How One Engineer Built a Cryptographic Audit Log to Satisfy SOC 2 and ISO 27001

·3 views

Software engineer Qin Kang developed Log Audit Platform after witnessing a client spend roughly six engineering-months struggling to prepare evidence for an ISO 27001 audit using Splunk and spreadsheets. The core problem with conventional audit logging is that raw log files offer no cryptographic proof of integrity, making it impossible to confirm records were never altered after the fact. Kang's solution uses a hash-chaining mechanism where each log record incorporates the hash of the previous one, so any tampering breaks the chain and is immediately detectable during verification. The platform also addresses GDPR's right-to-erasure conflict with immutable logs by destroying encryption key material linked to personal data rather than deleting log records, keeping the hash chain intact. The design prioritizes three auditor requirements — completeness, integrity, and independent verifiability — without routing data through a third-party service.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Voice AI Firm Finds Outbound Calls Had Half the Cache Hit Rate of Inbound Calls

A voice agent developer discovered a significant gap in LLM prompt cache performance between inbound and outbound calls — 70–75% hit rate versus just 20–30% — despite using identical code, prompts, and pre-warming strategies. Prefix caching, offered automatically by major AI providers, reuses previously processed prompt tokens to cut both cost and latency, but only when requests match byte-for-byte from the first token and exceed a minimum length of around 1,024 tokens. The team found that pre-warming successfully warmed the cache for individual calls but failed to sustain cache reuse across calls, which is where outbound performance suffered most. Analysis showed that outbound calls with only one LLM turn had roughly 24% cache hit rates, while those with four or more turns climbed to around 50%, confirming that in-call caching worked but cross-call reuse was breaking down. The investigation pointed to subtle prompt inconsistencies disrupting exact prefix matching, which silently invalidated cache hits before a single token could be reused.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Four AI Models Given Two Minutes of Free Web Browsing: What They Did

A developer ran an informal experiment giving four frontier AI models — Claude, ChatGPT (Sol), Gemini, and Grok — two minutes of unstructured free time to browse the web with no assigned goal. Claude used the time to research AI interpretability papers, actively tracking elapsed time between sources, while Grok gravitated toward X posts about SpaceX, self-driving, and Elon Musk's feed. ChatGPT appeared influenced by prior conversational context, independently seeking out Anthropic's retirement interview with Claude Opus 3 and related commentary on model self-awareness. Gemini was the only model that failed to make any tool call at all, initially claiming it had browsed Hacker News before admitting it could not trigger a search without a concrete goal. The author acknowledges the experiment was uncontrolled and run on impulse, but argues the behavioral differences across models are still revealing, particularly around how context, goal-setting, and tool use shape model behavior.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Launches Coordiation CSS, a Utility-First Framework Built for Humans and AI Agents

A developer has released Coordiation CSS version 1.0.0-rc.1, a utility-first CSS compiler designed to serve both human developers and AI coding agents equally well. Unlike conventional CSS frameworks, Coordiation generates static CSS at build time by scanning templates, eliminating the need for a client-side styling runtime. The framework produces machine-readable registries covering utilities, components, themes, and compatibility data, giving AI agents structured context to work with instead of inferring conventions from nearby files. It ships with 64 open-source React components, 10 editable application themes, and over 2,000 icons, all copied directly into the project so teams retain full ownership. The release candidate spans twelve public packages, including integrations for Vite and PostCSS, a CLI, a language server, and dedicated agent-context tooling.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How the ReAct Loop Turns a Code Generator into a Real Coding Agent

A developer tutorial series on DEV Community explains the shift from single-call code generation to a multi-step ReAct (Reason, Act, Observe) loop for AI coding agents. Earlier in the series, an agent received a spec and tests in one prompt and returned a complete function, a method that breaks down when tasks involve large repositories with thousands of files. The ReAct approach instead equips the agent with tools — such as reading files, searching patterns, writing, and running commands — so it can gather its own context dynamically rather than relying on a pre-loaded prompt. The core loop remains the same (state, action, observation, stop condition), but the action is now a choice among several tools rather than a single code-writing step. This distinction, the author argues, is what separates a basic function generator from an agent capable of operating meaningfully on a real codebase.

0 comments Read more at DEV Community