Developer finds critical GitHub write-guard in MCP server had no automated test

·1 views

A developer building an MCP server that lets Claude interact with GitHub and DEV.to discovered that a key security function blocking write operations had never been covered by automated tests. The server uses a GitHub token scoped with full write access, shared from a broader project, even though the MCP component is intended to be strictly read-only. A single guard function called `_gh()` enforces this by rejecting any non-GET request, but the project's self-test suite — which covers several other regression cases — omitted a test for this specific check. This means the guard could be silently removed in a future edit or merge conflict without any automated test catching the regression. The developer flagged the gap on July 30, 2026, noting that the read-only promise was enforced by code convention alone rather than verified behaviour.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Morse Code Constraints Reshaped One Developer's Approach to Accessible UI Design

A developer building a Morse code translator received feedback from users relying on assistive switch devices, where the only available input is a single short or long press. This binary input constraint mirrors Morse code's original two-symbol design, making the 1830s encoding a surprisingly natural fit for severely limited modern input hardware. The developer found that timing thresholds — distinguishing a dot from a dash — effectively become the entire interface, and that fixed global thresholds fail users with inconsistent motor control. To address this, an adaptive calibration approach was implemented, adjusting thresholds based on each user's own initial inputs rather than a universal standard. The experience broadened the developer's thinking about input design, highlighting that optimizing for fluency and forgiving signal interpretation matters most when an interface must serve users with constrained physical input.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Scroll-Animated Bengali Restaurant Landing Page Using Pure CSS and SVG

A developer has created 'Rannaghar,' a fictional Bengali restaurant landing page submitted to the Frontend Challenge Comfort Food Edition. The project uses no raster images, relying entirely on CSS, inline SVG, and typography to render visuals including a hero cooking pot, flames, and steam. Key technical features include scroll-driven animations via the CSS animation-timeline property, pure CSS tab state machines powered by the :has() selector, and a JavaScript fallback for broader browser compatibility. Accessibility was treated as a core requirement, with semantic landmarks, keyboard navigation, spice-level announcements, contrast-checked colors, and full prefers-reduced-motion support throughout. The developer noted that named view-timelines simplify scroll choreography and plans to explore the View Transitions API and an optional sizzle sound toggle in future iterations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Clean Data, Not Better Models, Is the Key to Reliable AI Outputs

A recurring problem in AI deployments is that poor data quality — not model capability — drives inaccurate or misleading outputs. Common issues include duplicate files, outdated content, contradictory records, unreadable scanned documents, and inconsistent formatting across datasets. Experts argue that feeding an AI more data does not improve its performance; feeding it cleaner, well-structured data does. The recommended fix is a continuous data pipeline that centralizes sources, standardizes formats, deduplicates records, and enriches files with metadata. Only the cleaned, current dataset should be used to build the knowledge base that AI agents query.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build a Dead-Letter Queue System for Reliable Webhook Processing

When webhook deliveries fail permanently due to schema mismatches, expired certificates, or downed endpoints, endlessly retrying them wastes compute and clogs pipelines. A dead-letter queue (DLQ) acts as a quarantine and forensic log, capturing failed events so engineers can inspect, fix, and replay them. Effective DLQ architecture typically uses two tiers: a fast ingestion broker to absorb dead-lettered events and a queryable storage layer with full execution context preserved in an envelope around each payload. Major cloud providers like Amazon SQS and Azure Service Bus offer native DLQ capabilities, including controlled redrive and automatic dead-lettering after a configurable delivery attempt threshold. However, production systems often need additional tooling on top of these managed services to support payload editing, root-cause analysis, and selective manual replay.

0 comments Read more at DEV Community