Overly Broad S3 Upload Policies Open Buckets to Unauthorized Write Access

·6 views

Security researchers have identified a recurring vulnerability pattern in Amazon S3 signed POST upload policies, documented across at least four HackerOne bug reports involving Shopify and BCM. The flaw occurs when developers use prefix-based key conditions — such as 'starts-with files/' — instead of binding each signed URL to a single, exact object key generated server-side. This broad scope allows any authenticated user to write to unintended paths within the bucket, potentially overwriting sensitive files or creating supply-chain implant points. The correct fix is to replace prefix conditions with exact-match key bindings, limiting each signed upload policy to one specific object. Security teams are advised to audit existing upload policies and enforce exact key matching to eliminate this class of misconfiguration.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Simple, Functional Developer Portfolios Beat Flashy Ones, Hiring Data Shows

A software engineer and hiring reviewer argues that developer portfolios succeeding in landing interviews share three core traits: live project demos, a functional contact form with a real backend, and proper SEO metadata so recruiters can find the candidate by name. Based on reviewing hundreds of portfolios as a freelancer, founder, and recruiter contact, the author found that visual complexity rarely correlates with interview callbacks. The recommended structure covers just four sections — hero, projects, about, and contact — designed so a recruiter can scan the page in under 30 seconds. The guide uses Next.js with the App Router and Node.js, though the author notes the structural principles apply to any framework. The article walks developers step by step from an empty folder to a deployed site with a custom domain, emphasizing SEO metadata setup as a critical step most developers skip.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Sidekiq vs Kafka: Key Differences Rails Developers Must Understand

A Rails developer building TxFlow, a payment processing system, documented the key conceptual differences between Sidekiq and Kafka after migrating from one to the other. Unlike Sidekiq, which processes job-based commands through queues, Kafka stores immutable event records in topics that multiple independent consumer groups can read at their own pace. The primary motivation for switching was architectural: a single payment event needed to trigger five independent reactions, and Kafka allowed new consumers to subscribe without modifying the original producer code. However, Kafka lacks Sidekiq's built-in retry and dead-letter handling, requiring developers to manually implement exponential backoff, dead-letter topics, and failure dashboards. The developer also noted that Kafka's scaling is bounded by partition count, and that ordering guarantees only apply within a single partition.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Empryo's 'Immune System' Forces AI Agents to Leave Lint Guards After Every Bug Fix

A developer building an AI coding agent called Empryo has introduced a structured bug-fixing protocol nicknamed the 'immune system,' designed to prevent the same bugs from being reintroduced by future agents. Under the system, a bug fix is only accepted after an independent reviewer confirms the reproduction, and the original finder cannot approve their own report. Each fix must demonstrate failure on old code and success on new code, with a separate reviewer checking the diff. For statically detectable patterns, fixes must also include a GritQL lint rule in Biome along with test fixtures for both bad and good code. The workflow is publicly available via SoulStack's immune-system skill and is designed to work with any agent capable of running shell commands.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Self-Host an AI Code Review Agent on AWS Lambda Using PR-Agent and CDK

PR-Agent is an open-source AI-powered code review tool originally created by Qodo and later donated to the community, now maintained under its own GitHub organization. It supports commands like /review, /improve, and /ask to automate pull request analysis across GitHub and GitLab. The tool can be deployed on AWS Lambda, which offers a cost-efficient fit since code reviews are event-driven and require no persistent state between invocations. Configuration is handled entirely through environment variables, making it well-suited for serverless environments where mounting config files is not practical. Model calls are routed through LiteLLM, allowing easy switching between providers like OpenAI and AWS Bedrock with a simple config change.

0 comments Read more at DEV Community