Next.js NEXT_PUBLIC_ Prefix Can Silently Expose Secret API Keys in Browser

·1 views

A common Next.js misconfiguration can cause secret API keys to be embedded in plain text inside publicly downloadable JavaScript bundles. The framework's NEXT_PUBLIC_ environment variable prefix is designed to expose values to the browser at build time, but developers sometimes mistakenly apply it to private credentials like Stripe secret keys or database URLs. Because the application continues to function normally with no errors, the leak produces no visible warning and can go undetected in production indefinitely. The mistake is often introduced by following tutorials or AI-generated code snippets that use the prefix without explaining its security implications. Developers are advised to audit their deployed bundles immediately and ensure only genuinely public values carry the NEXT_PUBLIC_ prefix.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Build a Real-Time Polymarket Order Book Monitor Using Python

A developer tutorial published on DEV Community walks through building a lightweight, real-time order book monitor for Polymarket using Python and its public CLOB Market WebSocket. The guide explains how to connect to Polymarket's WebSocket endpoint, subscribe to market data using asset token IDs, and process live events such as book snapshots and price changes. It demonstrates how to calculate key metrics including best bid, best ask, and spread from streaming data without requiring any authentication. The tutorial intentionally separates WebSocket transport from order book state management, making the tool suitable as a foundation for research, dashboards, or automated trading systems. It also covers practical considerations such as handling reconnects, heartbeats, and detecting stale market data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Identify Known CVEs in Closed-Source Firmware Without Source Code

Security researchers working with embedded and IoT devices often face the challenge of auditing closed-source firmware binaries for known vulnerabilities without access to vendor source code. The recommended approach begins with unpacking firmware images using tools like binwalk to extract the underlying filesystem, followed by scanning binaries for version strings using the 'strings' command. Identified component versions can then be cross-referenced against CVE databases using automated tools such as CVE-bin-tool, which matches findings against NVD vulnerability data. For kernel modules lacking readable version banners, utilities like modinfo and reverse engineering tools such as Ghidra can help narrow down applicable vulnerabilities. Crucially, a version match should be treated as a lead rather than a confirmed finding, since vendors sometimes backport fixes without updating version strings.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Fully automated trading system required human intervention three times in a month

A developer building a fully automated stock trading system documented three separate incidents within a month where human intervention was required to correct failures the system could not handle on its own. In the first case, a sell order for a specific stock was repeatedly blocked because the order size always exceeded the remaining daily trading quota, making execution structurally impossible regardless of scheduling. The second incident involved a safety circuit incorrectly blocking two valid buy orders after misreading intraday price snapshots as cumulative loss indicators, triggering a halt that was not warranted. A third failure occurred during the manual fix for the second incident, when a tool used to log human trades silently misclassified a first-time purchase of a new stock as an unrelated transaction, briefly leaving a real asset unrecorded in the ledger. The developer concluded that true automation requires well-designed human intervention pathways that are fully logged and cover all edge cases, since gaps in automation only become visible after failures occur.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Three Times a Self-Running Trading Bot Still Required Human Intervention

A developer running a fully automated algorithmic trading system had to intervene manually three times in a single month due to distinct structural failures. In the first case, a daily budget allocation rule repeatedly starved one sell order, which was never large enough to clear within the remaining budget, requiring a manual execution and a rule redesign. The second failure involved a drawdown guard that incorrectly blocked two valid buy orders by mixing intraday price snapshots with a metric meant to track cumulative state, prompting a fix that separated the two measurement types. A third incident occurred when the tool used to log manual trades silently misclassified a brand-new position, briefly leaving a purchased asset outside the ledger entirely. Each failure revealed a gap between a system designed to run autonomously and the edge cases that only surfaced during real-world operation.

0 comments Read more at DEV Community