Developer's 72-Hour Hackathon Build Revealed Security Flaws After Submission

·4 views

A developer built and submitted a web application called Charitas Clew during a 72-hour DEV Weekend Challenge, then continued auditing it post-submission. Working alongside two AI systems — Antigravity using Gemini and a custom ChatGPT assistant called Dr. Kahlo — the developer identified several security weaknesses, including a flawed prompt-injection keyword blacklist that was replaced with stronger structural controls. Live testing of the deployed application uncovered a misconfigured proxy trust setting that caused the IP-based rate limiter to malfunction in production, a flaw that automated tests had failed to catch. By the end of the audit, the project had grown to 143 passing tests, yet production still surfaced unexpected behavior. The key takeaway was that automated tests only validate the model of the system you built, not the real-world environment it runs in.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Jellyfin 12.0 Released: Major Update to Open-Source Media Server

Jellyfin, the free and open-source media server project, has officially released version 12.0. The release was announced on the Jellyfin official blog and gained attention on Hacker News. Jellyfin is a community-driven alternative to proprietary media server software such as Plex and Emby. Version 12.0 represents a major milestone in the project's versioning history.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Developer Builds Browser-Based Mini OS for Kids as Tribute to Daughter

A logistics professional transitioning into technology has built Anne OS Kids, a browser-based environment that simulates a small operating system designed for children. The project was created as a tribute to his daughter Anne, with the goal of giving kids a simple, fun, and safe introduction to computers. Built using HTML, CSS, and JavaScript with AI-assisted vibe coding, the project requires no installation and runs entirely within a web browser. It includes features such as a paint tool, text editor, calculator, educational games, and an achievements system. For the creator, the project represents a convergence of his career transition journey, his growing software engineering skills, and a personal dedication to his daughter.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Python tutorial builds a local audio call-review panel without API keys or model downloads

A new tutorial published on DEV Community by Oruk, an audio API provider, shows developers how to build a local call-review webpage using Python 3.10 or later and a standard browser. The page lets users replay individual speaker turns, search transcripts and annotations, and view vocal-expression scores such as emotion and speaking style separately from spoken content. The setup requires no API key or model inference, relying instead on a pre-saved JSON response and a publicly licensed 14.45-second grocery conversation audio sample from The Agentic Data Company's Open Yap 1K dataset under CC BY 4.0. The renderer uses only Python's standard library to generate a self-contained HTML file with a native audio player and plain JavaScript, with no third-party dependencies. Developers can optionally connect the same interface to the Oruk Python SDK to analyse their own recordings up to 30 MB and 60 minutes in length.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Hierarchical Sub-Agents Solve the Monolithic vs. Micro-Skill Dilemma in AI

Developers building AI agent skills often fall into two traps: cramming too much into a single massive skill prompt, or fragmenting logic across dozens of hard-to-maintain micro-skills. A hierarchical delegation approach offers a middle path, where one unified skill orchestrates multiple specialized sub-agents running concurrently. Each sub-agent is matched to an appropriate model tier — lightweight models handle mechanical, pattern-matching tasks, while medium-tier models tackle more nuanced reasoning. Splitting complex sub-tasks into two sequential passes on a smaller model can be nearly three times faster than routing them to a heavier model. The approach requires iterative testing and tuning based on real execution data to determine the right model assignments.

0 comments Read more at DEV Community