Developer finds three self-made bugs after testing his security extension on 20 real sites

·1 views

A developer building 'QuickAudit', a browser extension that runs OWASP-style security checks on web pages, discovered three significant bugs in his own tool after testing it against 20 real-world websites. One flaw caused the extension to audit Cloudflare bot-protection interstitial pages instead of the actual target site, producing false security findings. A second bug stemmed from a misread web specification, incorrectly flagging the 'origin-when-cross-origin' Referrer-Policy as high-risk when it actually restricts cross-origin data exposure. A third issue involved flagging sites like Stripe and NASA for using 'X-Frame-Options' without a modern CSP directive, a technically outdated but still widely supported and functional security header. The developer used these findings to overhaul parts of the extension's architecture, adding challenge-page detection and revising how low-severity informational findings are surfaced to avoid alert fatigue.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How a Dispatch Table Pattern Can Replace Messy If-Else Chains in Code

A software developer shared how repeated copy-paste logic in a large if-else chain handling third-party API payloads prompted a refactoring exercise. The codebase processed different JSON event types — orders, refunds, and shipments — using nearly identical logic duplicated across each conditional branch. The developer identified that each branch shared the same function signature, making it a classic candidate for a dispatch table or strategy pattern. By mapping event type discriminators to individual handler functions stored in a plain object, the sprawling conditional block could be replaced with a single lookup. The approach improves testability, reduces duplication, and makes adding new event types significantly simpler.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Claude Code hooks can enforce strict directory boundaries for unattended agents

Claude Code offers two mechanisms to restrict where an AI agent can write files, but they serve different purposes and are not interchangeable. The permissions.deny setting works as a block-list, but cannot replicate an allow-list because its precedence rules cause a blanket deny to override any exceptions. For finer control — such as limiting an agent to a specific subdirectory within a project — developers need to implement a PreToolUse hook, a command that intercepts file-writing tool calls before they execute. The hook receives the pending operation as JSON on stdin and can respond with an allow, deny, ask, or defer decision, along with a reason passed back to the model. This approach provides binding, code-enforced scope control that remains active even when no human is monitoring the agent.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Detect a Song's BPM and Key: Manual, DAW, and Tool Methods

Finding a song's tempo and musical key is essential for producers, DJs, and remixers working with audio. The quickest manual method involves counting the beat for 15 seconds and multiplying by four, though ambiguity can arise when a track feels half or double its actual tempo. DAW-based grid alignment offers a more precise approach, revealing tempo changes, live timing drift, and misaligned samples across an arrangement. Dedicated analysis tools like KeyFinder can automate the process, detecting BPM, musical key, scale type, and Camelot code from audio files or live system audio. Each method suits different workflows, with manual counting offering speed, DAW alignment offering accuracy, and software tools offering efficiency for batch processing or session prep.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Migrates Jenkins Freestyle Jobs to Declarative Pipelines on AWS

A developer documented their process of setting up Jenkins on an AWS Ubuntu EC2 instance, configuring Docker-out-of-Docker to allow Jenkins to build images via the host machine's Docker socket. The project initially used Freestyle jobs to run Node.js commands, but their limitations in handling multi-step workflows prompted a migration to Pipeline jobs written in Groovy. The new declarative pipeline, stored as a Jenkinsfile directly in the repository, defined clear stages for code checkout, dependency installation, testing, artifact packaging, and pushing Docker images to DockerHub. Credentials were secured using Jenkins' Secret text plugin within a withCredentials block to prevent sensitive data from appearing in build logs. The developer plans to extend the setup with Multibranch Pipelines and Jenkins Parameters to further automate and configure builds across multiple repository branches.

0 comments Read more at DEV Community