Fix Your FAQs Before Buying a Support Bot, Analysts Urge

·1 views

A recurring pattern observed across multiple businesses shows that a small number of repeated customer questions drive the majority of support ticket volume, often pointing to a single upstream communication failure. A direct-to-consumer brand, for example, saw its WhatsApp support queue dominated by 'where is my order' queries from customers who received tracking links showing only 'in transit' with no delivery date. Adding an expected delivery window and the courier's name to dispatch messages eliminated the question entirely, without any automation. The recommended approach involves manually tagging 30–60 days of support conversations by the customer's underlying need — not broad topic categories — to identify which specific information gaps are causing repeat contacts. The core argument is that support tickets function as receipts for communication failures, and resolving the root cause is more cost-effective than deploying faster tools to answer the same unanswered question repeatedly.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

JWT 'kid' Parameter Flaw Enables SQL Injection and Path Traversal Attacks

A security vulnerability in how servers process the JSON Web Token 'kid' header parameter allows attackers to manipulate key selection without breaking cryptography. Because the RFC defines no required format or character restrictions for 'kid', most libraries pass the raw value directly to database queries or file reads without sanitization. In the SQL injection variant, an attacker injects a UNION payload to make the server use an attacker-chosen HMAC key, then re-signs a forged token that passes verification. In the path traversal variant, injecting a sequence like '../../../../dev/null' causes the server to read an empty file, letting the attacker sign tokens with a predictable null-byte key. The vulnerability is rated CVSS 7.5 High, requires no prior authentication, and fully compromises authentication integrity.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Four Major WebSocket Frameworks Leave Origin Validation Off by Default, Enabling CSWSH

Cross-Site WebSocket Hijacking (CSWSH) exploits a gap in the Same-Origin Policy, allowing attackers to establish a persistent, bidirectional, authenticated channel by tricking a logged-in user's browser into initiating a WebSocket connection to a malicious page. Unlike standard HTTP requests, the WebSocket upgrade bypasses CORS preflight entirely, sending session cookies cross-origin without restriction — a deliberate protocol design dating back to RFC 6455. Four of the five dominant WebSocket frameworks ship with Origin validation disabled by default, leaving applications exposed unless developers explicitly enable the check. Real-world consequences have been severe: CVE-2020-25095 enabled unauthentiated remote code execution on LogRhythm, CVE-2023-0957 led to full Gitpod account takeover, and CVE-2024-51775 exposed Apache Zeppelin data to unauthenticated remote attackers. Security researchers trace the recurring vulnerability to an engineering culture where WebSocket endpoints are added to cookie-authenticated apps without applying the same CSRF-era protections already in place for HTTP routes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds Rust-based version bump tool claiming 10,000x speed over Python

A developer rebuilt the popular bump-my-version CLI tool in Rust after finding the Python original took a full second to increment a single version number. The new tool, called bump2version 0.2.0, automates updating version strings across multiple files such as Cargo.toml, package.json, and CHANGELOG.md in a single operation. It uses pure-Rust git integration via the gix library, avoiding subprocess calls entirely, and enforces memory safety with no unsafe code. Beyond a standalone CLI, the project exposes bindings for Python and Node.js, making the same Rust core accessible across three ecosystems. The developer acknowledged receiving outside assistance with parts of the system design during the project.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Passwordless Auth Exposes Tokens in Logs, Headers, and Email Forwarding Chains

Security researchers have highlighted how passwordless authentication methods such as magic links and TOTP, despite being designed to reduce phishing risk, introduce multiple new attack surfaces. Magic link tokens embedded in GET request URLs are routinely captured in server access logs from nginx, Apache, and CDN proxies, where they remain readable until log rotation. A critical vulnerability, CVE-2026-39912 (CVSS 9.1), exposed over 7,000 instances of V2Board by returning auth tokens directly in HTTP response bodies without requiring authentication. Browser Referer headers can leak tokens to third-party analytics platforms, while email security gateways may silently consume single-use tokens during URL prefetching scans. Additionally, attackers who briefly gain inbox access can plant silent forwarding rules that continue delivering future magic link tokens even after a password reset, leaving no failed login alerts for the application to detect.

0 comments Read more at DEV Community