GSoC 2026: Developer Builds Community Plugin Marketplace for OWASP OWTF

·2 views

A Google Summer of Code 2026 contributor working with the OWASP Foundation built a Community Plugin Marketplace for OWTF, a security testing framework that previously had a static, hard-to-extend plugin catalogue. The original plan to create a runtime sandbox was scrapped after a mentor pointed out that Python-based isolation sharing the same database and filesystem as OWTF would not constitute a real security boundary. Instead, the project shifted to a source-code review queue model, where uploaded plugins await admin approval before being integrated into OWTF's standard plugin pipeline. The contributor delivered six pull requests totalling around 6,000 lines of Python and TypeScript, 153 backend unit tests, a static AST validator that screens dangerous code at upload time, and a trust model document outlining the system's security scope and limitations.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Choosing a TTS API Requires Three Separate Filters, Not One Ranked List

A developer analysis argues that standard 'best TTS API' rankings are misleading because the three key decision factors — price, transport method, and compliance — cannot be meaningfully compared on a single scale. Pricing across providers varies by roughly 40x, ranging from $4 per million characters at Google Cloud and Amazon Polly to over $166 at ElevenLabs, a gap that becomes significant at high usage volumes. Transport architecture differs fundamentally: WebSocket streaming suits live conversational agents, chunked REST offers a middle ground, and batch delivery works for pre-rendered content like e-learning. On the compliance front, Google Cloud and AWS already have published HIPAA BAAs, while providers like Cartesia and Inworld have limited or tiered coverage. The author's core point is that these three dimensions act as independent filters that must each be evaluated separately before a vendor shortlist can be formed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Principles for Designing an AI Reasoning Ledger Record Outlined

A developer writing the 'Building the AI Memory Stack' series has published Part 4.5, focusing on the design of individual records within a Reasoning Ledger for agentic AI systems. The piece argues that agentic systems need a layer that preserves why a decision was made, not just what was decided. Rather than offering a simple schema to copy, the author emphasizes understanding the design tensions that determine what belongs in a ledger record. A key principle is that the ledger must never have the power to block or veto actions — its role is to serve as a neutral witness, not an enforcement mechanism. The article also stresses that superseded decisions should create new linked records rather than overwriting originals, preserving the full historical context of past choices.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Astroid Bug Caused Pylint to Flag Valid Python Code Due to Inconsistent Type Inference

A bug in astroid, the static-analysis engine behind the widely used Python linter pylint, caused identical typing.cast() expressions to be inferred differently based on how the surrounding method call was written. The issue, tracked as astroid #3077, meant that an explicit method call like self.separator.run() triggered a false positive E1101 error, while the functionally equivalent implicit self.separator() call did not. Investigation revealed the two call styles follow entirely different code paths in astroid, with the explicit path correctly resolving to a BoundMethod while the implicit path routed through BaseInstance.infer_call_result(), where an early attribute lookup failure silently terminated the generator before __call__ could be resolved. The root cause was an unhandled InferenceError in a generator function that cut short execution before the correct __call__ resolution logic could run. A fix was submitted via pull request #3242 to the pylint-dev/astroid repository on GitHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds 9-language static fan site for FromSoftware game without middleware

A developer created a multilingual fan site for The Duskbloods, an upcoming FromSoftware game, supporting nine languages including English, Japanese, Korean, and Chinese. The site was built using Next.js 15 App Router and the next-intl v4 library, with all pages statically generated at build time. To avoid extra costs on Cloudflare Workers, the developer skipped middleware entirely, instead using route groups so English content loads at root paths while other languages use locale-prefixed URLs. Official translations were sourced directly from the game's multilingual gameplay guide rather than machine translation, ensuring accuracy across all nine languages. A custom helper function was also implemented to gracefully handle sections where translations are incomplete or missing.

0 comments Read more at DEV Community