GitHub Fine-Grained Tokens Return 404 for Permission Errors, Not Just Missing Resources

·1 views

GitHub's fine-grained personal access tokens return a 404 Not Found response when access is denied, rather than the expected 403 Forbidden, because GitHub deliberately hides the existence of resources an unauthorised token cannot reach. This design prevents tokens from being used to enumerate private repositories, but it also misleads developers into debugging the URL instead of the token's permissions. Common causes include the target repository not being in the token's access list, required permissions being unset, a mismatch between the token's owner account and an organisation's private resources, or the organisation not yet having approved the token. Fine-grained tokens lack the x-oauth-scopes header that classic tokens provided, so the only ways to verify a token's capabilities are to review its settings or test specific endpoints directly. Developers are advised to map each API endpoint to its documented permission, create tokens with the minimum required access, and diagnose failures by permission before inspecting the URL.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

EKS Cluster Storage Cut After Audit Finds 200Gi Nodes Far Exceed Actual Usage

An infrastructure review of an Amazon EKS cluster found that worker nodes provisioned with 200Gi of root storage were consuming significantly less disk space than allocated under observed operating conditions. Engineers examined key storage paths including container images, kubelet data, and system logs to understand real consumption rather than relying on free-space metrics alone. The investigation was part of an ongoing series of capacity optimizations that had previously addressed CPU bottlenecks and oversized resource requests, which reduced the cluster from five worker nodes to four. Unlike earlier findings where capacity needed to be increased, this audit pointed in the opposite direction, suggesting the storage allocation could be safely reduced. The conclusion was not that 200Gi would never be needed, but that the current provisioning exceeded what the workload and operating conditions actually required.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Nginx Cache-Control Headers Can Delay Critical React Hotfixes Reaching Users

When developers deploy a React hotfix, some users may continue seeing the old version due to browser-side caching behavior that silently works against urgent updates. Browsers apply heuristic caching — defined in RFC 7234 — when no explicit Cache-Control headers are set, calculating a time-to-live based on a file's Last-Modified timestamp provided automatically by Nginx. Immediately after a fresh deploy, this TTL is near zero, so everything appears fine, but as days pass the TTL grows, meaning browsers serve stale files without ever contacting the server. The root cause is that browsers only send a conditional revalidation request to Nginx after the TTL expires, so ETags and updated files are never checked while the cache is still considered valid. The fix involves explicitly setting Cache-Control response headers in Nginx configuration, giving developers direct control over how long browsers store static assets.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Hits Physical Limits: GPU Shortages, 151M Token Theft, and a 38GW Power Crisis

The rapid scaling of AI systems is now running into real-world physical and security constraints, as highlighted by three developments this week. OpenAI paused new Pro subscriptions after demand for its high-reasoning GPT-6 Astra architecture overwhelmed available GPU capacity, since advanced reasoning models require far more compute per query than standard models. In a separate incident, attackers used 3,500 compromised accounts to extract over 151 million tokens from Anthropic's Claude, disguising data-harvesting prompts as Japanese translation requests to evade detection and train a cheaper rival model. Meanwhile, Microsoft's reported request for 38 gigawatts of electricity to power future data centers underscored the staggering energy demands of AI infrastructure — a figure that surpasses the total grid capacity of countries like Ireland or New Zealand. Experts now argue that the next competitive edge in AI will depend not just on model quality, but on advances in energy efficiency, inference optimization, and API security.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

React's Standalone startTransition API Enables Concurrent Scheduling Outside Components

React exports a standalone startTransition function that schedules low-priority state updates without requiring component scope or hooks. Unlike useTransition, which must be called inside a React component, the standalone API can be used in third-party stores, synchronous callbacks, and non-component modules. The key trade-off is that startTransition does not return an isPending flag, meaning loading state indicators must still be handled via useTransition inside components. Developers can combine both approaches — using startTransition in store logic and useTransition in components — to achieve concurrent scheduling across the entire application. This prevents rendering jank caused by blocking state updates in code that sits outside the React component tree.

0 comments Read more at DEV Community