SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Junior AppSec Engineer in India Struggles With Billion-Line Codebase and No Mentorship

0
·1 views

A junior Application Security Engineer in India has publicly sought help after being assigned to review a codebase of up to two billion lines within a one-month deadline, despite having minimal training and no senior mentor. The engineer, a recent graduate, was given only basic tools such as grep and a free-tier version of Codex, which proved inadequate for detecting complex security flaws at scale. Their only significant find — a critical two-factor authentication flaw involving an OTP stored in a browser cookie — was discovered by chance rather than through any systematic process. With limited proficiency in the relevant programming languages and growing employer pressure over perceived low productivity, the engineer's situation highlights a broader industry problem of organizations assigning high-stakes security work to junior staff without adequate support. Experts warn that such onboarding failures increase the risk of undetected vulnerabilities, data breaches, and long-term reputational damage for the organizations involved.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Google Adds Personal Intelligence Layer to Gemini in Chrome for Contextual Assistance

Google is expanding Gemini in Chrome with an opt-in feature called Personal Intelligence, which connects data from selected Google apps such as Gmail, Calendar, Docs, Maps, and YouTube to deliver more contextually relevant assistance. The upgrade aims to reduce manual context-switching by allowing the browser assistant to draw on a user's existing work across Google services, subject to explicit permissions. The rollout is currently focused on desktop Chrome, targeting US users and English-language configurations first, with regional expansion including Latin America planned. Personal Intelligence is in beta and is expected to support more connected apps over time, meaning current capabilities represent an early-stage implementation. Gemini in Chrome is not yet available on Android, and access to certain features may depend on a user's Google account subscription tier.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Is AI's 'Double-Check Before Use' Warning a Genuine Safeguard or a Liability Shift?

A widely discussed opinion piece on DEV Community questions whether the standard AI disclaimer — advising users to verify outputs before use — places an unfair burden on those least equipped to do so. The author argues that for familiar topics, verification is reasonable, but for unfamiliar ones, users may lack the knowledge needed to detect confident errors in the first place. The piece raises concerns that requiring line-by-line auditing of AI responses erodes the time-saving benefit these tools are meant to provide. The author suggests a more practical standard would be to calibrate verification effort to the level of risk involved, while making AI uncertainty and limitations more transparent to users. Ultimately, the article questions whether the blanket disclaimer is an honest safety measure or a mechanism for AI companies to transfer responsibility onto users.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How a Solo SaaS Developer Built Idempotent Email Delivery for a Cron-Based Product

A developer behind Upwork Scout, a small SaaS that matches freelancers to job listings via email, has detailed the engineering challenges of building a reliable scheduled email system. The core problem is that unlike database writes, sent emails cannot be undone or retried safely, making duplicate sends a real user-facing failure. To prevent duplicate emails, the developer uses deterministic Firestore document IDs derived from user and job data, turning idempotency checks into simple lookups rather than complex queries. A distributed lock prevents multiple concurrent scan runs from duplicating work and inflating scraping costs. The developer also intentionally chose at-least-once delivery for daily digest emails, reasoning that silently losing a digest is worse than occasionally sending a rare duplicate.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Trailing newline from 'echo' command silently broke every webhook HMAC signature

A developer building a GitHub Marketplace integration found that every single inbound webhook failed HMAC-SHA256 signature verification, with no intermittent failures to suggest a logic bug. After ruling out raw-body parsing issues, wrong algorithms, and timing-safe comparison errors, the culprit turned out to be a trailing newline character appended by the 'echo' command when writing the shared secret to a .env file. Because GitHub stores the secret without a trailing newline, its computed signature never matched the server's, which was hashing with an invisible extra byte. The fix was replacing 'echo' with 'printf "%s"', which outputs exactly what is given without appending anything. The author recommends printing a server-side length and repr-dump of any secret as the first debugging step in signature mismatches, and advises against transiting secrets through shell sessions without validation.

0 comments Read more at DEV Community