Developer's paid AI feature was free for anyone while invisible to paying users

·1 views

A developer at APEX Versus, an AI-powered comparison site, discovered two simultaneous bugs in its paid 'Deep Analysis' feature that produced the exact opposite of intended access control. The server-side API had no authentication or credit checks, allowing anyone to access the premium feature for free via direct requests, while a reversed visibility condition in the frontend hid the feature from users who had actually paid for it. The root cause was a silent, empty catch block masking a failed client-side credit deduction that had been quietly rejected by updated Firestore security rules for weeks. The developer fixed the issues by moving all credit checks and deductions server-side within a Firestore transaction, correcting the inverted UI logic, and adding the missing button that had never been wired up. The incident highlights a critical distinction between client-side and server-side validation, especially for revenue-sensitive features.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Web data growth outpaces bots: 402 million terabytes generated daily in 2026

By 2026, humans and machines together generate approximately 402.74 million terabytes of data every 24 hours, equivalent to nearly 3.8 petabytes per second. No existing bot, crawler, or supercomputer has the bandwidth, energy, or storage capacity to process this volume of information in real time. As a result, major tech crawlers from companies like Google and OpenAI now apply priority algorithms, frequently indexing only high-authority sites while independent and niche content can remain invisible for months. This selective crawling means corporate AI systems decide what portion of the internet is deemed relevant, effectively burying non-mainstream content from automated summaries people rely on. The article argues that local, on-demand fetch tools offer a more reliable and secure alternative to depending on overwhelmed third-party crawlers for retrieving and processing web content.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Pipeline Uses Barcodes and LLM Re-ranking to Identify Comic Books for Resale

A developer has built an open-source tool called intent-longbox that helps comic shop staff photograph back issues and generate accurate Shopify product listings. The pipeline decodes UPC barcodes to extract series, issue number, cover variant, and print run data before any AI model is involved, reducing reliance on error-prone vision-only identification. An LLM then re-ranks candidates but cannot alter the deterministic barcode output, and no listing goes live without a human confirming the result. The system is currently in pilot at a shop called Gotham City Limit, with similarity-based image retrieval not yet built, making damaged or pre-1990 barcodes the weakest point in the workflow. To preserve a tamper-proof audit trail, the database enforces append-only rules at the trigger level rather than relying solely on developer discipline.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

What Password Managers Really Track — And What Their Privacy Policies Promise

Password managers store far more than encrypted credentials, collecting behavioral data such as login timestamps, device details, IP addresses, and browser extension usage. Privacy policies across major providers vary significantly in how they handle data retention, third-party sharing, and government compliance requests. Services like 1Password and Bitwarden are noted for minimizing third-party analytics, while LastPass drew criticism for retaining vault metadata even after account deletion. Some policies contain vague language around data sharing with affiliates or law enforcement, which experts say obscures meaningful privacy risks. Users are advised to scrutinize key policy details — including deletion timelines, zero-knowledge architecture claims, and third-party data flows — before choosing a password manager.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds autonomous Claude Code plugin to handle PR reviews and Jira tickets

A software developer has released ultracode-live-engineer, a Claude Code plugin that autonomously reviews pull requests, follows up on PR feedback, and picks up Jira backlog tickets on a scheduled loop without human intervention. Over 163 automated wake-up cycles, the tool completed 32 PR reviews, resolved 4 PR follow-ups, and moved 13 Jira tickets forward. The plugin is designed with a strict escalation rule: when it encounters ambiguous situations, it pauses work and notifies a human via Slack rather than guessing or auto-merging. Performance optimizations — including parallelizing idle checks and batching routine AI calls — cut the median idle-pass time from 190 seconds to 79 seconds, reducing agent calls by 30%. The project addresses a documented industry gap where, per LinearB data, PR pickup on average teams takes 4–16 hours, while DORA's 2025 report notes that rising AI-authored code has increased human review time by 441% industry-wide.

0 comments Read more at DEV Community