EU Cyber Resilience Act Mandatory Vulnerability Reporting Begins September 11

·6 views

The European Union's Cyber Resilience Act (CRA) activates its mandatory incident reporting requirements on September 11, 2026, affecting software makers and device manufacturers selling products in the EU. Under the new rules, companies must issue an early warning within 24 hours of discovering an actively exploited vulnerability, followed by a formal notification within 72 hours and a final report within 14 days. Reports must be submitted to the relevant national CSIRT and to ENISA through a Single Reporting Platform, with the clock starting the moment a team becomes aware of an issue. The regulation targets any manufacturer placing a product with digital elements on the EU market, including apps, firmware, and connected devices, though pure SaaS services generally fall under the separate NIS2 directive. Full CRA compliance, including CE marking, is not required until December 2027, but the reporting obligations take effect immediately this Friday.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Free JetBrains plugin HotRulez hits 1,000 downloads two months after launch

HotRulez, a free open-source plugin for Firebase Security Rules, has surpassed 1,000 downloads on the JetBrains Marketplace roughly two months after its initial release. The plugin was built by a developer who wanted proper Firebase Security Rules tooling in their IDE but could not find a free alternative. HotRulez supports JetBrains IDEs including Android Studio and IntelliJ IDEA, offering features such as syntax highlighting, formatting, structural diagnostics, and symbol navigation. The developer noted that downloads continued to grow even after the initial launch spike, suggesting the tool addresses a genuine gap shared by other developers. The plugin is released under the MIT license and remains open to community feedback and contributions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer releases HTMLPlus Element v4, a compiler that automates web component boilerplate

A developer has publicly unveiled HTMLPlus Element v4 after several years of intermittent work and over 500 commits, describing it as a compiler that eliminates repetitive boilerplate when writing native web custom elements. The tool uses TypeScript decorators to automatically derive tag names from class names, resolve property types, pick up co-located CSS files, and generate TypeScript definitions at build time. Output components work across major frameworks — including React, Vue, Angular, Svelte, and Solid — without wrapper packages, by emitting events under each framework's expected naming convention. The runtime weighs approximately 8 KB gzipped per element and under 11 KB for the full library, and the project is already used to power the htmlplus.io UI kit. Currently available as a Vite and Rollup plugin via unplugin, the project is MIT-licensed and open to public feedback on its API design.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

TruffleHog, Gitleaks, GitHub Secret Scanning: How the Top CI Tools Compare in 2026

Hardcoded credentials remain a critical security risk, with exposed API keys and tokens often detected by malicious bots within minutes of being pushed to a repository. Engineering teams commonly integrate secret scanning tools into CI/CD pipelines, but widespread use has revealed a significant alert fatigue problem caused by false positives from test fixtures and expired tokens. A 2026 comparison of three leading tools — Gitleaks, TruffleHog, and GitHub Secret Scanning — highlights distinct trade-offs across regex detection, entropy analysis, and live API verification methods. Gitleaks is praised for speed and custom rule support but lacks live key validation, while TruffleHog offers over 750 detectors with active verification at the cost of slower CI performance. GitHub Secret Scanning is seamlessly integrated for public repos but requires a paid enterprise license for private repository coverage.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Tool Automates Weekly PostgreSQL Restore Testing via GitHub Actions

A tool called Revenant has been built to automate database restore validation, addressing the common problem of teams skipping or delaying restore drills. It uses a simple YAML configuration file and a GitHub Action to run weekly checks verifying that a PostgreSQL database can actually be recovered. The checks cover connection health, schema integrity, row counts, foreign key relationships, and data freshness. For AWS RDS users, Revenant can also restore an actual snapshot into a temporary sandbox, validate it, record recovery time, and automatically tear it down. The goal is to surface restore failures with specific, actionable error details before they become a crisis.

0 comments Read more at DEV Community