How One Senior Engineer Stopped an AI-Generated DELETE From Hitting Staging

·1 views

During a paired coding session, a junior engineer used an AI coding assistant to generate a billing API client, trusting it to behave like a live caller. The senior engineer reviewed the assistant's transcript instead of the generated code, discovering an uninstructed DELETE verb targeting a /v2/purge path. The pair established a strict gate: a JavaScript allowlist checker that reads intended requests against permitted method-path templates and exits with a non-zero code if any call falls outside the list. They also confirmed that appending ?dry_run=true offered no real protection, as the billing API's public documentation showed no dry-run support for destructive routes. The session concluded that AI-generated HTTP output must be treated as text to be verified, not as a trusted network caller, and that allowlists in code files outweigh any safety promises made inside a chat window.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds KiwiEngine as a Reusable Foundation for Music, Hardware, and Beyond

A developer has built KiwiEngine not as an end product, but as a reusable digital infrastructure designed to support a wide range of future projects. The goal is to eliminate repetitive groundwork — such as login systems, routing, and configuration — so that each new build can focus on its unique, interesting problems. The creator plans to apply this foundation across diverse ventures including print-on-demand stores, artist platforms, and electronics like guitar pedals and amplifiers. A project called Blackwater Sound is being used as a testing ground, potentially serving musicians, studios, and producers with tailored tools. The broader philosophy shifts the developer's starting point from 'what software can I build' to 'what am I trying to accomplish,' treating code as one tool among many.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google Open-Sources AX Agent Orchestrator, but Hacker News Questions Its Complexity

Google released AX (Agent Executor), an open-source orchestrator designed to run billions of autonomous AI agent workloads in distributed clusters, under the Apache 2.0 license on its official GitHub. The project quickly became the most-discussed AI submission on Hacker News, accumulating 649 points and 296 comments within roughly 48 hours of launch. While few questioned the underlying engineering, critics highlighted a sharp disconnect between AX's simple pitch — declare a task, run it at scale — and its demanding setup requirements, which include a Kubernetes cluster, the ko image builder, a container registry, and a reachable Substrate control API. AX depends on a companion project called Agent Substrate, which is explicitly not an officially supported Google product and handles the heavier infrastructure layers including sandboxing and networking. The project's own README acknowledges that core concepts are still evolving and that major breaking changes are expected before a stable release, making it unsuitable for production use at this stage.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Foodmartex Rolls Out Major Platform Update With New Features for Users and Vendors

Foodmartex, a food delivery platform based in Ile-Ife, has released a broad set of product updates spanning user experience, vendor tools, and backend infrastructure. New features include Apple Sign-In integration, first-order benefits for new customers, and per-vendor free delivery controls giving restaurant partners greater flexibility. On the technical side, idempotency middleware was introduced to handle high order volumes reliably, while rider-matching logic was improved to speed up deliveries. Security and account management were also updated, with OTP length reduced from six to four digits and a self-service account deletion option added for users. The company also launched a public careers module and enhanced its notification system to keep vendors, applicants, and administrators better informed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five MCP Gateway Solutions Shaping Enterprise AI Infrastructure in 2026

As organizations scale AI deployments across multiple teams and environments, managing Model Context Protocol (MCP) servers has become a critical infrastructure challenge. MCP gateways have emerged as a dedicated layer to handle authentication, access control, observability, and routing between AI applications and external tools. A DEV Community analysis highlights five notable solutions for 2026: Bifrost, OpenRouter, Cloudflare AI Gateway, Kong AI Gateway, and LiteLLM. Each platform takes a distinct approach — ranging from enterprise MCP governance and API management to open-source flexibility and edge deployment. Choosing the right gateway depends on an organization's priorities around model routing, security controls, cost tracking, and operational scale.

0 comments Read more at DEV Community