OWASP Cornucopia Mobile App Edition v2.0 Launches with 80 Threat Cards

·1 views

OWASP has released Cornucopia Mobile App Edition v2.0, a card-based threat modeling tool designed to improve mobile application security during the development process. The new version is compatible with MASVS v2.1, MASTG v2.0, and MASWE v1.0, and covers 80 threats mapped to security requirements, tests, and known weaknesses. Each card includes reference mappings to CAPEC, OWASP MASTG, and MASVS standards, helping development teams identify security requirements within agile sprints. The tool is already in use at Admincontrol, where teams play through threat scenarios before sprint planning to embed security thinking into their software development lifecycle. By involving developers directly in threat identification, the approach aims to build security awareness and prevent vulnerabilities from being deprioritized or forgotten in the backlog.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Plain HTTP Crawler Automates Contact Info Extraction from Company Websites

A developer has built an open-source tool called website-lead-extractor that automates the process of harvesting contact information from company websites, a task that traditionally consumes hours of manual work. Given a starting URL, the crawler uses Crawlee's CheerioCrawler to navigate within the same domain up to a chosen depth, extracting emails, phone numbers, and social media profile links from raw HTML. Because it relies on plain HTTP requests rather than a headless browser, it is fast and inexpensive to run but cannot retrieve content that loads dynamically via JavaScript. This makes it well-suited for static or server-rendered sites, which represent the majority of small and mid-sized business websites, though heavily client-rendered pages may yield incomplete results. The tool is available as an open-source project on GitHub and also as a hosted Apify actor requiring no local setup.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

7 Free and Open-Source Jira Alternatives for Teams Working With AI Agents

As AI coding agents become active contributors in software development, the demands on project management tools are evolving beyond traditional human-focused workflows. Tools must now support structured task handoffs, parallel agent activity, and review processes for agent-generated work. A roundup published on DEV Community highlights seven free or open-source Jira alternatives worth considering in 2026, including Plane, which offers a self-hosted Community Edition under the AGPL-3.0 license. These platforms vary in their approach, with some offering free cloud tiers and others relying on self-hosting for no-cost access. The piece emphasizes evaluating tools not just on classic project tracking features but on how well they integrate into hybrid human-and-agent development environments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Ex-OpenAI and Anthropic Researcher Warns AI Labs Moving Too Fast to Control

A researcher who claims to have spent three years at OpenAI and Anthropic publicly resigned this week, warning that leading AI labs are advancing toward systems that may become hard to control. His concern highlights a broader governance gap: AI tools are no longer just answering questions but actively executing commands, modifying files, and taking real-world actions. Most engineering teams lack a unified, reviewable record of what AI-assisted tasks actually do and why. The article argues that organizations do not need to wait for a superintelligence scenario to start making AI actions transparent and auditable. It introduces Chron, an open-source, local-first audit tool designed to log AI activity with tamper-evident records, positioning accountable evidence as a practical step every team can take now.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Developers Are Ditching Cloud Bookmarks for Self-Hosted, SQLite-Powered Tools

Privacy concerns around cloud bookmark services have pushed developers and power users toward self-hosted alternatives in 2026, as platforms like Pocket face uncertain futures following corporate layoffs and acquisitions. Cloud services can track saved links, build behavioral profiles, and share reading data with ad networks, making personal bookmark lists a surprisingly sensitive data asset. Open-source tools such as linkding, Shiori, Wallabag, and Linkwarden allow users to run private, searchable bookmark managers on local hardware or a self-controlled VPS. SQLite powers most of these tools, requiring as little as 50 MB of RAM and offering a single portable database file with no server daemon or complex configuration. Linkding, considered the most popular self-hosted option in 2026, can be deployed in under ten minutes using Docker, eliminating subscriptions, tracking, and vendor lock-in entirely.

0 comments Read more at DEV Community