GitGuardian Adds S3 Bucket Scanning After IAM Key Breach Took 8 Minutes

·4 views

AWS S3 buckets have become a significant security blind spot, accumulating years of logs, backups, and pipeline output that are rarely scanned for exposed credentials. A 2025 incident documented by Sysdig showed an attacker gaining administrative access to an AWS environment in just eight minutes after finding valid IAM keys in a public S3 bucket. AI tools are accelerating such attacks by automating reconnaissance and decision-making during intrusions. Security firm GitGuardian has responded by extending its secret scanning capabilities to cover AWS S3 buckets, including compressed archive formats, feeding findings into existing security workflows. Industry data suggests that 28% of cloud security incidents now originate outside code repositories, highlighting the need for scanning beyond traditional Git-based pipelines.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Daminion Finds Image Optimization Is a Workflow Issue, Not Just a Format Choice

While rebuilding the Daminion website, the team initially assumed switching to WebP would fix inconsistent image sizes across pages. Testing revealed that compression results varied wildly depending on source type, dimensions, and visual complexity, with reductions ranging from 27% to 95% using the same quality settings. The team concluded that no single format or compression rule works universally, and that the real fix was standardizing the publishing process itself. They adopted a repeatable pipeline — master, crop, resize, optimize, review, and publish — treating AI-generated images the same as designer master files rather than publishing them directly. Format selection, whether WebP, SVG, PNG, AVIF, or JPEG, now depends on the specific asset, workflow, and destination rather than a one-size-fits-all rule.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Judgment-Based Software Advice Matters More Than Coding Rules

Software advice broadly falls into two categories: practical rules like 'write small functions' and judgment-based principles that require interpretation based on context. Practical advice is easy to teach, verify, and enforce through linters and code reviews, making it widely adopted early in developers' careers. Judgment-based advice, such as 'the wrong abstraction is more costly than duplication,' offers no clear checklist and demands experience to apply correctly. The danger of relying solely on practical rules is conflating adherence to good practices with actually becoming a skilled engineer. Deeper software wisdom only becomes truly useful after a developer has lived through both the successes and failures that give abstract principles real meaning.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Notifio adds desktop alerts that batch listings to avoid notification overload

Notifio, a rental search monitoring app, has implemented desktop notifications after the feature was listed but never built. The system fires alerts locally before emails are even sent, eliminating network delays that can cost users a rental opportunity. To prevent notification fatigue, each search cycle triggers at most one banner, grouping multiple new listings with the first three previewed in the body. Clicking the notification opens the listing directly in the user's default browser, preserving their existing login session rather than routing them through the app's internal browser. These design choices — deduplication, batching, and smart handoff — were prioritised to ensure users keep the alerts enabled rather than switching them off.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why DNS for Multi-Tenant Fintechs Needs State Reconciliation, Not API Commands

A technical analysis argues that DNS management for fintech platforms serving multiple tenants should be modeled as a continuous reconciliation loop rather than a series of one-off API write commands. The core principle is that a system must compare its intended DNS record set against a fresh, authoritative observation of current state before declaring convergence, since a successful write does not guarantee the desired state is actually live. Platforms must maintain a strict ownership boundary, reconciling only the records they explicitly manage and leaving customer-controlled records untouched to avoid accidental deletions. Race conditions — such as a stale reconciliation job overwriting a newer DNS update during a tenant migration — are neutralized when workers reload the latest desired state and recompute a fresh plan instead of blindly executing queued commands. The distinction between platform-owned and customer-owned zones also demands different automation risk tolerances, with customer zones requiring verification steps and more cautious, report-before-repair workflows.

0 comments Read more at DEV Community