Developer fixes drift detector blind spot that missed 200-day-old unrotated secrets

·2 views

A developer discovered that their cloud drift detection tool, which works by comparing two snapshots to identify changes, was unable to flag secrets that had not been rotated for extended periods — in one case, 200 days. The core flaw was that the engine only detected change-based risks, while stale rotation is a standing condition that produces no diff between scans. To fix this, the developer built a separate rotation-assessment module that evaluates current state without requiring a previous snapshot, grading findings on a severity ladder from HIGH to CRITICAL based on how overdue rotation is. The solution uses AWS Secrets Manager's ListSecrets API, which returns rotation metadata without ever accessing secret values, ensuring credentials stay secure. Both the change-based and rotation-based modules emit findings in the same structured format, allowing their outputs to be merged into a unified risk stream.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How a stability-check loop cut false positives in visual regression monitoring

A software team found that screenshot-based visual monitoring was generating overwhelming false alerts, with 46 out of 47 flagged changes on one homepage caused by a rotating testimonial carousel. Common fixes like loosening pixel-diff thresholds or manually excluding dynamic elements proved unreliable, especially after page redesigns invalidated the configurations. The team's effective solution was a stabilization pass that pauses carousels and videos, removes cookie banners, and force-loads lazy content before any comparison is made. They then capture two consecutive screenshots and diff them against each other, only proceeding if fewer than 0.1% of pixels differ between the two. If the page fails to stabilize after two attempts, the job is flagged as unstable rather than silently passing a noisy baseline to review.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DevTime v0.1.2 Gives Coding Agents Verified Repo Memory via Local MCP Server

Developer tool DevTime has released version 0.1.2, introducing a local MCP server that coding agents can query to understand a repository before making edits. The tool scans codebases and surfaces structured knowledge — including supported concepts, evidence file paths, and explicit uncertainty — rather than letting agents guess at code structure. Three read-only tools are exposed: list_concepts, explain_concept, and get_context_pack, which bundles governed context for agents before they touch code. DevTime operates entirely locally with no cloud connectivity, no telemetry, and no code execution during scanning. It can be integrated with clients like Claude Code using a single command and is installable via pipx with optional MCP support.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Capacitors Store and Release Energy: The Math Behind the Flash

A capacitor stores energy in an electric field by accumulating charge against a rising voltage, with the total energy calculated using the formula E = 0.5 × C × V². Unlike batteries, capacitors can release their stored energy almost instantaneously, making them essential in camera flashes, defibrillators, spot welders, and microcontroller backup circuits. The stored energy depends linearly on capacitance but quadratically on voltage, meaning doubling the voltage quadruples the energy — a key reason engineers favor higher voltages over larger capacitors in pulse-power designs. This non-linear relationship also has safety implications, as large capacitors in power supplies and motor drives can retain hazardous charge long after equipment is switched off. Understanding how to calculate stored energy helps engineers correctly size backup capacitors, design safe bleeder resistors, and ensure pulse circuits deliver adequate performance.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Replacing Magic Numbers with Named Constants Cleans Up Legacy Code

A software developer shares lessons learned from refactoring a legacy service containing over 2,000 lines of code riddled with unexplained literal values, often called 'magic numbers.' The core fix involves replacing hard-coded values like file size limits, retry counts, and thumbnail dimensions with clearly named constants stored in a dedicated file. This approach improves readability, reduces bugs caused by inconsistent updates across multiple code locations, and makes testing easier. The refactored code becomes self-documenting, since constant names like MAX_UPLOAD_ATTEMPTS convey intent without relying on comments that can become outdated. The article uses a Python file-upload function as a practical before-and-after example to illustrate the technique.

0 comments Read more at DEV Community