OWASP Guide Outlines Best Practices for Secure API Key Management

·1 views

Security author Faiz Akram published a guide on August 21 detailing OWASP-backed best practices for managing API keys. The article emphasizes treating API keys with the same rigor as passwords, including regular rotation and secure storage. It also stresses the principle of least privilege, ensuring keys are granted only the minimum permissions necessary. The OWASP framework lends authority to the recommendations, while practical implementation steps make the guidance accessible to developers.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer fixes null-body crash in Formbricks survey SDK flagged by Sentry

A production crash in the Formbricks open-source survey SDK was automatically detected and reported by Sentry as issue FORMBRICKS-CLOUD-3VE. The bug caused an uncaught TypeError in visitors' browsers when the SDK's makeRequest helper attempted to read properties off a null HTTP response body. The same flaw existed in two separate packages — @formbricks/js-core and @formbricks/surveys — leaving the error path entirely unguarded against null or non-JSON responses. Developer Lewis Awe patched both instances by wrapping response.json() calls to handle SyntaxErrors and adding null-safe checks before accessing response properties. Because Formbricks does not accept unsolicited community pull requests, the fix was opened and merged on a personal fork as part of DEV's Summer Bug Smash challenge powered by Sentry.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Video AI APIs silently return durations shorter than requested, developers warned

A software developer has highlighted a systemic issue with video generation APIs, where requesting a specific clip duration — such as 10 seconds — often results in a shorter rendered file with no warning or error returned. The root cause lies in how latent video diffusion models compress frames internally, meaning only certain frame counts are mathematically valid given each model's frame rate and block size. When a requested duration does not align with these legal frame counts, the model silently rounds down to the nearest valid length. This discrepancy becomes a practical problem when multiple clips are assembled into a timeline, causing cumulative sync errors with audio or music. The developer recommends that engineers building on such APIs enumerate valid durations at build time and treat duration as a constrained value rather than a free input.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Swarm Runtime Lets Teams Scale from API Gateway to Multi-Agent AI Without Rewrites

A Rust-based AI runtime called Swarm is designed to eliminate the perceived trade-off between using a lightweight API gateway and a full agent orchestration framework. The tool allows engineering teams to start with a simple OpenAI-compatible proxy and progressively enable more advanced capabilities — such as multi-provider routing, stateful sessions, MCP tool execution, and multi-agent workflows — by changing configuration flags rather than rebuilding infrastructure. Developer teams typically scale their LLM stacks through predictable stages, and Swarm structures these as six configurable 'rungs,' each adding functionality without replacing the underlying runtime. The project is built in pure Rust and aims to avoid the common pattern of patching together separate microservices, vector stores, and evaluation scripts as requirements grow. By keeping the architecture unified, Swarm targets teams that want a production-grade binary at any stage of AI adoption without committing to a full agent framework from day one.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Klick.tools Launches No-Signup QR Code and URL Shortener Platform with Open API

A developer has launched klick.tools, a free web utility platform offering a QR code generator and URL shortener that requires no account creation or email verification. The QR tool supports seven content types, custom styling, and WCAG contrast checking, with all rendering done client-side so no data leaves the user's device. The URL shortener allows link creation in seconds, tracks click statistics, and lets users update destination URLs without reprinting materials. A REST API backs both tools, enabling anonymous use with IP-based rate limiting or authenticated use via API key for higher quotas and full link management. The platform is hosted in Germany, collects no IP logs, sets no tracking cookies, and was designed with GDPR compliance as a core requirement from the outset.

0 comments Read more at DEV Community