Read-Only Database Access Can Still Crash Your App if AI Workloads Go Unchecked

·1 views

A read-only Model Context Protocol (MCP) server connecting to PostgreSQL can still destabilize production systems despite lacking write permissions. Exploratory queries, wide aggregates, and concurrent retries compete with application traffic for the same CPU, memory, connections, and I/O resources. Experts warn that 'read-only' defines mutation rights, not workload safety, and AI-driven database traffic should be treated as a distinct workload class. Best practices include dedicated connection pools with hard limits, statement and row caps, replica routing with freshness contracts, and deadline propagation. Silently expanding the pool or falling back to the primary under load are considered unsafe responses; visible, bounded admission control is recommended instead.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

React useCookie Hook Turns Browser Cookies into Reactive Component State

A new hook called useCookie, available from the @reactuses/core library, allows React developers to manage browser cookies as reactive state rather than relying on the native document.cookie API. The native API requires manual string parsing, does not trigger re-renders, and can cause hydration mismatches during server-side rendering. With useCookie, components reading the same cookie key stay synchronized within a tab, and updates automatically propagate without extra boilerplate. The hook is built on the js-cookie library, meaning cookie attributes such as expiry, path, and SameSite are handled reliably through a structured options argument. Setting a value to undefined deletes the cookie, and passing a default value ensures the cookie is written on first render, making it immediately available to the server on subsequent requests.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Extension Blocks in C# 14 Are More Than New Syntax

Extension methods have been part of C# for years. Extension blocks finally make them feel like a small, organized API. Extension methods are one of those C# features that quietly end up everywhere. LINQ depends on them, library authors use them to improve APIs they do not control, and most production codebases eventually collect a few SomethingExtensions classes. The familiar syntax works, but it starts to feel awkward when several related operations target the same type: public static class DateOnlyExtensions { public static bool IsWeekend(this DateOnly date) => date.DayOfWeek is DayOfWeek.Sa

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Severity-Classifying Terraform Drift Alert Using AWS SNS, SQS, and Lambda

A developer overhauled a basic Terraform drift detection system after finding it only confirmed drift existed without identifying which resources changed or how critical the changes were. The updated pipeline uses CodeBuild to run terraform plan, extracts changed resource data via terraform show -json, and publishes a structured event through SNS. That event is simultaneously routed to an SQS queue for audit logging and a Lambda function that classifies each change as HIGH, MEDIUM, or LOW severity, with results stored in CloudWatch. To keep payloads lean, only the resource address, type, and action fields are extracted using jq, rather than publishing the full before-and-after plan. During testing, a region mismatch between the AWS CLI default and the queue's actual region caused a false NonExistentQueue error, resolved by explicitly specifying the correct region in the CLI command.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Engineers Find Security Flaws in App a Vietnamese CEO Said AI Built Cheaply

A Vietnamese CEO recently claimed that a $20/month Claude subscription had replaced his company's software developers, sparking widespread debate across social media. Curious engineers tracked down the application behind the viral post and began inspecting it using browser DevTools. They quickly uncovered serious security issues, including exposed credentials in frontend code, unprotected admin pages hidden only by CSS, and missing server-side authorization checks. The findings spread rapidly through Vietnamese tech communities, shifting the conversation from AI's code-writing ability to what separates functional software from production-ready systems. Commentators noted the flaws did not prove AI writes bad code, but rather highlighted that software engineering involves far more than generating working code.

0 comments Read more at DEV Community