How one auth server's JWT signing key moved from memory to vault — and what went wrong

·1 views

A software team managing a production authentication server documented how their JWT signing key evolved through three distinct stages: from in-process RSA-2048 memory storage, to a Vault KMS where the key is never exported and only signs on request. The shift to KMS meant a compromised application could no longer yield the private key itself, only the ability to request signatures — a capability that can be rate-limited, audited, and revoked. However, the same commit that introduced KMS signing quietly halved the PBKDF2 password-hashing iteration count from 100,000 to 50,000, a regression that went unnoticed because reviewers focused on the headline security improvement. The incident revealed a blind spot in code review: security-labeled changes can carry hidden regressions in sensitive constants like work factors, key sizes, or algorithm names. The team now treats work-factor values with the same scrutiny as algorithm choices, requiring explicit assertion and verification rather than inherited trust from a commit's stated purpose.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Using AI as a Coding Tool vs. Engineering Partner: A Growing Skills Divide

A discussion gaining traction in the developer community highlights a widening gap between engineers who use AI as a basic autocomplete tool and those who integrate it deeply into their workflows as a collaborative system. The distinction lies in how developers prompt and deploy AI — from simple code generation requests to complex architectural analysis, CI/CD pipeline integration, and context-aware terminal agents. Proponents of the deeper approach argue that skills like selecting the right model for specific tasks, managing token costs, and reducing hallucinations via retrieval-augmented generation now constitute a critical new technical stack. The debate raises broader career concerns about whether heavy AI reliance is eroding fundamental problem-solving abilities or simply represents the next layer of abstraction in software engineering. Developers are being encouraged to reflect on where they draw the line between AI assistance and AI dependency in their daily workflows.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer discovers his own proposed bug fix had already shipped — real flaw lay elsewhere

A developer filed a critical bug report against safari-mcp, his own open-source tool that allows AI agents to control a Safari browser session, after a user's tabs were navigated without consent. He traced the issue to positional tab tracking and proposed switching to a stable identity-based system using a sentinel marker. When he opened the code to implement the fix, he found he had already built and shipped that exact solution three months earlier in version 2.8.3. The real bug turned out to be four lines below the existing fix: a 'ghost index' clamping line that could reassign the agent's active tab index to a live user tab when the tab count changed. The incident highlighted how confident architectural reasoning from memory, without reading the actual code, can produce a plausible but entirely incorrect root cause.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Engineers Must Move Beyond Logs to True Observability in 2026

Modern software observability relies on four signals — metrics, traces, logs, and profiling — each suited to specific questions, yet most engineers still default to logs for nearly every debugging task. Logs are the least structured and most expensive signal at scale, yet they are routinely misused to derive metrics, a practice experts argue should be abandoned entirely by 2026. A proper observability approach correlates all four signals through a shared data model rather than patching them together after the fact. Metrics, being pre-aggregated numeric time series, are faster, cheaper, and more reliable for answering questions about volume and frequency than log-derived approximations. The next era of observability is less about data collection and more about comprehension — instrumenting events correctly at the source instead of working around poor instrumentation downstream.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GoodBarber builds apps with only user-approved SDKs compiled into the binary

No-code app platform GoodBarber has implemented an 'opt-in only' approach to third-party SDKs, ensuring libraries are compiled into an app's binary only when the corresponding feature is explicitly enabled by the app owner. The company calls this model 'on-demand embedded code,' driven by a feature graph that controls conditional compilation flags at build time. This contrasts with the industry norm where analytics, ad, and crash-reporting SDKs are often bundled by default, sometimes without the app maker's knowledge. The practical impact is significant: a kids app build with no third-party SDKs enabled weighs roughly one-third of a fully featured build, according to the company's July 2026 build data. The approach also helps app owners accurately complete Apple and Google's privacy compliance forms, since the binary contains only what has been deliberately activated.

0 comments Read more at DEV Community