Sentinel-IR Playground Beta Brings Browser-Based Structural Code Analysis, Including on Phones

·1 views

Sentinel-IR Playground is a beta browser interface for the Sentinel-IR 0.3.1 tool, letting users paste or select code and get structural analysis without installing software. It supports JavaScript, TypeScript, TSX and Python, and reports risk levels, security signals, imports, routes, operations and a compact representation for AI agents. The analysis runs locally in the browser via WebAssembly, so code is parsed rather than executed and is not uploaded to any server. The project was built largely so the author could use it from a phone without a development environment, and its design avoids requiring an AI model or API key. The developer notes this is an architectural claim supported by tests, not a guarantee against every possible browser or device compromise.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Check Agent Config Files in Cloned Repos Before Opening Them With Claude Code or Codex

A developer guide warns that cloned repositories can contain configuration files that alter how AI coding agents such as Claude Code, Codex, and Gemini CLI behave. Files like .claude/settings.json, .mcp.json, and .gemini/settings.json can define shell-command hooks, MCP servers, and helper commands that run on the user's machine. The article notes that each agent applies its trust checks differently, and in some cases, such as non-interactive mode, those prompts are skipped entirely. It recommends inspecting these files with tools like git grep and jq before launching an agent in an unfamiliar project. The guide also outlines specific flags and settings that can limit what project-level configuration is allowed to run.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

LiteLLM 1.107.0 cleanup: what a stable security baseline should verify

A host-level cleanup can look finished while an exposed service, cached artifact, or stale credential remains active. LiteLLM's incident guidance calls for removing compromised artifacts from registries, rebuilding affected environments, rotating credentials, and confirming old releases cannot return through caches. External scans, such as ZoomEye queries on the LiteLLM title and default port 4000, show where services are visible, while internal records show which deployments exist, their owners, and the artifacts they run. The two views should be joined at the level of owned assets rather than summed, since one host or owner can appear across several queries. Closure requires verified ownership, confirmation that the compromised release is absent, correct authentication and ingress settings, and, where the payload could have run, credential rotation and a persistence check. Evidence must be timestamped, since earlier clean scans or newly created keys do not by themselves prove the final state.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Identity verification timeouts should not be treated as approval or rejection

When an identity verification provider times out or its callback arrives late, the check has not completed, so the outcome is neither approval nor decline. The article warns against letting users through or rejecting them by default and recommends recording the technical failure separately from the decision. It describes a synthetic SQLite-based example in which a session has a deadline, late or unrecognised events are marked expired or unknown, and recovery occurs locally without polling a provider. In the hypothetical scenario, an expired session routes to human review or an authorized provider refresh rather than an automatic retry. The example is a dependency-free fixture and not a live provider integration.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Phone lookup APIs can inform signup steps but cannot prove number ownership

A phone lookup API answers only a narrow question about a number, not about the person entering it. The article argues that developers should decide which signup decisions a basic lookup result can support before integrating one. Rejecting users whenever a lookup is inconclusive, or treating a lookup as proof of ownership, are both presented as design errors. A synthetic four-branch example maps normal, unknown, provider failure and OTP outcomes to caller-owned next steps such as continuing signup, review, bounded retries or an existing OTP provider. The author notes that unknown and provider failure results both should avoid automatic rejection, since they signal different problems that call for different handling.

0 comments Read more at DEV Community