Developer Finds 4 Security Bugs in Live AI Student Platform DoubtDesk

·1 views

A developer auditing DoubtDesk, an anonymous AI-powered doubt-solving platform for students built on Next.js and PostgreSQL, discovered four bugs in a single review session. The most critical flaw was a GET endpoint that silently inserted dummy notification rows into the production database every time the URL was visited, with no environment check or access control. This meant bots, crawlers, or anyone sharing the link could repeatedly pollute live data without any user intent. The same endpoint also leaked full server-side stack traces to the client in error responses, a significant information-security risk. The developer patched the issues by restricting mutation to POST, blocking the route in production, and stripping stack traces from API error responses, also adding Jest tests to prevent regression.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

BlackBull framework now runs HTTP and MQTT 5 in a single Python file

The BlackBull Python web framework has added native MQTT 5 broker support, allowing developers to run HTTP and MQTT protocols together in one application file with a single pip install. The MQTTExtension can be attached to a BlackBull app, binding an MQTT broker to port 1883 while the HTTP server runs on port 8000. Because both protocols share the same process, data can be exchanged through plain in-memory variables without needing Redis, message queues, or any broker sidecar. The framework also auto-generates AsyncAPI documentation for MQTT routes, mirroring its existing OpenAPI 3.1 support for HTTP endpoints. Developers can subscribe to parameterised MQTT topics using the same decorator-based syntax used for HTTP routes, keeping the codebase consistent across protocols.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Spring Boot PostgreSQL COPY Protocol Eliminates Batch Size Tuning for Bulk Inserts

A software engineer building a real-time interbank settlement pipeline faced unpredictable daily transaction volumes, making it risky to hardcode a JDBC batch size for bulk database inserts. Standard JDBC batch inserts in Spring Boot require selecting a fixed batch size, which can cause too many database roundtrips if too small or memory and timeout issues if too large. To avoid this tradeoff, the engineer turned to PostgreSQL's COPY protocol, which streams an entire dataset directly into a table in a single operation, bypassing per-row parsing and execution overhead. In Spring Boot, this is implemented via PostgreSQL's CopyManager API, which requires unwrapping the HikariCP connection proxy to access the native driver. The approach removes the batch size as an application-level tuning variable, letting PostgreSQL and network capacity determine throughput instead.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Typed: Open-Source Python Clients Aim to Fix Crypto Exchange API Inconsistencies

A team of proprietary traders has released Typed, a suite of async, fully-typed Python clients designed to address common inconsistencies in crypto exchange APIs. The library provides one package per exchange venue with a consistent interface, validating all responses at the boundary before they reach user code. Four clients are currently live on PyPI under the typed-* namespace, covering Hyperliquid, Alchemy, MEXC, and dYdX, with more exchanges in active development. The developers say the tooling emerged from their own live trading needs, which they argue holds the project to a higher maintenance standard than typical open-source software. The packages are published under the GPLv3 license, and the team is welcoming community contributions and feedback via GitHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Reflects on AI's Growing Role and What It Means for Coding Skills

A developer writing on DEV Community describes relying heavily on AI-generated code since May 2025, mostly reviewing output rather than writing from scratch. While acknowledging AI's significant improvement over early tools, the author admits feeling conflicted about integrating generated code into their personal workflow. A deeper concern has emerged: the fear of becoming professionally redundant as AI handles more technical tasks. The author suggests that the future developer role may shift toward asking better questions, making sound judgments, and catching errors in AI output rather than writing every line manually. Despite this pragmatic view, they express nostalgia for the hands-on problem-solving experiences that defined traditional software development.

0 comments Read more at DEV Community