Four Key NestJS Checks to Prevent Sensitive Data Leaks in Banking APIs

·1 views

A technical analysis highlights four common ways banking and fintech APIs built with NestJS can inadvertently expose sensitive customer data. The most frequent issue involves returning raw database entity objects directly to clients, which can include fields like password hashes and national ID numbers that were never meant to be shared. A second vulnerability arises when APIs verify that a user is authenticated but fail to confirm whether that user is authorised to access a specific record. Insecure logging practices also pose a significant risk, as debug-level logs can silently capture and store full card numbers or other sensitive details. Developers are advised to use response DTOs with serialisation controls, ownership guards, and careful log sanitisation to close these gaps.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Native PDF Viewer Component in Development for Adalo App Platform

Developers building apps on Adalo, a no-code mobile app platform, have long struggled to display PDFs reliably across iOS, Android, and web. Existing workarounds — including WebView components, external links, and in-app browsers — each carry significant drawbacks such as blank screens, users being redirected outside the app, or inconsistent rendering on mobile devices. Third-party PDF components available in the Adalo Marketplace have also proven unreliable, with maintenance and stability issues reported as of 2025. A new native PDF Viewer component is being developed specifically for the Adalo Marketplace, aiming to use platform-native engines — PDFKit on iOS and PdfRenderer on Android — while also supporting web. The component is designed to enable inline rendering, pinch-to-zoom, full-text search, native share functionality, and compatibility with dynamic database URLs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds minimalist TCP-based internet protocol called weft in pure Python

Software developer Thomas Verhave created weft, a lightweight alternative network protocol built on raw TCP using only Python's standard library with zero external dependencies. The project features its own address scheme, a line-based markup format, a terminal browser, and an application-layer firewall, all contained within a few hundred lines of code. Inspired by a sarcastic remark about rebuilding the internet, Verhave designed weft around four principles: text-first pages, no client-side code, human-readable files, and a network small enough to understand entirely. The protocol deliberately borrows its simple request-response structure from the Gemini protocol, using just four status codes and no JavaScript, eliminating what Verhave sees as the surveillance and bloat of the modern web. Three linked servers demonstrate a working miniature inter-network, and while weft is not intended to scale, it serves as a proof-of-concept for a leaner, more transparent approach to networked communication.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Minimalist Alternative Internet Protocol in Pure Python

A developer has created 'Weft', a lightweight alternative internet protocol built on raw TCP, using only Python's standard library with zero external dependencies. The project features its own address scheme, line-based markup language, a terminal browser, and an application-layer firewall controllable via browser. Three small interconnected servers form the network, and the entire codebase spans just a few hundred lines of code. Weft was designed as a deliberate counterpoint to the modern web, which the creator argues is bloated with JavaScript and pervasive user tracking. The project's core principles include text-first content, no client-side code, human-readable page files, and a network simple enough to fully understand.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Common OpenTofu Errors Explained: Causes and Fixes for Real-World Deployments

OpenTofu, the Linux Foundation's open-source fork of Terraform, shares many of the same runtime errors that developers encounter during infrastructure deployments. Among the most frequent issues are stale state locks from crashed CI jobs, which can be resolved using the force-unlock command with the lock ID shown in the error. Cross-platform hash mismatches in the lock file occur when providers are initialized on one operating system but executed on another, and are fixed by regenerating the lock file to cover all target platforms. Structural errors like invalid for_each arguments arise when map keys depend on resource attributes not yet known at plan time, requiring developers to key maps on static input values instead. Other common problems include uninitialized working directories and unsupported provider arguments caused by version changes, each with straightforward CLI-based remedies.

0 comments Read more at DEV Community