Hubfly publishes a coding-agent skill with permission fences to prevent accidental data loss

·2 views

Hubfly has released a CLI skill that lets coding agents like Claude Code, Codex and Cursor inspect, plan and deploy apps to its platform. The skill follows a five-step loop of inspecting the app, reconciling it with the running container, reviewing the plan, asking for authorization on costly or destructive actions, and reporting the final state. Its rules stop agents from deleting durable volumes without a separate named confirmation and from exposing secrets or tokens. The guide recommends that users review and commit a local copy of the skill and configure permission allow-lists in their agent settings. Hubfly describes these controls as a fence rather than a full safeguard, and the skill is free, with costs tied only to deployed resources.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Tracking UK public tenders after Brexit: Find a Tender vs Contracts Finder

Since early 2021, UK tender notices no longer appear on the EU's TED database and are instead published on two government services. Find a Tender generally carries higher-value contracts, while Contracts Finder covers lower-value opportunities, mostly in England, plus award notices and early market engagement. Both publish data as OCDS JSON under the Open Government Licence v3.0, which permits commercial reuse with attribution and requires no API key. The author notes rate-limit responses (HTTP 429 and 403) that require waiting, and found that Contracts Finder's search feed sometimes shows deadlines a few hours off, so per-notice endpoints should be used for deadlines. Because weekly volumes are small, the author suggests pulling all new notices and filtering locally, and mentions a paid Apify actor that automates this for $0.004 per tender.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

WordPress CVE-2026-87902 Exploited Within a Day of Patch, Honeypots Log Webshell Attempts

A WordPress core vulnerability, CVE-2026-87902, was patched in version 7.1.2 and began seeing active attack traffic within roughly a day of disclosure. The flaw uses double-encoded directory traversal in the pagename parameter to include readable local PHP files without authentication, and can lead to remote code execution under certain theme and PHP configurations. Honeypot sensors in the Previdian network recorded 64 attempts from a single New Jersey host, which appeared to be an effort to install a web shell hosted on GitHub. Affected are WordPress releases below 7.1.2, and the campaign probed broadly rather than targeting a specific sector, so small and mid-sized sites are also at risk. Administrators are urged to update immediately and check for traversal requests, outbound fetches to code-hosting domains, and newly written PHP files.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Study finds 22.4% of AI Overview traffic lands in GA4 Direct, not Organic

A nine-month first-party analysis of one transportation-industry brand found that nearly a quarter of tracked Google AI Overview traffic was classified as Direct in Google Analytics 4 rather than Organic. The study covered September 2025 through June 2026 and recorded 51,200 referral events across 1,661 cited snippets. AI Overviews made up 7.53% of organic sessions overall, though their share swung from peaks of about 16% to 17% down to roughly 2% to 4% in recent months. Researchers suggest Google's text-fragment URL parameter may cause these visits to be misclassified, though the same pattern can appear in other Google features. The authors caution that the results reflect a single brand and should not be treated as a universal benchmark.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why a Self-Hosted Qdrant Memory System Returned Grocery Lists for Project Queries

A developer built a personal AI memory system using Qdrant, a local embedding model, and automatically generated session notes. When asked about recent project follow-ups, the system returned a grocery list because its wording shared similar vocabulary, producing a high cosine similarity score despite being irrelevant. The author explains that vector search is a nearest-neighbor method that finds mathematically similar text rather than truly remembering information. The experience led to adding domain filters to improve retrieval relevance. The article argues that the perceived memory is only as good as the retrieval quality.

0 comments Read more at DEV Community