SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Open-Source Secret Scanner Exposes Crypto Phishing Site's Own Firebase Keys

0
·2 views

A developer benchmarking Sentinel, a newly released open-source Git secret scanner written in Go, stumbled upon a phishing site impersonating Tether (USDT) while scanning random GitHub repositories. The scammer had hardcoded Firebase credentials — including an API key and project ID — directly into their code, leaving them fully exposed. The linked Vercel deployment revealed a fake Tether login page designed to steal cryptocurrency wallet credentials, even prompting users to authenticate via Spotify. The developer publicly posted the exposed keys in a GitHub Issue on the scammer's own repository, drawing attention to the vulnerability and getting the Firebase project flagged. The incident highlights growing risks tied to AI-generated code, where developers and bad actors alike often fail to properly manage sensitive credentials like API keys.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Developer builds tool to visualize how AI instruction rules degrade under context load

A developer created an interactive browser-based demo to illustrate how AI agent instructions lose effectiveness as a session's context window fills up. The tool renders each instruction as a 3D hill, with height determined by writing quality, while a rising water level simulates increasing context load — weaker rules sink first. The project was built as a single self-contained HTML file with no external dependencies, using a hand-rolled 2D canvas renderer instead of WebGL. A companion linting tool analyzes instruction text for common weaknesses such as hedging, vague language, and poor directive ordering. The core argument is that critical prohibitions should be enforced via runtime code hooks rather than relying on a model's attention to prose instructions.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds Fan Loyalty Tracker That Stores Streaks on Solana Blockchain

A developer has built Loyalty Ledger, a fan loyalty tracking app that records check-in streaks, badges, and activity history directly on the Solana blockchain rather than in a centralized database. The project was created as part of a weekend coding challenge focused on passion projects. The core idea addresses a common frustration: sports apps can reset or delete a user's loyalty history at any time, since that data belongs to the platform, not the fan. With Loyalty Ledger, a user connects a crypto wallet, selects a team, and checks in — each action writes a real on-chain transaction, and earned badges are minted as actual SPL tokens to the user's wallet. Currently, only the FIFA World Cup path is fully functional on Solana's test network, with NBA and other sports categories listed as works-in-progress.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Levelo-Js v2 Launches as Full TypeScript Rewrite with Overhauled Memory Management

Levelo-Js v2 has been released as a complete architectural rewrite of the lightweight JavaScript UI framework, now rebuilt entirely in TypeScript for strict type safety and improved developer experience. The new version ships production bundles via tsup, delivering tree-shakable ES Modules designed to reduce build size. A redesigned Reactive Ownership Architecture introduces parent-child state tracking, while the core effect engine now auto-disposes stale dependencies, keeping heap memory stable at around 2.5MB during intensive interactions. Two new lifecycle hooks, mount() and cleanup(), give developers precise control over DOM tasks, event listeners, and async operations across route transitions. The release also patches a compiler bug that incorrectly converted camelCase SVG attributes to kebab-case, and introduces an improved 404 fallback screen for unregistered client-side routes.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How one developer monitors 120 websites for free using Cloudflare's free tier

A developer built a web tool called 'itsnotyou.site' that determines whether a site outage stems from the user's connection or the website itself by running parallel checks from both the browser and Cloudflare's edge network. The entire system — including uptime monitoring for around 120 sites, 24-hour history, status pages, and outage alerts — operates at no cost on Cloudflare's free tier. The key engineering challenge was staying within Cloudflare's limit of 1,000 KV writes per day, solved by storing all 120 site statuses in a single data blob and offloading background sweeps to an existing VPS. A real-time visitor counter was moved to Cloudflare's Analytics Engine to prevent user traffic spikes from consuming the write budget reserved for the status monitor. The developer acknowledged that while Cloudflare costs nothing, the background sweep relies on a separately paid VPS, making the 'zero cost' claim partially conditional on existing infrastructure.

0 comments Read more at DEV Community