Unguarded AI API calls can silently drain budgets and trigger 504 errors in production

·1 views

An analysis of 1,662 public posts from app builders identified 215 verified failure cases, with AI model and API issues accounting for 4% of them. Six cases share a common pattern: outbound AI calls made with no timeout, no spending budget, and no fallback logic. Because failed calls cost almost nothing, monitoring dashboards show normal spend while users silently receive fallback responses or experience long hangs. Default OpenAI and Anthropic Node SDKs allow up to 10 minutes per attempt and retry up to twice, meaning a single hung request can stall for over 15 minutes before infrastructure layers like Vercel or Cloudflare terminate it with a 504 or 524 error. Developers are advised to set explicit timeouts and budget limits within their own code rather than relying on platform-level cutoffs.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why read-only access alone is not enough to secure an AI-powered HR assistant

Adding an AI assistant to an HR platform introduces permission challenges that go beyond simply restricting database writes. A read-only connection does not control which rows or columns a user can see, meaning even aggregate queries can inadvertently expose sensitive data like individual salaries. Effective access control must account for both the type of operation and its data scope, enforced at the application and data-access layer rather than through prompt instructions alone. The article uses WorkBento, a self-hosted Python HR platform, to illustrate how role-based permission matrices and workspace-scoped queries can address these risks. Developers are advised to validate access boundaries using sample accounts and test scenarios before deploying any AI assistant against real employee data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DocBento offers page-cited, self-hosted document AI with multi-OCR and access controls

DocBento is a commercial, self-hosted Python document management tool built by SourceBento that aims to address a core gap in document AI: tracing answers back to their source pages. The system processes documents through four OCR options — PaddleOCR, Tesseract, Docling, and a vision-model path — chosen based on input type such as scanned tables or handwritten text. Its search combines keyword and semantic methods, and any AI-generated answer includes page citations to help users verify claims directly against the original document. Access controls extend beyond the document interface to cover search results and AI-generated summaries, preventing restricted content from leaking through those channels. The AI assistant is optional, supports OpenAI-compatible endpoints, and the platform can function fully without an active AI provider.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

TrueNorth API offers Canadian sales tax calculation across all 13 provinces

A developer has launched TrueNorth API, a tool designed to calculate accurate Canadian sales tax for all 13 provinces and territories across 41 product categories. The API works in two steps: validating a customer's address to determine the province, then calculating the precise tax owed based on the product type and location. It accounts for complex regional rules such as Manitoba's children's clothing exemption, Ontario's prepared food rebate, Quebec's QST calculation method, and the federal luxury tax on high-value vehicles. The service is aimed at both Canadian and international sellers who need to correctly collect GST, HST, or PST at checkout. Pricing starts with a free tier of 10 calls per day, with paid plans beginning at $19 CAD per month for 10,000 calls.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

OKF Agent Memory gives coding agents persistent, git-native knowledge across sessions

OKF Agent Memory, an open-source tool released on September 5, 2026, aims to solve the problem of coding agents losing architectural context between sessions. The project stores an agent's knowledge as plain Markdown files with YAML frontmatter inside a repository's knowledge/ directory, making memory reviewable and version-controlled like any other source file. It ships as a single dependency-free Go binary featuring BM25 search with sub-300-microsecond lookups, requiring no vector database, embedding API, or external accounts. The tool exposes a stdio MCP server compatible with agents such as Claude Code, Cursor, and Codex, allowing them to query stored concepts directly. Version 0.4.4, released September 27, 2026, has already accumulated over 700 GitHub stars in under four weeks and topped weekly trending charts for AI agent repositories.

0 comments Read more at DEV Community