Laravel APP_DEBUG=true in Production Exposed Source Code, SQL Queries for Months

·3 views

A development team discovered last week that their Laravel application had been running with APP_DEBUG set to true in a production environment for several months. The misconfiguration caused every crashing route to display Laravel's full debug screen publicly, exposing file paths, stack traces, source code, SQL queries, and in some cases environment variables. The issue came to light during a routine SEO audit, when a Google Search Console alert flagged 2,246 pages returning 5xx server errors. Google had indexed all these error pages, meaning the sensitive technical details were accessible to anyone who found them via search. The team has since documented how they identified the breach, assessed the damage, and built a pre-deployment checklist to prevent similar oversights.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Build an Enterprise Autonomous Web Agent SaaS Using TypeScript

A new technical guide outlines how to architect an enterprise-grade autonomous web agent Software-as-a-Service platform using TypeScript. The piece addresses the growing demand from enterprises for intelligent systems that can interpret natural language directives, navigate dynamic web interfaces, and construct their own execution paths in real time. The guide draws an architectural parallel between microfrontend web applications and multi-agent systems, mapping components like API gateways to supervisor nodes and microfrontends to specialized worker agents. Key engineering challenges covered include preventing context degradation in long browsing sessions, isolating tenant states in distributed cloud environments, and maintaining compliance without sacrificing speed. The article provides theoretical foundations, architectural blueprints, and production-ready TypeScript code for building such a system from the ground up.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agents Expose a Long-Standing Gap in Non-Human Identity Security

As agentic AI systems like autonomous code assistants and orchestrators gain rapid adoption in 2025-2026, security experts warn that non-human identity (NHI) governance is being neglected. AI agents, like CI workers and service accounts before them, authenticate and connect to sensitive systems — yet are frequently granted broad, standing permissions via long-lived static secrets such as API keys. When these credentials leak, attackers can access everything the secret permits until the breach is detected. The core issue mirrors longstanding NHI security failures: authentication and authorization are not properly separated, violating zero-trust principles. Treating AI agents as accountable actors with scoped, time-limited permissions — similar to human employees — is proposed as a practical path toward closing this governance gap.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GitX tool organizes AI-generated code changes into clean, logical Git commits

A developer has released GitX, an open-source Git workflow tool designed to bring order to the messy working trees that AI coding agents like Codex, Claude Code, and Cursor often leave behind. After AI sessions that can touch dozens of files spanning features, bug fixes, tests, and documentation, GitX analyzes the changes and proposes how they should be grouped into separate, logically named commits before anything is written. The tool follows the Conventional Commits format and supports a broader workflow through commands covering branching, pull request creation, conflict resolution, and pre-commit checks. GitX is built with safety in mind, avoiding force-pushes, protecting existing branches, and flagging files that may contain secrets or credentials. It follows the portable SKILL.md Agent Skills format and can be installed via npx, with the creator actively seeking feedback on whether its commit-grouping logic matches how developers would organize changes themselves.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google shifts TPU management to Compute Engine as Cloud TPU API enters maintenance mode

Google has stopped active development of the Cloud TPU API, limiting it to bug fixes and security patches only, with no published sunset date. New TPU hardware generations, beginning with TPU7x (Ironwood), are exclusively supported through Compute Engine or Google Kubernetes Engine. A developer documented migrating a v6e-1 (Trillium) chip running the Gemma model under vLLM from the old queued-resources API to the new Compute Engine instances workflow. The core change involves replacing TPU-specific CLI flags and commands with Compute Engine equivalents, such as swapping accelerator-type for machine-type and using gcloud compute instances instead of gcloud compute tpus. Developers on v5p and v6e can migrate without special access, while TPU7x flex-start provisioning currently requires allowlist approval from Google's account team.

0 comments Read more at DEV Community