How to Handle Browser File Uploads Without Exposing Your API Key

·2 views

Storing API keys in the browser is a security risk, as client-side code can be inspected and credentials copied by anyone. A safer approach involves the server generating a short-lived, scoped upload link using the API key, then passing only that link to the browser. The browser never sees the actual API key; it simply redirects the user to a hosted upload page via the temporary URL. Developers can enforce restrictions on the link, such as allowed file types, size limits, file count, and expiry duration. This pattern is suited for workflows like support forms, job applications, and document collection where users need to submit files securely.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Stack Overflow's Slow Decline Predates the AI Era, One Engineer's Data Shows

A software engineer who built his debugging skills by answering questions on Stack Overflow between 2018 and 2024 has shared data showing his own activity collapsed well before AI tools like ChatGPT arrived. His annual answer count dropped from 150 in 2018 to just 3 by 2022, while the platform itself was still receiving over a million questions per year. The engineer argues the site's real turning point came around 2014, when Stack Overflow began aggressively closing questions for quality violations, discouraging new users from engaging. A 2022 study found roughly half of new-user posts received a closure, no answer, or an unexplained downvote, effectively stripping the platform of the human interaction that once made it valuable. By systematically eliminating conversation and context, the site inadvertently created the ideal conditions for an AI tool to replace it entirely.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

One Git Repo Can Replace Jira, Confluence, and TestRail for Traceability

A software development pattern proposes storing tickets, wiki pages, test cases, and test runs as YAML files within a single Git repository, eliminating the need for multiple SaaS tools. The approach uses consistent file-based IDs — such as AUTH-102.yaml for tickets and W-XXXXXX.yaml for wiki pages — so that linking between artifacts means opening a local file rather than calling external APIs. Inline wiki-style references like [[AUTH-102]] or [[wiki:W-ABC123]] can be embedded in any Markdown body, with unresolved links visually flagged before changes are synced. Because all data lives on disk, search, related-item lookups, and navigation work offline and behave like switching files in an IDE. The trade-off is that it forgoes automatic bi-directional sync with tools like Jira, but gains a reviewable, grep-able graph that requires no account or login to browse.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Model Security Training Must Address Checkpoint Deserialization Risks

Most AI security training focuses on prompt injection and jailbreaks but overlooks a more fundamental threat: malicious code hidden inside model checkpoint files. PyTorch's .pt and .bin files contain Python pickle archives that execute arbitrary code when loaded, a vulnerability class known as CWE-502 deserialization of untrusted data. CVE-2025-24357 demonstrated this risk in vLLM, where checkpoints downloaded from a model hub were loaded without the weights_only=True safeguard, enabling remote code execution on the inference host. A parallel flaw, CVE-2024-11393, affected Hugging Face Transformers with a CVSS score of 8.8, reached through MaskFormer model file parsing. Security teams are advised to inspect checkpoint files using tools like pickletools and fickling, adopt safer formats such as safetensors, and mirror approved models into internal registries pinned by digest rather than pulling directly from public hubs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

A Practical Guide to AI Red Teaming Tools and Frameworks in 2026

AI red teaming requires distinguishing between governance frameworks and hands-on testing tools, which are often incorrectly treated as interchangeable. MITRE ATLAS and OWASP Top 10 for LLM Applications serve as complementary taxonomies for classifying adversarial techniques, covering threats like prompt injection, jailbreaks, and data leakage. On the tooling side, garak functions as an automated scanner for initial assessments, PyRIT handles stateful multi-turn attack orchestration, and promptfoo integrates security assertions directly into CI pipelines. For traditional classifier models, the Adversarial Robustness Toolbox remains the appropriate choice, implementing evasion and poisoning attacks against major ML frameworks. A critical but often overlooked practice is pinning tool versions and archiving raw scan outputs, since changes in probe sets between releases can otherwise make results across scans incomparable.

0 comments Read more at DEV Community