SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Vibe-coded apps leave security gaps that expose user data, researchers find

0
·2 views

Security researchers scanned large numbers of AI-built apps that use Supabase and found widespread flaws, with 98% of 1,072 apps in one June 2026 scan containing at least one issue. UpGuard separately reported in September 2026 that over 16,000 Supabase databases had tables readable from the public internet without sign-in. The article attributes these problems to AI builders prioritising working features over security, leaving tables without Row Level Security, exposing secret keys in browser code, and writing inverted authentication checks. It recommends a checklist for developers, including enabling RLS on every table, restricting policies to signed-in users' own rows, and keeping service_role keys off the front end.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Small nursing trial reports ChatGPT knowledge gain at six weeks, but its power to detect it is questioned

A pilot randomized trial with 32 undergraduate nursing students compared a ChatGPT-integrated teaching arm against a control on endotracheal suctioning knowledge. Scores were measured before, immediately after, and six weeks later, with the between-group difference reaching significance only at six weeks (p = 0.044). A reanalysis argues the design could reliably detect only much larger effects than the roughly 10-point gap reported. The authors' table header is also ambiguous about whether its intervals are interquartile or min-max ranges, which affects the estimated spread of scores. The trial was registered retrospectively, a point the paper itself acknowledges. The critique relies on the published figures and a power calculation rather than on new data collection.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Reviewing Pull Requests Using Git Diff and Surrounding Code Context

A guide recommends beginning a code review with the local git diff and then examining definitions, callers, and imports around each change rather than judging lines in isolation. It explains that a desktop tool opens the project structure first, then displays files in source, full comparison, or changes-only views with highlighted edits. The approach ties every finding to reproducible evidence, including static checks, tests, and schema drift, and treats model-only claims as hypotheses until verified. The article cautions that static analysis can miss dynamic loading, framework entry points, and external consumers, so unreferenced files are not automatically safe to delete. It suggests reviewing the changes-only view first, then heavily referenced files and their callers to gauge the blast radius before judging individual lines.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Microsoft's AI Frontiers research group disbanded as co-founder John Langford departs

Microsoft's AI Frontiers research group, which built the AutoGen agent framework and the Fara computer-use agent, has been dissolved. Co-founder John Langford announced his departure on November 6 and said the group's roughly 50 members were merged into Microsoft AI in early September. Langford attributed the split to a clash between a research-driven culture and Microsoft AI's focus on scaling larger models and training. The group also produced model research such as the Full Bandwidth Transformer, and AutoGen has already stopped receiving support from Microsoft. Developers relying on these tools are being advised to plan for their own maintenance and to avoid dependence on a single model provider.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Background AI agents stalled silently for hours with no errors, prompting new safeguards

A developer reports that two background agents each hung on a single shell command for roughly two and a half hours without raising an error or sending a completion notice. The stalls were caused by commands such as a permission-gated delete chain and a sleep-based wait loop, which block indefinitely instead of failing. To prevent this, the developer now bans sleep, until and while wait loops, and recursive force-delete commands in build briefs, and requires long jobs to run with timeouts or completion notifications. If an agent is quiet for about 30 minutes, the developer checks timestamps in its output and file modification times, and relaunches it from a progress file if both are stale. The approach depends on agents recording progress in a file from the start of each task.

0 comments Read more at DEV Community