Developer Rebuilds CI Pipeline With Disposable MicroVMs After Near-Credential Theft

·1 views

A developer discovered a near-miss security breach when a suspicious pull request to an open-source project contained a hidden CI config change designed to exfiltrate cloud credentials stored on a self-hosted runner. The incident exposed a fundamental risk: self-hosted CI runners execute untrusted code from strangers while persisting between jobs, making any stored credentials vulnerable. Containers were ruled out as insufficient, since they share the host kernel and offer limited isolation. The developer rebuilt the pipeline using Firecracker microVMs on Krova Cloud, provisioning a fresh, disposable instance per job that is deleted immediately after completion. Each microVM runs on a private network with no public IP, no persistent state, and secrets injected only as short-lived runtime tokens, significantly shrinking the attack surface.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Key Considerations for Managing Cisco ACE Load Balancers in Production

The Cisco ACE load balancer, available as the ACE 4710 appliance or as a module inside network hardware, sits between clients and backend servers acting as a reverse proxy or Layer 4 load balancer. Administrators must understand how virtual IPs, class maps, policy maps, server farms, and health probes interact as a connected chain rather than isolated settings. Traffic distribution methods such as weighted round-robin and least-connections serve different purposes, and choosing between them should be based on actual application traffic patterns rather than algorithm names alone. Health probes require careful selection, since a TCP probe only confirms a port is open, while an HTTP probe against a dedicated endpoint provides a more accurate signal about whether the application is truly ready to serve traffic. Routing design, slow-start for new servers, and connection state management are also highlighted as factors that directly affect load balancer reliability and must be considered alongside the core configuration.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MyZubster Builds Monetization Layer to Enable Economic Transactions for Zorgax AI

MyZubster has completed a new monetization architecture built on top of its Payment Layer, designed to allow autonomous agents, applications, and users to interact economically with its Zorgax AI service. The implementation includes a server-side product catalog and pricing system, with the server maintaining authoritative control over the relationship between products, prices, payment intents, and credits. Security measures such as transaction idempotency, anti-replay protections, and auditable credit movements were incorporated as core protocol requirements from the outset. Eight test suites are currently passing, though Bitcoin payments remain disabled by default and no production activation is part of this development stage. The broader goal is to create an open ecosystem where humans, AI agents, robots, and digital services can coordinate and transact through shared protocols.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds browser-only HEIC to PDF tool that never uploads your files

Developer Nadia created HEICtoPDF, a free browser-based tool that converts iPhone HEIC photos to PDF entirely on the user's device, without uploading files to any server. The privacy-first design was driven by the recognition that HEIC files are typically photos of sensitive documents like passports and ID cards. The local-processing approach comes with deliberate trade-offs, including a 10MB per-file limit, lossy JPEG re-encoding at 0.85 quality, and no file history or stored state. Batch conversion and merging are supported, though combining large files locally can strain browser performance. The tool is available free at heictopdf.dev with no account or installation required.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Python tool lets travelers track cheapest Google Flights fares without an API key

A developer has demonstrated how to extract structured flight fare data from Google Flights using a third-party Apify actor called Flight Price Tracker, requiring no official API key. The tool accepts a route, a start date, and a date window, then returns one row per departure day showing the cheapest available fare, airline, stops, and timing. Users can set a maximum price filter so only qualifying fares are returned, and unmatched runs incur no cost while still reporting the real cheapest fare found. Relative date inputs such as '14 days' or '6 weeks' keep scheduled daily runs perpetually forward-looking without manual updates. The setup can be paired with Python and automation tools like n8n to log fare history to CSV and trigger alerts whenever a price threshold is met.

0 comments Read more at DEV Community