Engineers Find Security Flaws in App a Vietnamese CEO Said AI Built Cheaply

·1 views

A Vietnamese CEO recently claimed that a $20/month Claude subscription had replaced his company's software developers, sparking widespread debate across social media. Curious engineers tracked down the application behind the viral post and began inspecting it using browser DevTools. They quickly uncovered serious security issues, including exposed credentials in frontend code, unprotected admin pages hidden only by CSS, and missing server-side authorization checks. The findings spread rapidly through Vietnamese tech communities, shifting the conversation from AI's code-writing ability to what separates functional software from production-ready systems. Commentators noted the flaws did not prove AI writes bad code, but rather highlighted that software engineering involves far more than generating working code.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

A Valid GitHub Release URL Does Not Confirm Your Files Uploaded Successfully

A developer discovered that GitHub Release URLs can appear fully functional even when asset uploads have silently failed, leaving releases with no actual files inside. This happens because creating a release and uploading assets are separate API calls, meaning the first can succeed while the second fails due to permissions, filename mismatches, or network errors. The author proposes a five-step verification process: confirming expectations, checking the asset list via API, re-downloading through the consumer's path, comparing SHA-256 hashes, and logging each result individually. Relying solely on a working URL as proof of a successful upload is insufficient, since it only confirms the release container exists, not its contents. Hash comparison is highlighted as the only reliable way to verify file integrity, as filenames and visual inspection cannot distinguish between different versions of the same file.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Add Microsoft Clarity to Hugo Sites via Cloudflare Zaraz Without Redeploying

Developers running Hugo static sites on Cloudflare Pages can integrate Microsoft Clarity analytics through Cloudflare Zaraz, avoiding the need to modify templates or trigger a new build. Zaraz acts as a third-party tag management layer, injecting the Clarity tracking script at the network level rather than embedding it in the Hugo repository. Since Clarity may not appear as a native tool in the Zaraz catalog, it must be added manually using the Custom HTML option with the exact tracking code generated from the Clarity project dashboard. A built-in Pageview trigger is used to fire the script on page load, with SPA support left disabled for standard Hugo sites. Users are cautioned to assign the tool to a consent purpose within Zaraz Consent Management, as unassigned tools may run before a visitor has made a consent choice.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

ExecuTorch MLX Delegate Runs Qwen3 Up to 4.52x Faster Than PyTorch MPS on Apple Silicon

A developer tested Apple Silicon inference speeds using ExecuTorch 1.3.1's experimental MLX delegate, released May 18, 2026, with the Qwen3-0.6B language model. Benchmarks showed decode throughput of 41.8 tokens per second with PyTorch MPS BF16, rising to 134.8 with MLX BF16 and 188.9 with MLX INT4. The INT4 quantized model was 4.52 times faster than the PyTorch MPS baseline and produced a file 71.8% smaller than its BF16 equivalent. However, 4-bit quantization altered the generated text output in two out of three test prompts, indicating a trade-off between speed and output fidelity. The MLX delegate, which routes PyTorch computation graphs to Apple's MLX framework for GPU execution, remains experimental and subject to API changes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Completes HackerRank SQL Basic Select Module, Shares Key Takeaways

A developer recently completed the SQL Basic Select module on HackerRank as part of an effort to strengthen their SQL fundamentals. The module covered core concepts such as retrieving data using SELECT statements, forming the foundation of SQL querying. Through the exercise, the learner highlighted practical lessons including reading problems carefully and the importance of attention to detail. The developer plans to next tackle SQL Aggregations while working toward a broader goal of becoming a Java Full Stack Developer. The experience reinforced the view that skill-building is best approached incrementally, with a focus on understanding each concept thoroughly before advancing.

0 comments Read more at DEV Community