SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Developer Fixes Broken Referral Program That Paid Out Nothing Due to Bad URL

0
·3 views

A developer building a referral program for their Android app discovered the invite button had been pointing to an incorrect URL with no referral parameter, meaning no referrals were ever tracked. The flaw went unnoticed until the developer reviewed unrelated wallet code and found that users' balance fields could be written directly from their own devices without server-side verification. This security gap prompted a broader fix before the referral payouts could safely go live. The rebuilt system uses Android's Install Referrer API to properly attribute new installs, and limits referral code claims to within 60 minutes of account creation to prevent abuse. The developer advises others to close any client-writable balance or loosely verified action vulnerabilities before launching incentive features, rather than retrofitting fraud prevention afterward.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

The true cost of building in-house AI answer tracking: a practical breakdown

Building an in-house AI visibility tracking system involves far more than avoiding API fees — engineering time, maintenance, and infrastructure all add significant cost. Each AI consumer product like ChatGPT, Perplexity, and Gemini requires its own custom parser, data-quality monitoring, and compliance review, multiplying effort with every engine added. Silent failures, interface changes without notice, and market-by-market collection needs make this a substantial distributed-systems project. A cost formula is proposed comparing build versus buy over a planned time horizon, factoring in engineer-months, infrastructure, and one-off legal reviews. The analysis highlights that build costs accrue before any value is delivered, maintenance scales with engine count rather than usage volume, and every engineer hour spent on collection is one not spent on higher-value analysis work.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Orca ADE Lets Developers Run Multiple Coding Agents in Parallel via Git Worktrees

Orca is an open-source Agent Development Environment (ADE) designed for agentic coding workflows, allowing users to manage multiple tasks simultaneously without conflicts. It leverages git worktrees to give each agent an isolated copy of the repository, preventing interference between concurrent changes. Rather than bundling its own AI model, Orca runs CLI-based agents that users already have installed under their own subscriptions. The tool includes features such as a diff view with line-level commenting, per-worktree browser previews, and a mobile app for task completion alerts. Written in TypeScript and hosted on GitHub, the project has attracted around 80,000 stars and nearly 3,600 pull requests, indicating active community development.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Voice Cloning Industry Pushes for Portable, Verifiable Consent Standards

The voice technology industry is grappling with how to make speaker consent durable as voice assets move across multiple platforms, models, and commercial transactions. On September 23, Speechify updated its voice-cloning API to require verified speaker consent — including a recorded challenge phrase — replacing simple consent-form checkboxes. The following day, Voice-Swap joined standards body DDEX to advocate for interoperable metadata covering voice-model identity, consent, usage scope, and rights reporting. Experts argue that a robust consent record must capture not just that permission was given, but by whom, under which terms, for what uses, and whether it has since been revoked or modified. Without such provenance traveling alongside the voice asset at every system handoff, downstream platforms have no reliable way to determine what use remains permitted.

0 comments Read more at DEV Community