Developer security scans show makers quickly fix headers when given exact solutions

·1 views

A developer on DEV Community has spent two weeks running passive security scans on newly launched products and sharing findings publicly, including precise fixes for each vulnerability. A follow-up verification round showed that several makers shipped security header fixes within hours of receiving concrete, actionable guidance. The most widespread issue across scanned launches was a missing Content-Security-Policy header, found in roughly 70% of products, followed by missing HSTS — both considered one-line fixes. One product, Loop, moved from four failures to zero in under 24 hours, while Macless resolved five of six missing headers by routing GitHub Pages traffic through Cloudflare Transform Rules. The author notes that developers on platform subdomains like Streamlit face inherent limitations and recommends moving to a custom domain with edge-level header control for any product handling real users.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Beginner Walks Through Deploying a Web App Live on AWS Using EC2

A developer shared a step-by-step account on DEV Community of deploying a personal app to the internet for the first time using Amazon Web Services. The process involved setting up a safer IAM user account, launching an EC2 virtual server instance, and connecting to it remotely via SSH using a downloaded .pem key file. Once inside the server, the developer updated system software, installed required dependencies such as Node.js and Git, and pulled project code directly from GitHub. Environment variables were configured using a .env file edited through the Vim terminal text editor, which the author noted can confuse beginners due to its non-standard input modes. The post aims to demystify cloud deployment for newcomers by describing each technical step in plain, jargon-free language.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build a Node.js Service That Prints POS Receipts via a REST API

A developer tutorial on DEV Community walks through building a small Node.js service that sends point-of-sale orders to a thermal receipt printer. The setup uses Node 18 or newer, TypeScript, and Express, with no need to install any software directly on the printer. Orders are formatted as HTML and submitted via a POST request to the Receiptful API, which handles the conversion to ESC/POS printer commands. Credentials such as the API key and printer ID are stored as environment variables to keep them out of source code. The guide covers order data modeling, receipt HTML rendering, and wiring the print function to an Express route endpoint.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds open-source tool to keep LLMs out of financial fact-checking

A developer has released OpenThesis, an open-source desktop application designed to separate deterministic financial analysis from AI-assisted reasoning during company research. The tool ingests official filings from US SEC EDGAR, mainland China's CNInfo, and Hong Kong's HKEXnews rather than relying on a language model's memory or general web searches. Extracted financial facts are assigned reference IDs, and AI agents are required to cite those IDs when making factual claims, making unsupported assertions easier to flag. Calculations such as margins and reverse-DCF valuations are handled in regular code, so missing values cannot silently default to zero or distort the analysis. The project, licensed under Apache 2.0, aims to make research failures more visible and traceable rather than eliminating them entirely.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds AWS-powered dog detector app scoring 20/20 in weekend challenge

A developer built a webcam-based image classifier called 'Dog or Not: Lite' for the AWS Weekend Challenge, using Amazon Nova Lite via the Bedrock Converse API and deploying it on Amazon Lightsail in us-east-1. The app, built on FastAPI with Python 3.13, achieved a perfect 20/20 score on its test set with a median response time of 880 milliseconds per scan. The entire backend runs in just 285 lines of code with no build step or frontend framework, using a single HTML page and one API endpoint. The developer documented several AWS-specific pitfalls, including Lightsail's lack of IAM task roles requiring credentials via environment variables, cross-region inference profile authorization issues, and silent architecture mismatches when deploying non-amd64 container images. The app's classification logic is deliberately strict, recognising only living domestic dogs as true positives and excluding wolves, toys, statues, and costumes.

0 comments Read more at DEV Community