Silent CI Bug: A Security Scanner Passed for Two Months While Scanning Nothing

·2 views

A software developer discovered that a secrets-scanning script was silently passing CI checks for two months because it was receiving file paths instead of directories, causing its glob pattern to match zero files. Since both a clean scan and an empty scan exit with code 0 and print 'PASS', the failure was completely indistinguishable from a genuine pass. The only honest signal — a log line reading 'files scanned: 0' — was overlooked repeatedly because the word 'PASS' appeared immediately after it. The developer fixed the issue by adding an explicit check that exits with a distinct error code when zero files are scanned, refusing to report success. The key lesson: any verification step that gates a release must print how many items it examined and treat a zero-match result as a hard failure, not a silent pass.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

The Hidden Cron Scheduling Bugs That Catch Even Experienced Developers

Cron jobs, used to automate backend tasks like backups and health checks, follow a simple five-field syntax but hide subtle bugs that stem from differing implementations across platforms. A common production mistake involves combining day-of-month and day-of-week restrictions: in standard Unix cron, the expression '0 0 1 * 1' runs on both the 1st of every month and every Monday, not just Mondays that fall on the 1st. Extended syntax features like L, W, and # are supported in modern schedulers such as Quartz and Kubernetes but are silently ignored or treated as errors in classic Unix cron, causing jobs to never run without any warning. Cloud platforms including AWS EventBridge and GitHub Actions default to UTC, meaning a job scheduled for 9 AM may fire at an unintended local time for users in other time zones. Developers are advised to verify the target scheduler's syntax rules, timezone defaults, and day-field logic before deploying any cron expression.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

New tool countfn measures algorithm complexity by counting operations, not time

A developer has released countfn, available on both PyPI and npm, which measures algorithmic complexity by counting operations such as reads, writes, and calls rather than relying on elapsed execution time. Unlike existing tools such as big-O and big-o-calculator, countfn can return an 'UNDETERMINED' result instead of forcing a potentially incorrect complexity classification. Because operation counts are deterministic and noise-free, the tool avoids the statistical uncertainty inherent in timing-based measurements. The library also guarantees cross-language parity, meaning the same algorithm with the same seed produces identical operation counts in both Python and JavaScript. When complexity cannot be confidently identified — such as when two classes are too close to distinguish — countfn explicitly refuses to name one rather than guessing.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Make vs Zapier for Freelancers: How to Choose the Right Automation Tool

Freelancers in 2026 broadly have two leading automation platforms to choose from — Zapier and Make — each suited to different working styles and needs. Zapier is recommended for those who want quick, straightforward setups with a guided experience and a large template library, while Make better serves users who need branching logic, bulk operations, and more cost-efficient handling of complex, high-volume workflows. Both platforms support thousands of app integrations and now include AI steps capable of summarizing or drafting text mid-flow. Pricing models differ significantly: Zapier charges per task and costs can rise quickly with multi-step automations, whereas Make's operations-based billing often proves cheaper for data-heavy or frequent workflows. Experts suggest freelancers prototype in Zapier for speed, then migrate demanding pipelines to Make once volume and complexity justify the switch.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

docs-governance Helps Preserve Project Context Across AI Coding Agent Sessions

A developer has released docs-governance, an MIT-licensed open-source tool designed to retain project decision context across AI coding-agent sessions in Claude Code and Codex. The tool uses a set of small, purpose-specific Markdown files — covering project rules, navigation notes, current status, and change logs — to give each new session structured context without overloading a single instruction file. It also includes reusable skills, templates, and audit scripts, with support for larger projects needing architecture documents and decision records. The project is available on GitHub with installation instructions for both Claude Code and Codex. The developer is seeking community feedback on whether the audit tooling surfaces useful issues and whether maintaining the files remains practical in real-world projects.

0 comments Read more at DEV Community