SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Open-Source CLI Tool 'Ship Safe' Scans AI-Generated Code for Security Risks

0
·1 views

A developer has released Ship Safe, an open-source command-line security scanner designed to catch vulnerabilities in AI-generated code before it reaches production. The tool was built after the author repeatedly observed AI-generated code that appeared clean during review but shipped with risky defaults such as permissive CORS configurations, leaked tokens, and unsafe CI/CD workflows. Ship Safe scans application code, secrets, dependencies, GitHub Actions workflows, MCP server configs, AI agent patterns, and supply-chain risks. It can be run locally or integrated into CI pipelines, and supports SARIF output for compatibility with existing security tooling. The project is available on GitHub and is aimed at developers who rely on AI coding assistants, MCP, or security automation in their workflows.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Anthropic Releases Claude Code 2.1.224 With Self-Hosted Runner Support for Enterprises

Anthropic released Claude Code 2.1.224 on August 7, 2026, introducing self-hosted environment support for Team and Enterprise organizations. The update allows a new claude self-hosted-runner process to execute Claude Code cloud sessions on an organization's own machines or containers. However, the feature does not constitute fully on-premises inference — repository checkouts, build artifacts, and injected secrets remain on the organization's infrastructure, while session prompts, responses, transcripts, and model inference continue to flow through Anthropic's control plane at api.anthropic.com. The public beta currently excludes Zero Data Retention organizations, non-GitHub repositories, and inference routing through Bedrock, Google Cloud, or Microsoft Foundry. Platform teams are advised to carefully evaluate the trust boundary and complete a seven-step security checklist before connecting any production repository to a self-hosted runner.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds Offline, Encrypted Calibration Tool for Small Factories Using .NET 8

A developer created CalibKeep, a fully offline desktop application designed to replace spreadsheet-based calibration tracking in small manufacturing facilities. Built with .NET 8, Avalonia UI, and an AES-256 encrypted local database via SQLCipher, the app manages calibration schedules, depreciation, and audit trails. A critical bug was discovered where opening a SQLCipher database with the wrong passphrase permanently corrupted the connection handle, which was resolved by verifying an HMAC marker before ever accessing the SQLite file. The app supports ISO 9001 compliance by writing audit log entries within the same transaction for every data change, and a rule engine flags high-impact changes when calibration-critical fields are modified. The tool was published to the Microsoft Store, where the developer encountered and resolved issues around app manifest formatting, certificate signing mismatches, and license validation logic.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Tech Industry's Title Inflation Is Misleading Hiring Managers and Hurting Candidates

A hiring manager's policy of auto-rejecting Staff or Principal engineers with only 3-4 years of experience ignited debate online, with critics split between calling it gatekeeping and calling it reasonable. Research shows the controversy stems from widespread title inflation, with studies indicating that a quarter of junior roles were rebranded with senior titles between 2019 and 2022, while Lead positions tripled among early-career workers by 2023. A Pearl Meyer survey of over 400 organizations found 54% were using inflated titles as a talent attraction tool, often as a substitute for competitive pay raises. Experts like author Will Larson argue that Staff-level roles should be defined by scope and influence rather than tenure, meaning some engineers at small startups holding the title may not meet that bar, while others with fewer years genuinely do. Ultimately, candidates are the primary victims of this inflation, penalized by recruiters for titles they were given rather than ones they chose.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

OpenAI Lets ChatGPT Users Manually Control Reasoning Depth via GPT-5.6 Sol

OpenAI has introduced user-controllable reasoning levels in ChatGPT, allowing eligible subscribers to manually select how much reasoning a response receives instead of relying solely on automatic model selection. The update is built around GPT-5.6 Sol and offers five tiers — Instant, Medium, High, Extra High, and Pro — accessible through the ChatGPT model picker. Plus subscribers can access up to Medium reasoning, while Pro users unlock all tiers including the most demanding Pro option powered by GPT-5.6 Sol Pro. A Configure setting also lets users toggle automatic reasoning switching on or off, though if a higher-reasoning tier is exhausted, ChatGPT may fall back to a lower mode. The change gives users a clearer, per-response way to balance speed and depth depending on task complexity.

0 comments Read more at DEV Community