HourTotal stores time card data entirely in the URL, requiring no login or backend

·1 views

A developer built HourTotal, a time card calculator that encodes all work-hour data directly into the page URL as a base64url-encoded JSON fragment, eliminating the need for accounts or server storage. The tool supports up to two punch pairs per day across a five-day workweek, along with pay rate and overtime settings, compressing to roughly 390–650 characters of JSON. Because browsers exclude the URL fragment from HTTP requests, sensitive payroll data never reaches servers, CDN logs, or third-party platforms like Slack. After early issues with Safari's replaceState rate limit, the developer added a 500ms debounce so the URL updates shortly after each edit rather than on every keystroke. Sharing a time card is as simple as sending the link, which reopens the identical filled-in calculator for anyone who receives it.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Unprotected MCP Servers Are a Security Risk for AI Agents

Model Context Protocol (MCP) has become a widely adopted standard for connecting AI agents to tools, APIs, and databases, but most MCP servers are deployed without authentication, authorization, rate limiting, or audit logging. Without a gateway layer, any agent that reaches an MCP server's port can invoke every available tool, making it impossible to track who called what or enforce per-tool permissions. Malicious content in an agent's context window can also trigger prompt injection attacks, manipulating the agent into taking unintended actions. Kong AI Gateway 2.0, available through Kong Konnect, addresses these gaps by introducing dedicated entities such as AI MCP Servers, AI Consumers, AI Auth Strategies, and AI Policies. The platform replaces older plugin-based approaches from Kong Gateway 3.x and provides declarative configuration to enforce authentication, tool-level authorization, rate limiting, and full audit trails for every AI agent interaction.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build an Accessible SaaS Pricing Page Using Native Radio Buttons

A best-practice guide for SaaS pricing pages recommends using native HTML radio buttons grouped inside a fieldset element, rather than custom div-based controls. Each pricing plan card acts as a label wrapping its radio input, allowing users to select a plan by clicking anywhere on the card while retaining full keyboard and assistive-technology support. Visual styling such as border changes and background highlights should complement — not replace — the underlying form behavior, ensuring the page works even if CSS or JavaScript fails. Plan cards should clearly display cost, billing period, target user, and key feature differences without hiding critical details in tooltips. Server-side validation of the submitted plan value is also advised, since browser input should always be treated as untrusted data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Security Review Flags Six Critical Upgrade Vulnerabilities in $5.7B SparkLend

A technical security assessment of SparkLend, a decentralized lending protocol with $5.7 billion in total value locked across Ethereum and multiple Layer 2 networks, has identified six critical vulnerabilities in its upgrade architecture. The review, dated September 24, 2026, was conducted by a senior DeFi security researcher examining proxy patterns, storage layouts, and governance pathways rather than the protocol's core lending logic. Among the most severe findings are storage-slot misalignments between Ethereum and L2 implementations that could silently corrupt user balances and collateral ratios during an upgrade. Auditors also flagged a governance bypass flaw in the UpgradeController that allows any address to execute proposals before the 48-hour timelock expires, potentially enabling immediate deployment of malicious code. The protocol received an overall risk score of 7 out of 10, with reviewers noting that while its core economic logic is sound, the upgrade surface poses a significant threat to a large portion of user funds.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Seven Workplace Strategies to Handle a Toxic Manager, Inspired by Schopenhauer

A software engineer writing for DEV Community draws on philosopher Arthur Schopenhauer's ideas about will and reason to outline seven behavioral rules for dealing with toxic managers. The author argues that logic alone fails against manipulative leadership because such managers operate on emotional scripts rather than rational debate. Three common toxic archetypes are identified — the Caregiver, the Victim, and the Inquisitor — each using distinct tactics to exploit or destabilize subordinates. Key strategies include withholding emotional reactions, guarding personal vulnerabilities, and allowing toxic leaders to expose themselves over time rather than confronting them directly. The framework reframes workplace survival not as conflict but as deliberate, low-visibility self-protection.

0 comments Read more at DEV Community