FoxyInvoice Dev Log: How One App Enforces Multi-Tenant Data Isolation

·8 views

Developer blog series FoxyInvoice has published Chapter 4, detailing the security and data isolation architecture of its multi-tenant invoicing platform. The system uses JWT-based authentication with Argon2id password hashing and Google SSO, issuing short-lived access tokens that carry tenant identity on every API call. Data isolation is enforced at the ORM level via EF Core global query filters and a save interceptor that stamps every database row with the caller's tenant ID, making cross-tenant data leaks structurally difficult to introduce. Role-based access control maps to granular permission strings enforced across API routes, UI rendering, and middleware layers, while an audit interceptor logs before-and-after snapshots of all entity changes. Additional safeguards include nightly off-site database backups with size validation, GDPR-compliant data export and deletion workflows, Stripe-delegated card handling to avoid PCI scope, and a secrets gate via gitleaks to prevent credentials from entering the repository.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

GSoC Developer Rebuilds Nominatim's Category Model to Support Multi-Tag Places

Developer Agasta, selected for Google Summer of Code (GSoC), spent the summer overhauling the category model of Nominatim, the geocoder that converts OpenStreetMap place names and addresses into coordinates. The core problem was that Nominatim previously allowed only one class/type pair per place, making it difficult to represent objects with multiple identities, such as a hotel containing a restaurant. The rebuild introduced PostgreSQL's ltree extension to store categories as hierarchical dot-separated paths, enabling filters like 'all descendants of osm.amenity' without requiring explicit prefix storage. Changes spanned the import pipeline, database schema, ranking logic, search indexes, API, and SQLite adaptor, and also uncovered a pre-existing bug in the PostgreSQL array result processor. The updated API now supports advanced filtering with AND/OR semantics, hierarchy matching, and consistent behaviour across all supported backends.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

OWASP Core Rule Set Extended to Block LLM Prompt Injection via WAF

A technical guide published on September 20, 2026, demonstrates how to apply the OWASP Core Rule Set (CRS) to large language model traffic using Solo Enterprise's agentgateway and the Coraza rules engine. Unlike traditional web application firewalls that inspect URLs and headers, this approach buffers and parses the full JSON request body so that prompt content and tool call arguments become addressable fields for rule matching. Custom SecLang signatures can be added alongside CRS to detect and block common LLM attack patterns such as prompt injection, jailbreak framing, and system-prompt exfiltration attempts, all returning HTTP 403 responses. The WAFPolicy resource is decoupled from routing, allowing a single policy to be reused across multiple HTTP routes without modifying the underlying model or MCP server. Live cluster tests on version 2026.8.2 confirmed that normal requests pass while all adversarial prompt payloads were blocked.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Independent Benchmark Finds Jev AI Confident Only When Correct on Agent Risk Tasks

A software developer published a 60-case benchmark on September 19, 2026, testing Jev, an AI model launched by TypeSafe AI on September 15, 2026, on its ability to classify agent tool-call risk into four categories. The benchmark was designed to assess accuracy, latency, and the reliability of Jev's confidence scores — the operationally critical claim from the model's launch. Both jev-latest and jev-preview achieved 91.7% overall accuracy, with perfect scores on clear cases but lower performance on ambiguous ones, run from a residential connection in Portland, OR. The most consistent finding across all runs was that every incorrect answer carried a confidence score below 1.000, meaning the model never expressed full certainty on a wrong answer. The full benchmark harness, tasks, and per-call results are publicly available on GitHub for independent verification and re-running.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Securely Verify Telegram Login Widget Payloads in PHP and Yii2

Integrating the Telegram Login Widget into web applications requires strict backend validation to prevent identity spoofing. Developers must verify the incoming authentication payload using HMAC-SHA-256, derived from a SHA-256 hash of the Telegram bot token. The process involves sorting query parameters alphabetically, building a formatted data string, and comparing the computed signature against the received hash using a timing-attack-resistant function. An expiration check on the auth_date parameter is also enforced to guard against replay attacks. In Yii2, a database migration adds a unique telegram_id column to the user table, allowing validated Telegram identities to be mapped to local user records.

0 comments Read more at DEV Community