Volunteer Peer Reviewer Uncovers 11 Real Bugs in MarketNow's Payment and Audit Systems

·1 views

Developer rushabdev conducted a pro bono peer review of MarketNow, a pre-revenue agent commerce platform, focusing on its USDC payment system and Sentinel audit pipeline. The review produced 11 verified findings, including one high-severity issue where the README falsely claimed a '10/10' security score without supporting evidence from completed audit stages. The high-severity finding was patched within 24 hours, while five payment-related bugs have been queued for active fixes and six Sentinel issues will inform the next version of the static analyzer. MarketNow founder Edison Flores publicly credited rushabdev on the platform's /trust page, framing transparent treatment of security reviewers as core to the product's identity. The codebase remains open for community review on GitHub, with no bounties offered but a commitment to reproduce, track, and credit every finding submitted.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How a Timezone Bug Silently Corrupted Daily Sales Reports in Production

A software developer discovered that daily sales reports for stores in Lagos and London were consistently showing zero sales for the final two hours of each day due to a timezone handling bug. The root cause was that UTC midnight was used as the day boundary for all stores, incorrectly assigning late-night orders to the wrong calendar day for locations east of GMT. The bug only surfaced in production — not in development — because retried Celery tasks passed already timezone-aware datetime objects to a pytz localize() call that expects naive datetimes, triggering a ValueError. The fix involved adding a per-store IANA timezone field and a helper function that converts each store's local day boundaries into a UTC range before filtering orders. The author notes the underlying risk persists even in modern Django using zoneinfo, warning that passing aware datetimes into functions expecting local midnight bounds can silently return wrong data without proper input guards.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI Safety Frameworks Are Now a Business Necessity, Not an Option

As AI systems take on higher-stakes decisions, companies without proper safety frameworks are increasingly exposed to regulatory fines, reputational harm, and customer backlash. Experts recommend aligning AI goals with human values, making automated decisions explainable, and requiring human approval for critical actions. Common failure modes include proxy bias, distribution shift, and goal misalignment — each capable of causing significant unintended harm. Developers are advised to define clear ethical red lines, test systems adversarially, and monitor production environments continuously. Beyond ethics, robust AI safety practices are framed as financially prudent, helping organizations avoid penalties that can exceed $100 million.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Ownership Mindset Is a Slogan Managers Praise Until Engineers Actually Use It

A software engineer argues that organizations routinely demand an 'ownership mindset' from engineers but penalize the critical thinking that mindset requires. When engineers raise concrete concerns about architecture, data models, or failure modes, they are often labeled difficult or obstructive rather than praised for due diligence. The author attributes this contradiction to misaligned incentives: managers feel the cost of delays immediately but rarely bear the consequences of technical failures that emerge later. Compliant engineers who simply build what is asked provide the illusion of progress while quietly transferring liability when things break. The piece concludes that genuine ownership means voicing concerns early and with clear reasoning, and that organizations which punish such behavior will eventually train their teams into silence.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Azure Logic Apps Standard: Using Access Policies to Secure Shared API Connections

Enterprise integration platforms built on Azure Logic Apps Standard often require multiple Logic Apps within the same resource group to share managed API connections, such as Office 365 or SFTP connectors. Provisioning separate connections for each Logic App increases maintenance overhead, while unrestricted sharing poses security risks. Microsoft's recommended solution combines API Connection Access Policies with Managed Identity, allowing each shared connection to be provisioned once while controlling which Logic App can authenticate to it at the ARM level. Each Logic App is assigned its own system-assigned Managed Identity, and access policies are attached as child resources to specific connections, ensuring that only authorised Logic Apps can use them at runtime. Connections are deployed idempotently via Bicep as a shared infrastructure step, decoupled from individual Logic App deployments.

0 comments Read more at DEV Community