New local tool keymap maps where API keys sit across config files and shell history

·1 views

After a recent agent-tool vendor breach, the author found it hard to say which API keys they had or where they were stored, and suspected most developers face the same problem. They built keymap, a dependency-free Python tool that scans agent, CLI and shell config files for provider keys such as Anthropic, OpenAI, GitHub and AWS. The tool flags duplicate copies of keys, overly permissive file permissions, keys in shell history, and files at risk of being committed to git. It runs read-only with no network access or telemetry, and prints only key prefixes and SHA-256 fingerprints along with a rotation checklist.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Lessons from running a 200-game browser arcade on instant-play design

A contributor who helps run PlayPokiGame, a free site of casual HTML5 games playable in-browser without downloads or signups, shares lessons from observing real player behavior. Time-to-interactive proved the strongest predictor of play sessions, with games showing a playable frame within about three seconds drawing far more engagement. The author also found that browser players skip tutorials, so controls should be shown in-game, and that short 10–20 minute play bursts favor games with natural 3–5 minute loops. Instant respawns, auto-pausing on tab blur, and periodic localStorage saves are highlighted as key to keeping players from abandoning games. The author argues these principles apply broadly to web products, given the browser runs on everything from cheap Chromebooks to high-end workstations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Browser-based HEIC to JPG conversion for iPhone photos using JavaScript

iPhones save photos in HEIC format by default, which is smaller than JPG but often rejected by websites, forms, and Windows apps. Because only Safari can natively decode HEIC, the author recommends the heic2any library, which uses WebAssembly to convert files directly in the browser. The library is about 1.3 MB, so it is loaded only after a user selects a HEIC file to keep page loads fast. Developers are advised to handle multi-image HEIC outputs as arrays, check file extensions since MIME types can be empty, convert files sequentially to limit memory use, and use a quality setting of 0.9. Since the file never leaves the user's device, the approach also suits private photos.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five On-Premises Project Management Tools Compared on Data Control and Workflow Fit

Organizations that must keep project records on infrastructure they manage need to weigh deployment options alongside approval steps, status reporting, and daily usability. A new practitioner's guide compares five tools on deployment and data control, workflow coverage, and operational fit. It recommends first confirming hosting requirements, then testing each candidate against a representative project from planning through reporting. The guide profiles ONES.com, Jira Data Center, Microsoft Project Server, Wrike, and OpenProject Enterprise, noting each one's strengths and caveats such as Jira Data Center's announced end-of-life timeline. Its suggested evaluation method is to trace a requirement through planned work and execution updates to see whether it surfaces in project reporting.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Treat LLM Agents Like New Bank Tellers: Five Controls That Transfer

A developer with a background in financial systems argues that LLM agents with tool access resemble new bank employees who are fast but cannot reliably distinguish genuine customers from fraudsters. The author suggests that long-established banking controls can be applied to these agents. Key recommendations include enforcing policy in code rather than in prompts, using a gate that checks each proposed tool call before execution, and treating retrieved document content as untrusted data to limit prompt injection. The piece also recommends detailed logging of every proposed tool call, including rejections, and using velocity checks to detect fraud patterns.

0 comments Read more at DEV Community