How to Add Automated Secret Scanning to GitHub Actions Using Dotguard

·1 views

Developers can integrate the open-source tool Dotguard into GitHub Actions using a single YAML block to automatically scan repositories for exposed secrets on every pull request or push. The tool checks .env files, config files, and source code for leaked credentials, including cloud keys, tokens, and high-entropy strings tied to sensitive variable names. When a secret is detected, the CI build fails and generates a JSON report pinpointing the exact file and line, making remediation straightforward. False positives can be handled through documented exceptions rather than disabling the scanner entirely, preserving the integrity of the security check. The article argues that the cost of running such a scan is negligible compared to the potential six-figure financial and reputational damage caused by a leaked credential.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds MCP-specific observability tool after generic APM tools fell short

A developer created mcpobs, an open-source observability tool designed specifically for the Model Context Protocol (MCP), after finding that standard APM tools only surfaced generic HTTP-level data for MCP tool calls. Existing tracing solutions could not distinguish between actual tool failures, missing tools, argument validation errors, or expected 401 responses that are part of the MCP auth handshake. The tool can be installed via pip and classifies failures into actionable categories, tracks progress on long-running tools in real time, and links downstream database, HTTP, and LLM calls within the same trace. Released under the Apache-2.0 license, mcpobs is self-hostable via Docker Compose and requires no account to run. A hosted version is also available on an invite-only basis at mcpobs.dev for users who prefer not to manage the pipeline themselves.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build Safe, Production-Ready AI Agents in Laravel

A technical guide published on DEV Community outlines best practices for deploying AI agents in Laravel beyond the prototype stage. The article warns that dangerous agents are not those that give wrong answers, but those that confidently take harmful actions, loop uncontrollably, and leave no recoverable audit trail. It argues that Laravel's existing primitives — queues, validation, policies, transactions, and logging — make it well-suited for building reliable agent systems when used correctly. Key recommendations include persisting every agent run as a durable record, moving reasoning to queued jobs, enforcing approval gates for high-risk actions, and treating all model output as untrusted until validated. The guide emphasizes that a production AI agent should be treated as a supervised workflow engine, not a chatbot, with strict tool contracts, budget limits, and shadow-mode evaluation before any prompt changes go live.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Engineer Warns Multi-Cloud Strategy Cost More Than the Risk It Prevented

A software engineer at a tech company reflects on a decision to adopt a multi-cloud infrastructure across two providers, driven by concerns over vendor dependency and contract leverage. Over two years, the strategy proved more costly and operationally complex than anticipated, without the feared provider-wide outage ever occurring. Because maintaining true workload portability required avoiding each platform's best managed services, the team effectively paid cloud prices while rebuilding data-centre-level infrastructure themselves. The human toll was significant — on-call procedures, hiring, and team expertise all suffered as engineers were spread thin across two platforms instead of deeply skilled in one. The author now advocates a more targeted approach: keep data portable, use infrastructure-as-code, and address only the specific risks that genuinely threaten the business.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Visual diff tools aim to fix AI coding agents' blind spot on UI regressions

AI coding agents excel at fixing backend bugs using test failures and error logs, but lack the ability to visually verify UI changes they make, often shipping broken layouts undetected. Unlike code errors, visual regressions such as shifted buttons, reflowed cards, or missing shadows rarely trigger automated test failures, leaving agents to self-report UI changes as correct without any visual confirmation. A proposed solution involves capturing cloud-rendered screenshots on every pull request, diffing them against a baseline, and posting cropped before-and-after comparisons directly in the PR where agents already check for failures. An AI judge pre-labels each visual change as either an intentional restyle or an unintended regression, allowing the agent to review only the relevant pixel-level crops rather than full-page screenshots. Using a set of MCP-connected tools, the agent can then list affected UI stories, inspect diffs, fix regressions, and approve intended changes, completing the visual review loop without manual intervention.

0 comments Read more at DEV Community