Leantime API keys act as service accounts with broad visible access risks

·5 views

Leantime, a project planning and task management tool with an API, uses users, roles, projects, and API keys that can function as durable service accounts. Internet-facing deployments may therefore expose credentials able to read or modify project data, and a ZoomEye count-only query returned 960 assets matching the Leantime fingerprint, though this does not confirm that all are active instances. The guidance recommends inventorying every API key by owner, role, project scope, and last use, and removing unused experimental keys. Administrators are advised to restrict who can create keys, alert on key and role changes, and verify API-level permissions with low-privilege test accounts. Self-hosted operators should also review secret storage, file permissions, and leftover setup paths.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer weighs options for struggling X reply app Starling after weak early traction

A developer who built Starling, a tool that drafts X replies in the user's own voice, says the app has struggled to find users despite going live as a free beta on 31 October. After an unsuccessful Flippa auction that drew no bids, they are now considering selling the product, pivoting it toward professionals who reply online for work with a LinkedIn focus and a $19-29 monthly price, seeking an audience-holding partner, or shutting it down. Their estimate is that they may reach only 30-90 sign-ups and 0-2 paying users in the next two months, given the crowded market for AI writing tools. They have asked the developer community for advice and invited feedback on the free product at starlingwriter.com.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Confirmed Crypto Transactions Can Still Trigger AML Reviews

A blockchain transaction showing confirmation does not guarantee that the funds lack a suspicious history, a point often overlooked by users. Confirmation only shows the transfer was processed; it does not verify the origin of funds, sanctions exposure, or links to scams and stolen assets. Compliance screening instead examines the risk profile of a wallet address, which is a different question from whether a transaction occurred. Risk indicators can include sanctions connections, mixer activity, stolen funds, darknet exposure, and interactions with flagged counterparties. The concern is especially relevant for USDT on the TRON network, widely used by traders, exchanges, and businesses receiving stablecoin payments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DoorDash's AI-Assisted Coding Interview: A 60-Minute Practice Plan

DoorDash's March 2026 engineering interview announcement describes swapping traditional coding rounds for a 60-minute session where candidates use integrated AI tools on a supplied project. Evaluators reportedly weigh how candidates get oriented, verify AI output, debug, control scope, and explain tradeoffs, with finishing every task counting for less than good judgment. The article proposes a rehearsal built around a small support-ticket routing app, where a new refund rule must take priority over existing order and payment rules. The author stresses that the schedule is an original practice plan rather than DoorDash's official agenda, and advises candidates to confirm tool permissions with their recruiter.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

FBI Attributes $6.3B Binance Crypto Theft to North Korea's TraderTraitor Group

The FBI has attributed the theft of roughly $6.3 billion in cryptocurrency from Binance on October 29, 2026, to the North Korean threat group TraderTraitor. Binance says it has found no evidence of hot-wallet private key leakage but is probing a possibly compromised DevOps endpoint and other potential entry points. TRM Labs reports that the stolen funds were moved across ten blockchains in a short window, using pre-signed authorizations on Ethereum and standard signed transfers elsewhere, which suggests the signing infrastructure was compromised. Frozen assets total about $2.7 billion as of October 30, but attackers still hold ETH and BTC that issuers cannot freeze. Binance plans to phase in withdrawal resumption starting November 1.

0 comments Read more at DEV Community