Developer's SQL scanner missed 4 of 5 real CVEs, then a fix made things worse

·1 views

A developer tested 'inlet', their open-source static SQL-injection scanner for Python codebases, against 15 real PyPI packages — five of which had documented, verified SQL-injection CVEs. The scanner failed to detect four of the five vulnerabilities because the vulnerable code routed through framework-level abstractions rather than the direct method names inlet was designed to recognize. A smaller bug was also uncovered: inlet misclassified safe calls in the Peewee ORM due to a method-name collision with standard database cursor calls. The developer built and shipped a fix that successfully reduced false positives in Peewee, but a follow-up check revealed the same rule silently dropped 94 genuine database call sites across other packages. Rather than ship a fix that improved one metric while degrading overall accuracy, the developer reverted the change and documented the 0-for-5 miss rate transparently in the project's evaluation file.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

CauterRule v0.3.0 Exposes Flaw in AI Rule Validation: Text Matching Masks True Accuracy

CauterRule, an open-source tool that converts repeated AI agent failures into reusable standing rules, released version 0.3.0 with findings from a field test covering 40 corpora and 4,768 trajectory runs across two cloud models. Developers discovered that the tool's replay gate, which decides whether an extracted rule gets promoted, relies on lexical text similarity rather than verifying whether a rule would actually change an agent's outcome. In one documented case, a correctly extracted git rule was demoted to 'inconclusive' because unrelated successful trajectories happened to share the token 'git' with the rule's trigger phrase. The team also found that extraction accuracy, measured by token-F1 against ground-truth rules, scored only around 0.50–0.58, not due to wrong outputs but because the model rephrases correct answers that a token comparator penalises. The release reframes the problem as two distinct challenges — rule extraction quality and replay verification validity — pointing to separate fixes needed for each.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Enterprise AI Fails When Deployed on Broken Business Processes

Many enterprise AI projects begin by selecting a model rather than first examining the business process the technology is meant to improve. Poorly defined workflows — marked by unclear responsibilities, inconsistent data, and unwritten business rules — do not get fixed by AI; they get amplified. A human operator working with bad data may produce isolated errors, but an automated AI system can replicate those same errors across thousands of records at scale. The article argues that teams often spend weeks refining prompts while the root problem, flawed process design, remains unaddressed. Before choosing any AI model, organizations should clearly define process boundaries, data ownership, and measurable success criteria.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How One Developer Ran Proxmox and Docker on the Same Windows Machine

A developer discovered that Windows Hypervisor Platform and nested Proxmox virtualisation are mutually exclusive, forcing Docker Desktop to fail whenever Proxmox was active. After AI tools only suggested choosing one option, the developer devised their own fix: offloading the Docker daemon entirely to a dedicated Ubuntu VM running inside VMware. The Windows Docker CLI was then configured to communicate with that remote VM via SSH context, bypassing the hypervisor conflict altogether. The setup uses Docker Engine 29.8.0 on an Ubuntu 24.04 VM with 4 vCPUs and 8 GB RAM, while Docker Desktop on Windows is retained solely for its CLI. A noted side effect is that disabling the Windows hypervisor also silently breaks WSL2, despite status commands appearing normal.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Droid ASC Android Reverse Engineering Tool Claims 269x Speed Gain Over jadx

Droid ASC is an open-source Android reverse engineering tool introduced at Black Hat Europe 2026 Arsenal, designed to address the slow decompilation and high memory demands of traditional tools like jadx. The tool uses a zero-index architecture and on-demand Deflate stream decompression to query APKs as live databases rather than exhaustively indexing them. Benchmark tests across four commercial APKs showed search speeds up to 269 times faster and memory consumption up to 125 times lower than jadx, with no disk caching required. In one test, jadx crashed with an out-of-memory error at 49% completion on a 352 MB APK, while Droid ASC returned results in under two seconds. The tool is aimed at penetration testers, red teams, and bug bounty researchers, and is recommended strictly for use in authorised testing environments.

0 comments Read more at DEV Community