TrueNorth open-source tool flags wrong figures before forms are submitted

·5 views

A developer built TrueNorth, an open-source verification engine that checks whether a value is plausible in context and matches its supporting document. The idea followed an April 2024 incident in which a Citigroup employee entered an $81 trillion payment instead of $280, caught only after about 90 minutes. The tool runs as a Next.js web workspace for reviewing documents and as a Chromium extension that holds back suspicious values in live forms. Verification combines deterministic rules, statistical outlier checks, and Gemma 4 reasoning for cross-field validity, with human review retaining final approval. The project was built in one day at Hacktoberfest '26 at NIC Faisalabad, where it won first place, Best Open-Source AI Project, and a special Best Use of Gemma 4 award.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Vercel's Agent Desktop Lets AI Agents Operate Native Apps Without Hijacking the Cursor

Vercel Labs has released Agent Desktop, an open-source framework that lets AI agents control native applications on Mac, Windows, and Linux. Instead of relying on screenshot-based vision, the tool reads operating system accessibility APIs and structured UI trees to identify buttons, menus, and text fields. This allows several agents to run in the background on tasks like notes, calendar reminders, or log parsing without taking over the user's mouse. The article also cites demonstrations in which an agent corrected faulty song metadata and played the right track on Spotify. The piece presents these developments as a shift from AI that answers questions toward AI that takes action.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Shared Data Definitions Come First in CTV Campaign Measurement

Measurement for connected TV campaigns depends on agreed definitions of events before dashboards are built, since a technically accurate report can still answer the wrong question. The article argues that developers, media operators and sales teams should align on what each event means, where it originates and how it links to business outcomes. It separates the observed action, such as a button click, from business qualification, such as a valid lead, and recommends documenting triggers, sources, timestamps, owners and exclusions for each event. It also advises testing failure states like validation errors and page refreshes, and keeping media delivery records distinct from CRM progression, joining them only where evidence supports it. The illustrative schema is presented as a discussion aid rather than a production design, since available platform data varies.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

UET Taxila 2025 Cycle II Closing Merit Rose 5 to 19 Points Above 2024 Cycle I

Open-merit closing scores for UET Taxila's 2025 Cycle II ran 5 to 19 points higher than the 2024 Cycle I figures across programs, according to a comparison of the university's portal tables. The gap is partly due to comparing different years, since no 2025 Cycle I table has been published. Cycle II opened after the second entry test in late June 2025 to fill seats left vacant by Cycle I, and a smaller seat pool with a new group of test-takers pushed the closing aggregate up. The analysis notes that prospectus closing merit figures are calculated differently from portal figures, so applicants should check which source a number came from. Official closing merit data should be confirmed directly on the university's admissions website.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer finds invite gate bypass via database access in FastPass build log

The author of FastPass, a paid inbox product, had secured their invite-only gate on the server after earlier moving it out of the browser. Reader feedback prompted a check of the database layer, which Supabase exposes directly to the browser through PostgREST and governs with Row Level Security. Testing confirmed that RLS allowed clients to write a value the gate relied on, meaning the gate could be bypassed. To avoid touching production data, the author rebuilt the schema from read-only catalog queries into a disposable Postgres instance and verified it matched production using a policy hash. They then ran 70 probes as anonymous, logged-in, and service-role callers, each inside a rolled-back savepoint, and the first run exposed several classes of problems.

0 comments Read more at DEV Community