Founder discovers critical data-exposure flaw two days after MVP launch

·1 views

A software founder discovered a Broken Object Level Authorization (BOLA) vulnerability in their project management tool, SyncBoard, just two days after launch, when a beta user reported being able to view other users' projects by changing the ID number in the URL. The flaw existed across six API routes and stemmed from code that verified a user was logged in but never checked whether the requested resource actually belonged to that user. The fix required adding a single ownership check to each affected database query, and was fully deployed within 40 minutes of the founder reading the report. All 40 existing users were notified the same evening, with a transparent explanation of what data had been exposed and what steps were taken. Three users left, but the majority stayed, including the developer who uncovered the bug — highlighting that prompt, honest disclosure can help preserve user trust after a security incident.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How TCP Packet Fragmentation Silently Broke a Live AI Career App on Cloud Run

A developer discovered that CareerPilot AI, a six-stage agentic career analysis tool, was crashing in production on Google Cloud Run despite working perfectly in local development. The app used Server-Sent Events to stream real-time reasoning steps to users, culminating in a large 15KB JSON payload as the final output. An initial attempt to fix apparent buffering issues by force-flushing every SSE chunk after each write made the problem significantly worse. Aggressive flushing caused the final JSON payload to be split across arbitrary TCP packet boundaries mid-byte, and the client-side parser — which assumed each incoming chunk was a complete JSON object — threw a SyntaxError on the truncated data. The root cause was a mismatch between SSE chunk delivery assumptions and how Google's Front End proxy handled fragmented TCP packets under real network conditions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds iOS Keyboard From Scratch in C++ to Fix Third-Party App Graveyard

A developer named Diction has built a third-party iOS keyboard entirely from scratch in C++, frustrated by the poor quality of existing App Store alternatives. The app began as a voice-first keyboard but expanded into a full QWERTY project after users needed a reliable fallback for typing. Unlike most third-party keyboards, it avoids off-the-shelf autocorrect libraries and instead features a custom-built correction engine, learning layer, and suggestion pipeline. The developer cites five common failure points in existing keyboards — speed, predictability, crash recovery, autocorrect quality, and personalised learning — as the core problems the project aims to solve. After ten major releases and thousands of engineering hours, the keyboard is still under active development.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Choosing a Test Automation Tool That Holds Up Beyond the Demo

Most test automation tools perform well in initial demos, but their true value only becomes clear as a test suite scales from a handful of tests to hundreds over months of real-world use. Key long-term challenges include maintaining tests after redesigns, debugging failures in CI environments, and ensuring that workflows involving emails, APIs, and multiple browsers remain reliable. Experts suggest evaluating tools against practical maintenance scenarios—such as updating a login flow or renaming a UI element—rather than focusing solely on ease of setup or AI-generation speed. Debuggability is another critical factor, with detailed logs, video replays, and network data proving far more valuable than simple pass/fail screenshots. Ultimately, the most effective automation tool is one the entire team can understand, update, and trust long after the original engineer has moved on.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Is Eliminating Rote Marketing Work, Not Creative Judgment

Artificial intelligence is rapidly automating repetitive marketing tasks such as resizing assets, generating copy variations, and producing reports, threatening roles built around volume over value. Industry leaders including Reddit's CMO and Digitas' CEO have noted that AI's primary contribution is freeing up time for human judgment and creativity, not replacing those qualities. With production bottlenecks largely removed, the quality of an idea is now immediately exposed rather than obscured by lengthy workflows and resource constraints. Small teams in emerging markets can now match the output that once required large departments, fundamentally shifting what marketers are paid to deliver. The skill that remains irreplaceable, according to the article, is taste — the cultivated ability to distinguish ideas that resonate from those that merely exist.

0 comments Read more at DEV Community