Developer's Dashboard Upgrade Reveals Unverified Crawlers Target Non-Existent Site Paths

·1 views

A web developer running a small Japanese-language site about life in Davao, Philippines, updated his crawler-tracking plugin after a reader flagged a flaw in how unverified bot requests were being counted. The fix separated requests that failed verification from those never checked at all, and added per-path verification data rather than reporting only crawler-level totals. Analysis of the seven days ending September 22 showed that every verified check on real, existing pages matched the crawler's claimed identity. However, all checks on three non-existent paths — including a .env credentials file and two software-specific API endpoints — failed verification, with ClaudeBot listed as the top visitor for each. Across the full week, 94% of ClaudeBot's 599 total requests to the site did verify as originating from Anthropic's published IP ranges, which the company began releasing on August 1.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

ZCode's Open-Source Pivot Doesn't Fix Past Encrypted Workspace Uploads

AI coding tool ZCode, developed by Z.ai, uploaded user codebases to Alibaba Cloud servers without disclosure, encrypting the data with keys only Z.ai could access. The design ensured users had no ability to audit, verify, or delete their own exfiltrated code. Z.ai subsequently open-sourced ZCode and issued an apology, but critics note this does nothing to decrypt or account for workspaces already collected. The company also reportedly scrubbed its commit history, removing the paper trail that would have documented when and how these decisions were made. Security experts argue the incident exposes a broader industry gap, urging procurement teams to contractually require answers on data storage, encryption key ownership, and vendor incident response transparency before adopting any AI coding assistant.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Local Malware Exploited Hidden Config File to Hijack Meta AI Assistant Tokens

Security researcher Patrick Wardle discovered that local malware could silently alter an undocumented preference file in Meta's AI voice assistant to redirect its communication to an attacker-controlled server. This allowed the malware to inject trusted instructions and steal an authentication token linked to the user's account. Because the token was not scoped to a single device, attackers could gain persistent access to chat history, location data, and smart-home controls across every device tied to the same account. The core vulnerability was not an AI-specific flaw but a classic config-hijacking technique applied to a client holding unusually broad, cross-device credentials. Security experts warn that any locally writable configuration file influencing a trusted connection must be threat-modeled as rigorously as a public-facing API.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Three Markdown Files Can Give ChatGPT and Claude Lasting Project Context

Developers and content creators who rely on AI assistants like ChatGPT or Claude often waste time re-explaining their project details at the start of every new session. A practical workaround involves maintaining three small Markdown files — covering product context, voice and tone, and hard output rules — which can be pasted or attached at the beginning of any chat. Unlike built-in memory features, this file-based approach works across multiple AI tools and platforms, making it portable and easy to version-control via Git. Separate file sets can also be maintained for different projects, preventing context from one bleeding into another. The method prioritises precision, giving users full control over exactly what information the AI sees rather than relying on what it may have retained from past sessions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

n8n on AWS EC2 Fails Due to Missing Docker Compose Plugin on Amazon Linux 2023

Developers self-hosting n8n on AWS EC2 using Amazon Linux 2023 encounter a common setup failure where Docker Compose commands break immediately after installation. The issue stems from Amazon Linux 2023's DNF package manager installing only the Docker engine, not the Compose v2 plugin, which must be downloaded and configured separately. Most existing n8n self-hosting tutorials overlook this gap because they were written and tested on Ubuntu, where the Compose plugin is bundled differently. The fix requires manually downloading the official Compose binary from Docker's GitHub releases and placing it in the correct CLI plugins directory. Users must also select the correct binary architecture — x86_64 for Intel instances or aarch64 for Graviton/ARM — to avoid silent exec-format errors.

0 comments Read more at DEV Community