UnwrapTruth: Free Web App Scans Grocery Labels for Ultra-Processed Ingredients

·1 views

A developer has launched UnwrapTruth, a free, no-login web app that lets users scan supermarket product barcodes or ingredient labels directly from their mobile or desktop browser. The tool uses the NOVA 4 classification system to flag ultra-processed ingredients, artificial sweeteners, and chemical emulsifiers, and can detect over 30 disguised palm oil derivatives. It also applies the Nutri-Score 2024 algorithm to provide real-time nutritional breakdowns covering sugars, fats, sodium, fiber, and protein. A side-by-side comparison mode allows users to evaluate two products simultaneously, while a local pantry feature saves household staples without any user tracking. Built with Next.js, Tailwind CSS, the Open Food Facts database, and Google's Gemini API for label recognition, the app is hosted on Vercel and requires no app store download or account signup.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Build a Home Security Operations Center Using Free Open-Source Tools

A developer has published a guide detailing how to build an enterprise-grade Security Operations Center (SOC) on a home network using entirely open-source software. The core stack includes Suricata for signature-based intrusion detection, Zeek for comprehensive network activity logging, and Wazuh for endpoint monitoring and vulnerability scanning. ntopng provides real-time human-readable traffic analysis, while Elasticsearch serves as the central data layer for indexing and querying all collected security data. The guide emphasizes understanding each tool's role rather than blindly copying steps, arguing that architecture matters more than expensive hardware. It can be run on a standard laptop or desktop using VirtualBox, with an optional migration to Proxmox for always-on deployment.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

npm install Does Far More Than Download Files, Developers Should Know Why

Running npm install triggers a multi-step process that includes dependency resolution, lockfile processing, native builds, and potentially executing lifecycle scripts — not just downloading files. A single package installation can silently pull in dozens or hundreds of transitive dependencies that developers may never directly inspect. Packages can define postinstall scripts in their package.json, meaning code from your dependency chain can run automatically during installation. While lifecycle scripts are a legitimate npm feature used by many trusted packages, they represent a real security consideration in software supply chains. Understanding what npm install actually does helps developers make more informed decisions about the packages they trust and install.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build a Secure Node.js Password Reset Flow in 2026

A secure Node.js password reset system requires server-issued tokens, email delivery, separate confirmation, session revocation, and audit logging as distinct but coordinated steps. Skipping session revocation after a confirmed reset leaves stolen sessions active, meaning an attacker can continue accessing an account even after the legitimate user changes their password. OWASP recommends uniform responses for both known and unknown email addresses, single-use expiring tokens, and mandatory session invalidation post-reset. Audit logs should record stable event types — never raw tokens, passwords, or email links — and on-call alerts should trigger only when a confirmed reset lacks a corresponding session revocation record. Monitoring thresholds should be calibrated against actual event-delivery lag to avoid false positives while keeping the window short enough to catch live stolen sessions quickly.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Overly Broad S3 Upload Policies Open Buckets to Unauthorized Write Access

Security researchers have identified a recurring vulnerability pattern in Amazon S3 signed POST upload policies, documented across at least four HackerOne bug reports involving Shopify and BCM. The flaw occurs when developers use prefix-based key conditions — such as 'starts-with files/' — instead of binding each signed URL to a single, exact object key generated server-side. This broad scope allows any authenticated user to write to unintended paths within the bucket, potentially overwriting sensitive files or creating supply-chain implant points. The correct fix is to replace prefix conditions with exact-match key bindings, limiting each signed upload policy to one specific object. Security teams are advised to audit existing upload policies and enforce exact key matching to eliminate this class of misconfiguration.

0 comments Read more at DEV Community