Security scanner finds critical flaws in 9 of 13 popular AI app starter repos

·2 views

A developer built a static analysis tool called vibecheck and ran it against 13 popular open-source AI app starter repositories on September 16, 2026, to identify common production-breaking security patterns. Only 4 of the 13 repos scanned clean, while the remaining 9 produced 101 findings, including 50 classified as critical. The most widespread issue, unauthenticated API routes, appeared in 6 repositories, followed by client-exposed secrets and unsafe HTML rendering, each found in 5 repos. The scanner is deterministic, requires no external dependencies, and ran on unmodified default branches of each repository. The author notes that none of the flagged issues are obscure vulnerabilities — they are routine oversights, such as deferred authentication and hardcoded credentials, that AI code generators tend to leave unaddressed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds Polish-keyword programming language, gains deep Ruby insights

A Ruby developer spent 18 months building AlexScript, a fully featured interpreted scripting language whose keywords are written in Polish, his first language. The project grew from a weekend experiment into a language with a standard library, async/await support, a debugger, and a self-hosted web framework. Building the interpreter revealed several Ruby performance nuances, including that Ruby's throw/catch is far more efficient than raise/rescue for non-local exits like function returns. The developer also discovered that scanning UTF-8 strings character by character causes accidentally quadratic performance, fixable by using getbyte and byteslice for O(1) byte access. A unified method dispatch table — rather than separate registries for native and user-defined methods — further simplified the interpreter's architecture and improved lookup efficiency.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Go developer builds linter to enforce file-level visibility in flat packages

A Go developer has released declscope, an open-source linter designed to enforce file-scoped access boundaries within Go's flat package structure. Go conventionally offers only two visibility levels — exported and unexported — with no native file-scope option, meaning any unexported symbol is accessible across all files in a package. The tool addresses a growing concern that AI coding agents, finding unexported helpers in scope, call or modify them freely since such cross-file conventions exist only as informal comments rather than compiler-enforced rules. The developer noted that even explicit instructions in AI configuration files failed to reliably prevent boundary violations, prompting a machine-checkable solution. declscope can be installed via standard Go tooling and flags violations when declarations are used outside their intended file scope, providing agents and reviewers with clear repair guidance.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agents Can Use Far More Energy Than Single Prompts, Researcher Finds

Climate scientist Zeke Hausfather analyzed the energy consumption of AI agentic workflows, finding they can use significantly more electricity than standard one-off chatbot prompts. Unlike a simple question-and-answer exchange, AI agents repeatedly re-process their entire accumulated context with each step — such as running commands, reading files, or calling tools — driving up computational costs. Hausfather estimated his own daily AI agent usage consumed between 1.2 and 5.9 kWh, with visible output accounting for just 0.4 percent of total tokens processed. The concern is not one user's consumption in isolation, but the aggregate energy demand when many users run agentic workflows simultaneously. While an exact global climate impact remains uncertain, the directional finding is clear: agentic AI systems can carry a substantially larger energy footprint than most users assume.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

ECC Agent Harness Runs in Cursor Without Context Bloat Using Modular Setup

Developer affaan-m released ECC v2.0, an agent harness that standardizes AI coding rules, skills, and MCP configurations across tools like Cursor, Claude Code, and Codex. A key challenge when using ECC inside Cursor is context bloat, where loading all instinct files and tool schemas at once rapidly consumes tokens and slows multi-turn sessions. The recommended fix is modular rule scoping — symlinking only language-specific rules relevant to the active workspace rather than loading the full ECC repository into the root prompt. MCP servers are added selectively via a project-level config file to further limit unnecessary context. Testing showed that routing Cursor through a prompt-caching gateway endpoint reduced multi-turn context costs by roughly 80–90% while preserving reasoning quality and chat history.

0 comments Read more at DEV Community