Whiteboard (YC W26) launches open-source IDE for human-AI software architecture

·1 views

A four-person team of former tech leads has released Whiteboard, an open-source desktop IDE designed to help developers and AI agents collaboratively design and review software. Built on top of CodeOSS, the app lets AI agents draw diagrams and traces on an in-canvas workspace, with direct links to the underlying code. Key features include a Rust-based semantic diff viewer, a decision log for tracking autonomous agent choices, and compatibility with tools like Claude Code and Codex. The app is already being used by engineers at companies such as Salesforce and Modal for reviewing architecture and spec-level changes. Released under an MIT license, the team plans to eventually offer a hosted web version with multiplayer reviews and trajectory storage while keeping the tool self-hostable.

Read the full story at Hacker News

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Unprotected MCP Servers Are a Security Risk for AI Agents

Model Context Protocol (MCP) has become a widely adopted standard for connecting AI agents to tools, APIs, and databases, but most MCP servers are deployed without authentication, authorization, rate limiting, or audit logging. Without a gateway layer, any agent that reaches an MCP server's port can invoke every available tool, making it impossible to track who called what or enforce per-tool permissions. Malicious content in an agent's context window can also trigger prompt injection attacks, manipulating the agent into taking unintended actions. Kong AI Gateway 2.0, available through Kong Konnect, addresses these gaps by introducing dedicated entities such as AI MCP Servers, AI Consumers, AI Auth Strategies, and AI Policies. The platform replaces older plugin-based approaches from Kong Gateway 3.x and provides declarative configuration to enforce authentication, tool-level authorization, rate limiting, and full audit trails for every AI agent interaction.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build an Accessible SaaS Pricing Page Using Native Radio Buttons

A best-practice guide for SaaS pricing pages recommends using native HTML radio buttons grouped inside a fieldset element, rather than custom div-based controls. Each pricing plan card acts as a label wrapping its radio input, allowing users to select a plan by clicking anywhere on the card while retaining full keyboard and assistive-technology support. Visual styling such as border changes and background highlights should complement — not replace — the underlying form behavior, ensuring the page works even if CSS or JavaScript fails. Plan cards should clearly display cost, billing period, target user, and key feature differences without hiding critical details in tooltips. Server-side validation of the submitted plan value is also advised, since browser input should always be treated as untrusted data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Security Review Flags Six Critical Upgrade Vulnerabilities in $5.7B SparkLend

A technical security assessment of SparkLend, a decentralized lending protocol with $5.7 billion in total value locked across Ethereum and multiple Layer 2 networks, has identified six critical vulnerabilities in its upgrade architecture. The review, dated September 24, 2026, was conducted by a senior DeFi security researcher examining proxy patterns, storage layouts, and governance pathways rather than the protocol's core lending logic. Among the most severe findings are storage-slot misalignments between Ethereum and L2 implementations that could silently corrupt user balances and collateral ratios during an upgrade. Auditors also flagged a governance bypass flaw in the UpgradeController that allows any address to execute proposals before the 48-hour timelock expires, potentially enabling immediate deployment of malicious code. The protocol received an overall risk score of 7 out of 10, with reviewers noting that while its core economic logic is sound, the upgrade surface poses a significant threat to a large portion of user funds.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Seven Workplace Strategies to Handle a Toxic Manager, Inspired by Schopenhauer

A software engineer writing for DEV Community draws on philosopher Arthur Schopenhauer's ideas about will and reason to outline seven behavioral rules for dealing with toxic managers. The author argues that logic alone fails against manipulative leadership because such managers operate on emotional scripts rather than rational debate. Three common toxic archetypes are identified — the Caregiver, the Victim, and the Inquisitor — each using distinct tactics to exploit or destabilize subordinates. Key strategies include withholding emotional reactions, guarding personal vulnerabilities, and allowing toxic leaders to expose themselves over time rather than confronting them directly. The framework reframes workplace survival not as conflict but as deliberate, low-visibility self-protection.

0 comments Read more at DEV Community