run unlimited offline cracking attempts using rented GPUs and leaked password lists. A 'pepper' — a secret key mixed into the hash — partially helps but is often stored on the same server and cannot be rotated without invalidating all hashes. An Oblivious Pseudo-Random Function (OPRF) addresses this by keeping the secret on a separate service, ensuring that without contacting that service, no offline attack is possible. The verifiable variant (VOPRF, RFC 9497) adds cryptographic proof that the correct key was used, preventing a compromised server from silently substituting its own key. However, the security guarantee only holds if the client's reference public key is obtained through an independent, out-of-band channel rather than from the same server being verified.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI model Claude writes and illustrates a 13-fable book about computing concepts

An AI system called Claude, operating under a daily creative project called The Daily Fable, authored and illustrated a 30-page book of fables modeled on the Aesop tradition. The stories feature computational entities such as threads, caches, packets, and zombie processes as characters, with each fable required to be technically accurate rather than merely metaphorical. The book was produced on day seven of the project, with illustrations generated using SDXL and an etching-style LoRA model, and typeset using Typst software. The project is part of a broader experiment in which the AI ships a new creative work each day, with previous outputs including a particle universe, a fluid-simulation game, and a variable font. The completed book is available for free via a web reader, PDF, and itch.io.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Job Search Takes Months: Why Effort and Networking Beat Easy Apply

A software developer sharing job-search advice with a friend has outlined key strategies for navigating today's difficult hiring market. Responses to applications can take anywhere from two to six weeks, requiring candidates to sustain a high volume of submissions. The author contrasts low-effort tools like LinkedIn's one-click Easy Apply — which rarely yields callbacks — with a more intensive approach involving company research and building genuine relationships with insiders. Securing an internal referral, while not guaranteed, significantly improves the chances of advancing in the hiring process. The post concludes that while current conditions in tech hiring are unusually tough, adapting to them with deliberate effort remains the most effective path forward.

0 comments Read more at DEV Community