How a 60-line Doctrine type adds column-level encryption to a Symfony app

·1 views

A developer building InvoicePilot, a Shopify invoicing app, found the application stored customer names, addresses and emails in plain text in a PostgreSQL database on an unencrypted VPS. To honestly answer a compliance audit question about data-at-rest encryption, they implemented application-level column encryption using PHP's built-in libsodium library in roughly 60 lines of code via a custom Doctrine type. The approach targets realistic, lower-cost threats such as leaked database dumps, misconfigured backup storage, and contractor access to restored snapshots, rather than full host compromises. However, the author notes that once a database column becomes an encrypted blob, four previously reliable features — including some that fail silently — stop working as expected. The post also warns that the entire approach is undermined if the encryption key is stored alongside the data it protects.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Cut LLM API Costs in SaaS Using Prompt Routing and Batch Processing

A software engineer outlines a cost-reduction strategy for SaaS platforms that rely on large language model APIs, focusing on three core techniques: prompt routing, fallbacks, and batch processing. The approach involves classifying incoming requests by type and routing simpler, testable prompts to a smaller, cheaper model first, only escalating to a larger model when a local quality check fails. Engineers are advised to define clear output contracts and acceptance rules for each request class before choosing a routing strategy, rather than relying solely on model confidence scores. The article also presents a build-versus-buy comparison covering managed single-model setups, managed small-to-large routing, and self-hosted inference, helping teams choose based on traffic volume and operational capacity. The author cautions that adding a router introduces a second production system with its own policy, telemetry, and rollback requirements, and recommends collecting measurements before committing to a multi-model architecture.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MCP 2026-07-28 Spec Drops Sessions, Makes Servers Stateless HTTP Services

The Model Context Protocol released its most significant update on July 28, 2026, eliminating the session handshake and the Mcp-Session-Id header so every request is now fully self-describing. The change means MCP servers can run as plain stateless HTTP services, enabling standard round-robin load balancing, autoscaling, and caching without sticky sessions. A new mechanism called MRTR allows tools to request user input mid-call by returning a closed response with an 'input_required' status, then resuming when the client retries with answers attached. Tool and resource list responses now support caching via ttlMs and cacheScope fields, reducing redundant fetches from clients. Three features — Roots, Sampling, and Logging — are deprecated alongside the legacy HTTP+SSE transport, with at least 12 months of continued support before removal.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

TabPFN Brings Zero-Shot ML Predictions to Tabular Data Without Tuning

Prior Labs has developed TabPFN (Prior-Data Fitted Networks), a pre-trained Transformer model that makes instant predictions on tabular datasets without requiring traditional model training or hyperparameter tuning. The tool uses zero-shot learning, completing predictions in a single forward pass while natively handling missing values and categorical features. TabPFN integrates with the widely used Scikit-Learn API, allowing data scientists to plug it into existing workflows with minimal setup. It performs competitively against tuned models like XGBoost on small to medium datasets, though it is less suited for datasets exceeding 100,000 rows or time-series data with temporal dependencies. Both CPU and GPU execution are supported, and the model handles binary as well as multi-class classification tasks out of the box.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Python Asyncio Explained: Concurrency Without Threads Using Async and Await

Python's built-in asyncio library enables asynchronous programming, allowing applications to handle multiple tasks—such as network requests or file operations—without blocking execution. Instead of waiting idly for one operation to finish before starting another, asyncio uses an event loop to switch between tasks whenever they are paused at an await point. Core concepts include coroutines, defined with async def, and tools like asyncio.gather() that run multiple coroutines concurrently within a single thread. This approach is particularly effective for I/O-bound workloads, such as web scraping or API calls, where programs spend most of their time waiting rather than computing. The result is significantly better performance compared to traditional synchronous code, without the complexity of managing multiple threads.

0 comments Read more at DEV Community