Security Audit Finds Most Public AI SDK Repos Omit Token Limits

·7 views

A developer conducted a security audit of 14 public AI SDK repositories, analyzing 20,004 source files. The audit found that 12 of the 14 repositories contained code that called AI generation functions without setting a maximum token output limit. This omission, present in 103 of 116 relevant files, represents a potential security vulnerability by allowing unbounded resource consumption. The findings include projects from the SDK vendor's own repositories, where minimal example code is often copied into production. The author concludes the lack of token ceilings is a common pattern in the SDK's ecosystem.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Marketplace proposes soft-flag system for vehicle listing brand mismatches

Online marketplaces often compare a seller's manually entered vehicle brand with the official brand decoded from the vehicle's VIN. A direct mismatch can trigger automatic seller bans, which risks penalizing honest errors while missing sophisticated fraud. A proposed technical solution introduces a graduated flagging system that scores mismatches for review instead of enacting immediate bans. This approach aims to reduce false positives from typos or naming variations while still highlighting potential inconsistencies. The system is designed as a trust signal, not definitive proof of fraud, and should be combined with other verification checks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Nemotron 3 Ultra Leads HY3 in Benchmarked LLM Recruitment Task Evaluation

A recent benchmark evaluation compared the performance of two large language models on a recruitment agent task called Team Recruitment (Oracle). Nemotron 3 Ultra achieved an overall score of 90.87, outperforming HY3, which scored 83.1. The benchmark's methodology ensures comparability by using identical prompts, a fixed scoring judge, and detailed per-axis rubrics. Key scoring criteria included binary gates for budget and seat limits, as well as role coverage and skill match. The full results and model outputs are publicly available for audit, revealing Nemotron's advantage in critical constraint compliance areas.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Supabase RLS policy flaws can expose user data without triggering errors

An article from DEV Community explains that Supabase authentication and Row Level Security policies must work together to properly secure data. Authentication identifies users, while RLS policies control data access, but broken policies fail silently by returning empty results instead of errors. Common vulnerabilities include forgetting to enable RLS, incorrect policy logic, trusting editable user metadata, and security-invoker views. The author recommends implementing integration tests that verify separate users cannot access each other's data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Faster YouTube Scraper by Reverse-Engineering Internal API

A developer built a tool that scrapes YouTube data by reverse-engineering its internal InnerTube API. The official YouTube Data API has strict quotas and registration, while browser automation is slow and resource-heavy. The new method sends HTTP requests directly to YouTube's undocumented data endpoint. It dramatically improves speed and reduces resource usage compared to traditional methods. The developer created a Python library called ytscrape to implement this approach.

0 comments Read more at DEV Community