Python CLI Tool Scans Directories for World-Writable and Risky File Permissions

·1 views

A lightweight command-line tool called perm-audit has been developed in Python to help developers and security teams audit file permissions across directories. The tool uses only Python's standard library, requiring no additional installations, and can be dropped into any environment for immediate use. It detects world-writable and group-writable files, flags ownership mismatches, and displays octal permission codes in either summary or verbose mode. Common use cases include pre-deployment security checks, CI/CD pipeline gates that reject overly permissive files, and regulatory compliance documentation. The tool supports configurable directory depth and can be integrated into system PATH for repeated audits across web roots, shared folders, and build artifacts.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Playwright Browser-Mode Fix Stops Excluded Plugins Being Updated and Triggering False Alerts

A bug in a Playwright-based WordPress maintenance tool caused plugins marked as excluded from updates to be updated anyway during browser-mode runs, including as a residual pass after SSH-based updates. The root cause was a select-all checkbox approach on WordPress's update-core.php page that never consulted the excluded plugins list. Additionally, the post-update residual check incorrectly flagged intentionally skipped plugins as pending updates, generating misleading warning emails. The fix introduces per-checkbox evaluation that extracts each plugin's slug and skips it if found in the exclusion list, mirroring the filtering already applied via WP-CLI on SSH-capable sites. A separate residual-state function was also updated so that only excluded plugins remaining on the update page no longer trigger a warning.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Run Multiple Python Bots on One Railway Service Using StayPresent

Developers running multiple related Python bots on Railway typically deploy each as a separate service, doubling hosting costs and configuration overhead. A tutorial published on DEV Community demonstrates how to consolidate two or more bots — such as a Telegram and a Discord bot — into a single Railway container using a Python library called StayPresent. The setup requires a central entry point file that launches each bot as an independently monitored subprocess, meaning a crash in one bot does not affect the others. StayPresent also handles Railway's HTTP port requirement and exposes a status endpoint showing uptime and restart counts for each bot. The approach is described as compatible with other PaaS platforms like Render and Koyeb as well.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Keep a Discord Bot Running on Render's Free Tier Using StayPresent

Discord bots deployed on Render's free tier frequently go offline because Render's health checker expects an HTTP response on an open port, which a standard discord.py bot never provides. Without a responding port, Render marks the service as unhealthy and repeatedly restarts or spins it down. The fix involves installing the StayPresent library, creating a new entry point file that binds to Render's assigned PORT environment variable and serves a basic health response, then updating the start command in Render's service settings. An optional self-ping feature can also be configured to prevent the service from sleeping due to inactivity on Render's free tier. The bot's core Discord logic requires no changes — only the entry point Render uses to launch the application is new.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

StayPresent Offers Crash Recovery and Status Pages for Bots at No Cost

StayPresent is an open-source Python library that provides crash recovery, hang detection, and status page generation for bot developers, released under the permissive MIT License. Unlike many free developer tools, it operates entirely within a user's own deployment with no external servers, API keys, or third-party services involved. Because there is no hosted infrastructure on the vendor's side, there is no ongoing cost that would create pressure to introduce paid tiers or feature restrictions. The tool is available via pip and carries no account requirements, usage limits, or hidden upgrades. Developers trade the convenience of a managed external service for full control over their own monitoring data and infrastructure.

0 comments Read more at DEV Community