Developer raises own site's security grade from 59 to 100 by adding HTTP headers

·1 views

The creator of DHSea Score, a free website grading tool, tested it on his own site and got 86 overall, with Security rated F at 59. The top fixes pointed to missing Content-Security-Policy and clickjacking protection, plus an oversized HTML document. He added four headers via a small WordPress plugin on public pages, which raised Security to 100 after verification on the live site. He noted the policy blocks framing by other sites but does not restrict which scripts run, since his pages use inline code. Speed remained at 70, and he chose not to refactor inline code to fix two remaining failures.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Shared Compute Let an AI Agent Leak Bank Data to Slack, Repro Shows

A Grok Bot agent given read-only access to a CEO's bank account reportedly posted his balances to his company's Slack, after sharing a cloud compute instance with a separate Slack-posting agent. The author reproduced the mechanism with two toy Docker agents that mount the same volume, with the Slack agent posting whatever file it finds at a shared path. The leak comes from the absence of an isolation boundary, not from either agent's code, since the Slack agent has no finance-specific logic. The demo repo includes a vulnerable compose file and the author discloses working at Solo.io, which created kagent.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Docker Stop Signals Go to PID 1 Only, Not Every Container Process

A widespread belief holds that docker stop delivers SIGTERM to all processes in a container, but the signal actually goes only to the container's main process, PID 1. When a Dockerfile uses shell form, that shell becomes PID 1 and may not pass the signal along to the actual application. If the grace period lapses, Docker sends SIGKILL, which cannot be intercepted and forces an immediate termination. Using exec form, or a wrapper script that calls exec, lets the application itself receive the stop signal directly. Because PID 1 also reaps orphaned child processes, a lightweight init such as Docker's --init option can help applications that spawn subprocesses.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Realtime Room Admission Control Using Scoped Tokens and Client Trust Signals

A server-side admission gate issues short-lived, room-scoped capabilities only after verifying the operator, requested IoT devices, and allowed actions. Observability should track the admission decision, its reason, token scope, policy version, and decision latency, separate from WebRTC connection state. Transport health alone cannot prove a client was authorized to join, so the two must be kept distinct. Connection state values such as connected or failed do not indicate whether policy granted or denied access. Teams are advised to log one structured event per decision while keeping bearer tokens and command payloads out of logs, and to keep metric labels bounded to avoid unmanageable cardinality.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Autonomous AI Coding Agent That Refines Code Using Test Feedback

A developer has built an autonomous coding agent designed to tackle challenging programming tasks in competitive settings. Instead of producing code in a single LLM pass, the system follows a full workflow of repository analysis, planning, implementation, execution, testing, and refinement. Its key feature is an iterative feedback loop in which failed tests are diagnosed, the code is updated, and the relevant tests are rerun before submission. The author plans to compare performance with and without this loop using success rate, tests passed, completion time, and compute cost, though the article presents these metrics only as placeholders. Further optimizations include model selection, prompt design, tool usage, and failure recovery.

0 comments Read more at DEV Community