Tutorial Shows Python Method to Track New SAM.gov Contract Opportunities Without an API Key

·11 views

A tutorial explains how companies selling to the US federal government can automatically monitor SAM.gov for new solicitations, sources-sought notices, and presolicitations. It describes using a hosted scraper on Apify, which requires an Apify account and API token but no SAM.gov account or key. The author provides a roughly 30-line Python script that pulls open IT-services opportunities by NAICS code and exports them to a CSV sorted by response deadline, including links to attached documents. The post notes that the synchronous Apify endpoint suits short runs, since runs over 300 seconds return an HTTP 408 error. In the author's test run on November 12, 2026, the script saved 48 open opportunities in about 20 seconds.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

CVE-2026-58115: Unauthenticated Node-RED Admin API Enables Full Takeover of Siemens Industrial Gateway

A critical vulnerability, CVE-2026-58115 with a CVSS score of 10.0, affects Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED before version V4.3.4.1. Node-RED's editor and Admin API lack authentication by default, and on the affected product this setting was left off, letting a remote attacker deploy flows that execute arbitrary commands with maximum privileges. The flaw stems from a missing authorization boundary rather than a code bug, and the attack relies only on built-in inject and exec nodes, which makes it hard to distinguish from normal automation. Siemens disclosed the issue on August 11, 2026, and researchers at VulnCheck recorded a live exploitation attempt on October 30, 2026, three days after publishing a detection signature. Siemens recommends upgrading to Industrial OS V4.3.4.1 or later.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

ByteStash API Keys Stayed Valid After Account Deactivation (CVE-2026-126658)

A flaw in ByteStash versions 1.5.10 through 1.6.2 lets API keys keep working after the owning account has been deactivated. The API-key validation path does not verify whether the account is still active, so administrators who disable a user may believe access has ended when it has not. Any holder of a surviving key, including a former user, a compromised client, or an automation, could keep reading or modifying stored snippets, which may contain sensitive internal material. The recommended remedy is upgrading to version 1.6.2 and confirming that deactivated keys are rejected, along with auditing and rotating keys and reviewing logs for post-deactivation use. Organizations unable to upgrade immediately should restrict API and MCP access as a temporary measure, since this does not fix the underlying account-status check.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Building a Podcast Intro Generator with ElevenLabs Text-to-Speech

A DEV Community tutorial explains how to automate podcast intros using text-to-speech technology, since recording a new intro for every episode is time-consuming for solo creators. The proposed pipeline gathers the episode title and tagline, merges them into a script template, sends the text to the ElevenLabs API, and post-processes the audio with fades and loudness normalization. The author provides a Python wrapper that handles authentication, voice selection, and saving the returned audio as an MP3 file. The article also suggests cloning one's own voice in the ElevenLabs dashboard for consistent branding across episodes, and recommends using a templating tool such as Jinja2 to inject episode-specific details. The tutorial includes a referral link to ElevenLabs for obtaining an API key.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

What a SERP API Is and How Its Pricing Compares in 2026

A SERP API converts a search engine results page into structured JSON, returning fields such as position, title, URL, and snippet along with optional modules. The author notes it fetches live pages rather than crawling or indexing, so stored data cannot be re-fetched and parsers must adapt to layout changes. Responses include a status field, since an HTTP 200 can still carry a parse error, plus a request ID and the credits charged per call. Using price figures from a public comparison table checked in late October 2026, the article shows that at a $200 monthly budget, SerpBase, Serper, and SerpApi differ roughly 28-fold in how many searches they deliver. The author cautions that coverage varies between providers and that cheaper options may lack needed fields.

0 comments Read more at DEV Community