Hosting a three-repo security platform on free tiers: the bugs that surfaced

·3 views

A developer built Sentinel, a self-hostable security monitoring platform split into an API, a dashboard, and a Python scanner, and documented the problems that emerged when moving it from local Docker Compose to free hosting services. Storing the refresh token in a SameSite=Strict cookie caused logouts on every reload across different hosted domains, and the developer avoided the tempting SameSite=None fix by routing requests through a same-origin proxy in the dashboard. A sign-in error was then traced to a relative-URL bug in the proxy mode that made every API call throw before being sent. The account also covers how a seed script's upsert design prevented admin password resets, leading to a one-off reset script.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Ionify Explores Virtual Compiler Inputs to Avoid Full Tailwind Rescans

Ionify, an open-source frontend build tool, previously faced a Tailwind performance regression in which changing classes triggered a full rescan, raising build times from about 300ms to 1.3s in one workload. A first optimization cut the overhead by roughly 40 to 50 percent, prompting the developer to ask whether the unnecessary rescan could be eliminated entirely. Ionify's AI coding assistant advised a conservative approach, since changes can affect other inputs through dependencies, so scanning only the modified file is not automatically correct. The developer instead explored building a Virtual Input from the artifacts Tailwind's compiler needs, invalidating it only when correctness-relevant dependencies change. The work remains conceptual, with no guarantee that unrelated dependency changes can always be ignored.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Tesla's Low-Advertising Growth Model Relies on Product Buzz and Brand Advocacy

Tesla has built strong brand awareness and sales with comparatively little traditional advertising, relying instead on its vehicles, launch events, distinctive design, and direct-sales model. The article argues this is not proof that advertising is unnecessary, but shows how product interest, customer advocacy, and earned media can drive demand. Tesla's 2025 annual report states it has historically sold vehicles at relatively low marketing cost while still monitoring its public narrative and investing in customer education and advertising when needed. The piece contends that products generating genuine conversation give customers and media material to spread the message themselves. It adds that this model only works when the product delivers real value, since hype without substance can damage long-term trust.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer details test suite for a high-concurrency Spring Boot e-commerce backend

A developer documented the testing and quality engineering approach used in ShopEase, a Spring Boot 3.x e-commerce backend built on Java 17. The strategy spans unit and slice tests for controllers and services, integration tests for cross-component database flows, and concurrency tests that simulate multi-threaded contention to prevent inventory overselling. Load and stress tests run through a custom Java concurrency harness to measure throughput and failure rates under heavy traffic. The author reports that the suite achieved a 100% build success rate across modules and thread-safe inventory handling.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

JEA endpoints need ongoing governance after role files are written

Just Enough Administration replaces broad administrator access with constrained PowerShell remoting endpoints that map users to approved commands. The article warns that security depends on the endpoint configuration, role files, loaded modules, and the account the endpoint runs under, since a permissive command or writable module path can recreate excessive access. It recommends starting with minimal administrative outcomes, using proxy functions and explicit parameter validation, and avoiding tools like Invoke-Expression. Governance also requires tracking endpoint registrations and file hashes, centralizing protected transcript logs, and testing that unauthorized commands and malformed configurations fail closed.

0 comments Read more at DEV Community