How to securely serve private user avatars in a Node.js SaaS with presigned URLs

·1 views

Developers building Node.js SaaS applications should store user avatars in a private object storage bucket and generate short-lived presigned URLs at display time rather than persisting any URL in the database. Each avatar should be saved under a key containing a random component to avoid race conditions from concurrent uploads and to simplify cache invalidation. The database should store only the object key, since keys remain stable while signed URLs expire, preventing stale-URL issues. Signing calls can be cached in Redis for a duration slightly shorter than the signature's own lifetime to reduce per-render overhead. Popular S3-compatible options including AWS S3, Cloudflare R2, Backblaze B2, and Supabase Storage all support presigned downloads, so the practical differentiators are egress costs, existing integrations, and operational limits discovered only after shipping.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

EYG: New Programming Language Designed With Human Usability in Mind

A developer has introduced EYG, a programming language built with a focus on human-centered design. The project was shared on June 8, 2026, via a personal blog post by its creator. EYG aims to address common pain points programmers face with existing languages by prioritizing usability and accessibility. The announcement was posted to Hacker News, where it attracted early community attention. Details about the language's syntax and features are available on the author's website.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Why Enterprise AI Agents Need Runtime Policy Gates, Not Just Prompt Rules

Relying on system prompt instructions to restrict AI agent behavior is insufficient, as probabilistic language models can bypass such guidance under adversarial or complex reasoning conditions. Security experts recommend moving policy enforcement out of the prompt window and into deterministic runtime execution gateways to address the OWASP LLM08 excessive agency risk. A four-tier action classification framework categorizes agent tasks by risk and reversibility, ranging from autonomous read-only queries to high-risk irreversible operations like database deletions or wire transfers that require mandatory human approval. Technical controls such as JSON Schema validation on tool parameters and sidecar policy engines like Open Policy Agent ensure decisions are evaluated independently of the model's internal reasoning. For critical actions, state-preserving circuit breakers pause agent execution and route a dry-run preview to a human approval queue before any irreversible operation proceeds.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Low-Cost RL Fine-Tuning of 9B Model Reportedly Rivals Frontier AI on Catalog Tasks

A report claims that a small open-source 9-billion-parameter language model, fine-tuned using reinforcement learning at a cost of approximately $500, outperformed larger frontier models on a catalog review task. The findings were published on the Fermisense blog. The claim highlights growing interest in cost-efficient fine-tuning techniques as alternatives to expensive large-scale model training. However, the limited engagement on Hacker News — just 3 points and no comments — suggests the results have not yet received broad peer scrutiny. Full methodology and benchmark details would need to be reviewed to assess the validity of the comparison.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Developer Seeks Best OCR Tool to Grade Handwritten Gaokao Math Answers

A developer building an English-language Gaokao math exam platform is searching for a reliable OCR solution to automatically grade handwritten student responses. The challenge is complex because answers often span half a page and include fractions, square roots, crossed-out formulas, and geometry diagrams written under time pressure. Tools under consideration include Mathpix, MyScript iink, Google Cloud Vision, Azure Document Intelligence, and the open-source model TrOCR, each with distinct trade-offs between accuracy and implementation effort. The developer plans to use separate recognizers for formulas and plain handwriting, retain positional and confidence data for each recognized element, and flag unreadable lines as provisional rather than defaulting to a zero score. A real-world test set using authentic Gaokao-style handwriting, including messy and crossed-out samples, is yet to be built before any tool is adopted.

0 comments Read more at DEV Community