SchemaGate Library Fixes Security Gap in Text-to-SQL Agents for Oracle and Postgres

·1 views

A developer building text-to-SQL agents on Oracle and PostgreSQL identified a recurring security flaw in the order of operations, where table selection occurs before security checks are applied. The issue is not in custom code but in how these agents are architecturally designed to function. To address this, the developer released an open-source Python library called SchemaGate, installable via pip with no API key required and compatible with any SQLAlchemy-supported database. The tool enforces role-based access controls before schema exposure, using principal and catalog abstractions to gate table visibility. SchemaGate is publicly available on GitHub and documented at the developer's GitHub Pages site.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

OpenAI Logs 3.1 Agent-Workdays Per Human Workday, But Research Speed Lags Behind

OpenAI published an internal report on September 6, 2026, revealing that its research organization was running 3.1 agent-workdays of AI runtime for every single human workday by mid-August. Researchers were contributing code faster and conducting more experiments, with AI agents also taking over troubleshooting tasks that previously required support office hours. However, OpenAI cautioned that increased code output and experiment volume do not automatically translate into proportionally faster research progress. The report notes that research involves many interdependent stages — including decision-making, analysis, and safety review — and accelerating one stage often shifts the bottleneck elsewhere. The key takeaway for developers and freelancers is to identify which stage is actually limiting finished output, rather than simply maximizing AI usage.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Ditches Job Hunt to Spend a Year Building His Own Projects

A Bangladeshi software developer recently left his remote Unity job and completed a large freelance contract covering web, mobile, GPS, and real-time tracking features, only to find the client expected ongoing new development under a flat maintenance fee. Frustrated by an unsustainable arrangement and a discouraging experience on Upwork — where applications often go unanswered and each bid costs money — he began reconsidering his approach to work. Realizing he had savings of over 250,000 BDT and a solid skill set, he decided to stop waiting for someone to hire him and instead dedicate the next 12 months to building his own projects. His self-directed plan involves creating tools, open-source projects, games, and developer utilities without pressure to monetize every idea. One early output is DevJS, a Node.js utility that consolidates multiple development processes — such as backend, frontend, and Flutter — into a single terminal interface.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Solo Dev Ditches Discord and Google Drive for Zero-Cost Google Sites Portal

A solo developer shares how relying on a pinned Discord channel and shared Google Drive folder to distribute builds to playtesters quickly became unmanageable as their project grew toward a public release. Discord proved effective for small alpha groups but created onboarding friction, lacked discoverability, and felt unprofessional as a public-facing hub. After testing several distribution options including OneDrive and self-hosted SSH servers, the developer settled on the Google Drive API for file delivery due to its reliability and easy access control. With the distribution pipeline already tied to Google's ecosystem, Google Sites emerged as the logical zero-cost alternative to SaaS website builders that typically charge $15–$30 per month. However, the developer soon encountered limitations when attempting custom HTML embeds, as Google Sites sandboxes all third-party code inside restricted iframes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Auth.js Database Schema Explained: Four Core Tables and How They Work

Auth.js, formerly known as NextAuth, automatically creates four database tables when integrated into a project: users, accounts, sessions, and verification_tokens. The users and accounts tables share a one-to-one relationship, while a single user can be linked to multiple OAuth providers such as Google or GitHub. Sessions are generated on every sign-in and tied to individual users, supporting multiple simultaneous sessions across different devices. Verification tokens are short-lived, used for tasks like email verification, and are deleted automatically once expired. Developers can safely extend the users table with custom columns, as Auth.js ignores fields it does not recognize.

0 comments Read more at DEV Community