New Open-Source Tool Detects Cross-Tenant Data Leakage in Multi-Tenant SaaS Apps

·1 views

A developer has released mcp-tenant-isolation, an open-source static analysis scanner designed to catch tenant isolation failures in multi-tenant SaaS applications and MCP servers. The tool addresses a security blind spot left by popular scanners like Snyk, Semgrep, and CodeQL, which do not understand tenant context or track organizationId boundaries in database queries. It ships with 57 deterministic rules across seven categories, covering database queries, file storage, cache key scoping, IDOR vulnerabilities, logging, and MCP-specific patterns. The scanner can be installed via npm and run from the command line, producing a pass/fail verdict with detailed, actionable remediation guidance for each finding. It also supports SARIF output for direct integration with GitHub Code Scanning, making it suitable for CI/CD pipelines.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Quant Models Outperform Human Traders by Removing the Render Layer

A developer essay argues that human traders are fundamentally limited by how their brains 'render' raw market data into emotionally charged patterns, such as seeing a 'head and shoulders' formation in a price chart. This cognitive rendering process attaches memories, feelings, and associations to data before any conscious decision-making occurs, making purely disciplined trading nearly impossible. In contrast, machine learning models like XGBoost operate on plain numerical tables, splitting data by measurable thresholds and building hundreds of small decision trees without any emotional interpretation. The essay is the third in a series exploring the concept of the 'render layer' — the brain's tendency to collapse raw input into a subjective scene — and how it applies to both human cognition and AI systems. The author concludes that quantitative finance is one domain where keeping the render layer out of the decision process is not just preferable but essential.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Advocates Building Small Projects and Shipping Early Over Perfection

A developer on DEV Community has shared reflections on the value of building small, independent projects. Their key takeaway is that simplicity and early shipping tend to be more effective than pursuing perfection. Even modest projects, they note, offer meaningful lessons in coding, deployment, design, and real-world user behaviour. The developer plans to periodically share personal development notes and experiments on the platform.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Random Forests Use Distributed-System Logic to Make Stabler Predictions

A random forest is a machine learning algorithm that builds hundreds of independent decision trees, each trained on a random data resample and a random subset of features, then combines their outputs via majority vote. This design mirrors distributed systems thinking: no single point of failure, and errors cancel out because each tree fails differently. The key distinction from simple bagging is the forced feature randomization at each split, which ensures trees remain genuinely diverse rather than converging on the same dominant predictors. However, the approach breaks down when that diversity is illusory — trees trained on a biased dataset share the same blind spots, producing confident but uniformly wrong predictions. Random forests remain a widely used baseline for tabular business data before teams consider more complex deep learning solutions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How an AI Escalation Router Prevents Wrong Automated Replies in Customer Support

AI support agents can erode customer trust not through malice but by delivering confidently wrong answers on sensitive issues like refunds, security, or outages. An AI escalation router acts as a policy layer that evaluates each support conversation across intent, risk, confidence, and customer context before deciding the next action. Rather than triggering human handoff only after a failure, the router intervenes proactively by choosing from states such as auto-reply, clarify, draft-for-review, human handoff, or block. This approach aims to protect customers from harmful automation errors while freeing human agents from routine, low-risk tickets. Developers are advised to begin with five clear routing states rather than complex workflows, making the system auditable and manageable for small teams.

0 comments Read more at DEV Community