sql-guard TypeScript package validates AI-generated PostgreSQL via AST before execution

·1 views

Developer has released sql-guard, a TypeScript package designed to validate AI-generated PostgreSQL queries before they are executed by an application. The tool parses SQL into an abstract syntax tree (AST) and checks it against a developer-defined allowlist policy, catching issues that simple text pattern-matching cannot reliably detect. The package blocks unauthorized table access, disallows unrecognized function calls, and rejects multi-statement input by default, making its initial policy deliberately strict. It returns structured violation details and error codes, and offers an assertSafeSql() method that throws an error to halt execution on rejection. The package focuses solely on query structure validation and is not a substitute for parameterized queries, row-level security, or other database access controls.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

n8n Integrates Amazon Bedrock AgentCore for Managed AI Agent Workflows

n8n has spotlighted a verified community node that connects Amazon Bedrock AgentCore with its workflow automation platform. The integration, built by AWS, allows users to run production-grade AI agents within a managed runtime provisioned directly in their own AWS account. A demo support-triage workflow showcases four specialist agents sharing a common memory harness, enabling context to persist across turns and between agents without restarting each interaction. The node supports multiple AI model providers, isolated execution environments, and cloud tools such as a code interpreter and browser. It is compatible with both self-hosted and cloud versions of n8n, though AWS account setup including IAM configuration is required.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

6.8% of 1,049 AI-Built Apps Found Leaking Private Data Due to Disabled Security Setting

A security researcher scanned 1,049 publicly listed AI-built applications in 2026 and found that 71 of them, roughly 6.8%, had at least one database table containing real private data accessible without any login. The vulnerability stemmed from a known misconfiguration: Row Level Security left disabled on Supabase-backed apps that expose a public API key in the browser's JavaScript. Exposed data included account profiles, private messages, paid usage history, and in one case a master database key granting full read, write, and delete access. The researcher manually reviewed results to exclude 40 apps with intentionally public tables, such as leaderboards and blog posts, before notifying all 71 affected companies individually with details of the exposure and a free offer to help fix it. The findings align with earlier reports from Wiz, Forbes, and The Verge, which have consistently placed the misconfiguration rate among AI-built apps at between one in ten and one in fifteen.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Microsoft Entra lets organizations delegate AI agent consent without broad admin roles

Microsoft Entra supports a granular consent delegation model that moves beyond the traditional binary choice of full centralization or broad administrative roles. Organizations can define app consent policies specifying exact permission types, resources, and client applications, then bind those policies to custom directory roles. The key role action, microsoft.directory/servicePrincipals/managePermissionGrantsForAll.{id}, restricts a delegate's consent authority strictly to what the policy allows, rather than granting wide directory access. This approach is increasingly relevant as AI agents multiply, turning tenant-wide consent from an occasional setup task into a recurring control-plane operation. Using broad built-in roles like Application Administrator to clear consent queues expands authority without improving precision, whereas policy-bound delegation addresses both scale and control simultaneously.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Satirical Essay Mocks AI-Reliant Developers Who Never Read Their Own Code

A satirical piece published on DEV Community lampoons the growing trend of developers relying entirely on AI agents to write, review, and document code. The essay coins the term 'Real Programmers' for those who orchestrate AI tools using plain English prompts, contrasting them with 'Quiche Eaters' who still read and write code manually. It mocks practices like skipping permissions flags, approving pull requests in seconds, and regenerating code instead of debugging it. The piece also takes aim at self-referential AI workflows where agents both write and document code, eliminating human comprehension from the loop. While framed as humor, the essay reflects genuine industry debate over how much understanding developers should retain as AI-assisted coding becomes mainstream.

0 comments Read more at DEV Community