UpstreamWitness: Open-Source Tool Tracks Whether Upstream Projects Adopted Your Fix

·5 views

A developer has released UpstreamWitness, an open-source evidence-tracking tool designed for security researchers, bug bounty workers, and open-source contributors. The tool monitors public upstream activity — such as commits, pull-request states, releases, and symbol changes — following a user's original submission date or PR. It classifies findings into four outcome tiers, from confirmed merges to no detectable signal, while explicitly noting that correlation does not constitute proof of attribution or payment. The tool operates strictly on public repository data, avoiding any handling of confidential vulnerability reports or private communications. Built on Python 3.11–3.13, the project is available on GitHub and its creator is seeking real-world public test cases to guide further development.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

MyZubster Adds Signed Wallet Verification for Off-Chain Marketplace Requests

MyZubster Marketplace has introduced a system allowing users to create marketplace requests verified by an EVM-compatible wallet using off-chain cryptographic signatures. The flow separates identity, intent, and payment — meaning a signed request is not a blockchain transaction and no funds are authorized at this stage. Users connect a browser wallet, sign a backend-generated challenge to prove ownership, and then sign a separate economic snapshot when submitting a marketplace request. Single-use challenge tokens are consumed atomically after verification to prevent replay attacks, ensuring a signature cannot be reused to generate multiple orders. The feature introduces defined wallet states and order statuses, though the team notes the complete end-to-end production flow is not yet finalized.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Pentest Bot Found Admin GitHub Token at $13B Startup Baseten in 25 Minutes

An autonomous penetration testing agent called Strix discovered a live GitHub admin token belonging to ML infrastructure firm Baseten during a pre-vendor security evaluation. The bot found a publicly accessible Harbor container registry on Baseten's domain, pulled a Docker image, and scanned its build history using TruffleHog. A GitHub personal access token had been embedded in a RUN instruction during a March 2023 image build and was never rotated, leaving it exposed in plaintext for over three years. The token granted full admin and push access to core product repositories and read/write access to private customer code, with no human involvement beyond the initial prompt. The root cause was a non-expiring, repo-scoped GitHub token on a bot account, compounded by a long-known Docker ARG secret-handling mistake that bakes credentials permanently into image build history.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Connect an Industrial Laser Distance Sensor to Raspberry Pi Using Python

A new tutorial on DEV Community walks developers through interfacing an industrial phase-shift laser distance sensor with a Raspberry Pi using Python. The guide focuses on the LDL-T series optical module, which offers millimeter-level accuracy over ranges up to 100 meters — far beyond what common ultrasonic or infrared sensors can reliably achieve. It covers hardware wiring, enabling the Pi's serial UART port, and installing the pyserial library to handle communication. The sensor communicates via HEX frame commands over serial, and the provided Python script triggers single-shot measurements, validates checksums, and converts the 4-byte response into a distance reading in meters. The tutorial also includes troubleshooting advice for common issues such as serial port permission errors and wiring mistakes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Separates AI Agent Task Execution from Its Own Success Verification

A software developer building a pre-release system called Ranex identified a structural flaw in AI agent pipelines: the same harness that performs a task often decides whether that task succeeded, creating a conflict of interest. To address this, the developer forked the opencode agent harness at a specific commit and locked its plugin surface to prevent unverified components from altering its behaviour. The redesigned architecture separates roles so the harness can only emit work and references, while an independent kernel cross-checks those outputs against its own append-only, hash-chained dispatch record. Completed work is logged as a CANDIDATE rather than a PASS, meaning no approval is granted by the worker that produced it. Final sign-off remains a manual, out-of-band human action to prevent automated self-approval from masking incomplete or incorrect results.

0 comments Read more at DEV Community