Developer finds site advertised rate limits for months with no enforcement code

·2 views

A developer discovered that their Cloudflare Worker had been sending RateLimit headers on every response, promising a cap of 100 requests per 60 seconds, while no actual limiting logic existed anywhere in the codebase. The flaw meant no 429 responses were ever returned, and any well-behaved automated agent trusting those headers would have unnecessarily throttled itself against a non-existent limit. The bug surfaced during an internal audit while the developer was preparing answers to tough questions about the site's own agent-readiness standards. A fix was implemented using Cloudflare's Workers rate limiting binding, keyed to client IP, which now enforces the same 100-requests-per-60-seconds limit the headers had long advertised. The developer noted a key limitation: because the site has no accounts or logins, IP-based keying is the only option, meaning multiple users sharing a proxy or NAT address share a single request budget.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds Live Attack-Detection Lab Using OWASP Juice Shop and SecureNow

A developer has demonstrated how to combine OWASP Juice Shop, a deliberately vulnerable web application, with SecureNow's SDK to create a real-time attack-detection environment. OWASP Juice Shop simulates an e-commerce platform built on Node.js and Express.js, intentionally embedding flaws covering nearly every category of the OWASP Top 10, including SQL injection, XSS, and authentication bypass. By integrating SecureNow's SDK into the project, HTTP request lifecycle events are captured and streamed to a live dashboard as they occur. The setup was validated by manually browsing the app and performing actions such as failed logins, with each event appearing on the dashboard in real time. The combined setup allows security learners to observe attacks being flagged the moment they happen, offering a practical defender's perspective rather than purely theoretical study.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Revisits Twelve-Factor App Methodology for the Age of AI Systems

Software engineer Adam Wiggins originally published the Twelve-Factor App methodology in 2011 as a guide for building stateless web applications on platform-as-a-service infrastructure. A developer has now revisited all twelve factors to assess their relevance in an era of AI coding agents and AI-native applications. The review is driven by two core premises: that software authors and operators are increasingly non-human, and that application behavior is now shaped by factors outside the codebase itself. Rather than discarding or blindly applying the original factors, the author argues that the underlying principles remain valid but the environment around them has fundamentally shifted. A second part is planned to address areas the twelve factors never covered, including input handling, evaluation agents, and data lineage through model calls.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Zone01 Kisumu IP Training Highlights Why Software Engineers Must Understand IP Law

A developer who attended an intellectual property training session at Zone01 Kisumu has shared key takeaways on how IP law affects software engineering. The session covered the distinction between copyright and patents, noting that copyright automatically protects source code upon creation but does not prevent independent reimplementation of the same logic. Attendees also learned about open-source licensing, with permissive licenses like MIT and Apache 2.0 allowing commercial use provided original copyright notices are retained. Work-for-hire agreements were another focus, explaining that employment contracts often transfer code ownership to employers, including work done using company resources. The session underscored that understanding IP law is an essential skill for modern engineers, not just legal professionals.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Memento's Leonard Shelby Dissected as a Flawed RAG Pipeline

A DEV Community essay draws a detailed parallel between Christopher Nolan's 2000 film Memento and retrieval-augmented generation (RAG), arguing that protagonist Leonard Shelby functions as a real-world model of the architecture. Like a RAG system, Leonard distrusts internal memory and relies entirely on externalized, auditable records — Polaroids, notes, and tattoos — to operate. The analysis highlights how Leonard's system lacks provenance, versioning, and conflict detection, mirroring critical weaknesses found in production RAG pipelines today. Key film moments, such as the altered caption on the 'Teddy' Polaroid and the destruction of records at the burn barrel, are mapped to failure modes like poisoned knowledge bases and undetected data deletion. The piece concludes that every catastrophic mistake Leonard makes is a recognizable engineering bug currently shipping in real AI systems.

0 comments Read more at DEV Community