Developer releases CLI tool to help JS/TS apps comply with India's DPDP Act 2023

·4 views

India's Digital Personal Data Protection (DPDP) Act, 2023 is now in force, carrying penalties of up to ₹250 crore for violations such as loading trackers without user consent or storing personal data unencrypted. A developer has released an open-source CLI tool called @dpdp-india/audit that statically scans JavaScript and TypeScript codebases to flag non-compliant patterns, functioning similarly to ESLint but focused on privacy rules. The tool covers 13 rules, detecting issues ranging from unguarded Google Analytics and Facebook Pixel loads to bulk data exports lacking audit trails. It also ships with a ready-to-use Next.js consent system, including a banner component and a consent-aware script loader, so developers can remediate flagged issues quickly. The package additionally supports SARIF output for integration with GitHub Code Scanning and can be configured to fail CI builds when violations are detected.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Vector Search Is Becoming Data Infrastructure, Not a Standalone Database Choice

The growing adoption of retrieval-augmented generation (RAG) has led many teams to prioritize vector databases before establishing a proper data model, which experts argue is the wrong approach. Major cloud platforms are absorbing vector search into existing infrastructure: AWS has made S3 Vectors generally available, Google supports vector indexes in BigQuery, and Cloudflare Vectorize integrates retrieval with edge applications. This shift signals that specialized vector databases are not obsolete, but the assumption that every use case requires one is fading. Production systems demand answers to complex questions around data freshness, deletion ownership, tenant isolation, and security filtering — concerns that go far beyond picking an index. Vector search is increasingly being treated as a data infrastructure problem, with at least five distinct workload types — including hot product retrieval, permission-sensitive enterprise retrieval, and cost-sensitive cold archiving — each carrying different technical and operational requirements.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer audit of Claude Code logs uncovers real AWS keys and risky commands

A developer auditing their own Claude Code session logs discovered that AI coding agents store full transcripts of everything they process, including sensitive credentials, in local JSONL files. Scanning 59 session files across multiple projects revealed 71 findings in one project alone, including database connection strings, JWTs, and two live AWS access keys in another. The logs also recorded risky commands the agent had executed, such as curl-piped-to-bash scripts and destructive shell operations. In response, the developer built and open-sourced a tool called agent-audit, which scans these log files locally for leaked secrets and dangerous command patterns without sending any data externally. The findings highlight a broader security gap as agentic coding tools become more capable and routinely handle sensitive project data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Client-Side Watchdog Fixes Silent AI Stream Drops Caused by Proxy Timeouts

AI chat streams can cut off silently at exactly 30 seconds due to a proxy read timeout, not a model failure — the reverse proxy closes idle upstream connections after 30 seconds of no data. A developer identified the issue while testing a chat widget, finding that tokens flowed normally until the model paused, at which point the gateway dropped the socket without sending any error or close event. The bug was confirmed by reproducing the cutoff via curl and a local test server that simulated a 35-second pause between streamed responses. The root cause is the classic proxy_read_timeout behavior in reverse proxies like Nginx, which measures silence between reads rather than total connection time. The recommended fix is a client-side watchdog that monitors chunk delivery intervals and transitions the UI to an honest error state when the stream goes quiet beyond a set threshold.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Apex Grid Technologies Builds Self-Hosted Postiz Instance with Python API Client

Apex Grid Technologies has deployed a self-hosted instance of Postiz, an open-source social platform, using Docker Compose to maintain full environmental control. The team built a Python client using the requests library to interact with Postiz's public API, specifically the /api/public/v1/posts endpoint for creating and retrieving posts. A key technical finding was that the endpoint returns either a single object or a list depending on the operation, requiring type-checking logic in the client code. The setup currently lacks advanced features like rate limiting or granular permissions through the public API, which the team considers an acceptable tradeoff for their needs. Going forward, Apex Grid plans to integrate the self-hosted platform with on-device AI models and improve the Python client with async support and enhanced error handling.

0 comments Read more at DEV Community