How Developers Can Use Internet Scanning Tools to Find Exposed APIs and Services

·1 views

Developers frequently deploy APIs and microservices that can become unintentionally exposed to the public internet due to misconfigurations, overlooked firewall rules, or forgotten test deployments. Internet-wide scanning tools like ScanSearch index network devices and services globally, functioning similarly to a search engine for network assets. Developers can use such tools to verify whether specific ports are publicly accessible, locate forgotten servers, and identify services running vulnerable or default configurations. Targeted queries combining port numbers, IP ranges, or organization names can quickly reveal whether an internal API has an unintended public presence. Understanding an application's external attack surface is considered a critical step in building more secure infrastructure.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How an AI Gateway Can Prevent App Failures from Deprecated Models

A developer's app, ChefExtract, began returning 404 errors during a live demo after an AI model it relied on was deprecated by its provider. The incident highlighted the risk of depending on a single AI API, prompting the developer to explore AI gateways as a more scalable solution. An AI gateway acts as a middleware layer that routes requests to multiple LLM providers, enabling automatic failover, cost control, caching, and unified observability. The developer tested Bifrost, an open-source gateway built by Maxim AI in Go, which supports over 20 providers including OpenAI, Anthropic, and Google Vertex. Bifrost can be set up with a single command and requires only a one-line URL change in existing code, making it a low-friction way to add redundancy to AI-dependent applications.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Step-by-Step Guide to Building JWT Authentication in Node.js From Scratch

A developer tutorial on DEV Community walks beginners through building a complete JWT authentication system in Node.js from the ground up. JWT, or JSON Web Token, allows a server to verify a user's identity without querying a database on every request, using a signed token sent between client and server. The guide covers user registration, login, protected routes, and token verification using packages such as Express, Mongoose, jsonwebtoken, bcryptjs, and dotenv. Passwords are hashed with bcryptjs before storage, and a secret key is used to cryptographically sign tokens, ensuring they cannot be forged. The tutorial emphasizes secure practices, including storing secrets in environment variables and never committing them to version control.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five React Performance Techniques That Deliver Real Production Gains

A technical guide published on DEV Community outlines five practical React performance optimization strategies aimed at addressing common bottlenecks in production applications. The article argues that overusing hooks like React.memo and useCallback without identifying actual problems can worsen performance and clutter codebases. Key recommendations include moving state lower in the component tree to prevent unnecessary re-renders, using children props to isolate rendering in parent components, and virtualizing large lists with libraries like @tanstack/react-virtual. The guide also advises splitting monolithic JavaScript bundles into smaller chunks using dynamic imports and React.lazy, so users only download code relevant to the page they visit. Each technique is presented with working code examples intended to produce measurable improvements rather than premature micro-optimizations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Safely Modify a SquashFS-Based Live Linux System Like SystemRescue

Live Linux distributions such as SystemRescue store their root filesystem inside a read-only SquashFS archive embedded within an ISO9660 image. Modifying such a system requires extracting the ISO, editing the SquashFS rootfs via chroot or overlay, then rebuilding both the SquashFS and the bootable ISO. For SystemRescue specifically, the recommended approach prioritizes YAML configuration, SRM overlay modules, and the official sysrescue-customize script before attempting direct SquashFS reconstruction. On Debian or Ubuntu-based systems, the key dependencies include squashfs-tools, xorriso, and rsync, with QEMU and OVMF useful for post-modification testing. Sufficient disk space — roughly three times the ISO size — is advised, particularly when rebuilding from within a live SystemRescue environment.

0 comments Read more at DEV Community