LLM Gateway Model Lists Are Unreliable Contracts, Developer Audit Finds

·1 views

A developer audit conducted on 29 September 2026 tested the public model-list endpoints of multiple LLM gateways, calling each twice with a twenty-minute gap. The investigation found that base URLs were sometimes misconfigured, causing API clients to fail before a single request was made. Model counts proved unstable, with one endpoint returning 477 models on one date and a different figure shortly after. Response field schemas also changed without notice, silently breaking any downstream logic built on those fields. The author recommends five baseline checks — including verifying route existence, diffing field sets between calls, and snapshotting responses — before routing production traffic through any gateway.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

New Cyber-OSINT model released

Article URL: https://twitter.com/0x0SojalSec/status/2104736980768866439 Comments URL: https://news.ycombinator.com/item?id=49890829 Points: 4 # Comments: 0

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Webhook Signature Verification Alone Does Not Guarantee Request Authorization

Verifying an HMAC webhook signature only confirms that a payload originated from a vendor, not that the request is authorized to modify specific resources in your system. Developers must separately map incoming events to internal subjects and apply proper authorization checks — covering tenant, user, and resource — before executing any side effects. A correctly signed payload can still contain a spoofed tenant ID or an action the customer never permitted. Network trust and cryptographic authenticity do not substitute for a defined authorization policy. Experts recommend evaluating subject, action, and resource before mutating any system state.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Splits 2,000-Line Home Assistant Config into 8 Organised Files Using Python

A Home Assistant user refactored a bloated 2,144-line automations.yaml file — spanning 63 automations across heating, alarms, cameras, and more — into eight separate, topic-specific files. The main concern was silently breaking critical automations, such as heating controls managing 11 thermostats, during the refactor. To address this, the developer wrote a 40-line Python script to split the file and a separate verification script to confirm no automations were lost in the process. Classification was handled through substring matching on German-language automation aliases, routing each entry into a named bucket like 'heating' or 'alarm', with unmatched entries falling into a miscellaneous file. The project highlights a practical approach to managing growing smart-home configuration files without relying on metadata tags or manual reorganisation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build Identity-Aware AI Agents Using Microsoft Agent Framework and Auth0

A developer built a four-part tutorial series demonstrating how to add proper identity and authorization controls to AI agents using Microsoft Agent Framework and Auth0. The project centers on a fictional expense-approval agent where a manager interacts with an AI that retrieves reports, sends emails, and approves or rejects expenses on their behalf. Each agent capability — from reading expense data to taking actions — required its own distinct identity and authorization decision, rather than a single blanket permission. Auth0's Fine-Grained Authorization was used to filter accessible data before vector search runs, ensuring the underlying language model never processes information a user is not permitted to see. The series, published on the Auth0 blog, aims to address the identity and accountability gaps that most AI agent tutorials overlook entirely.

0 comments Read more at DEV Community