Why .env.example Files Go Stale and How Schema-Based Tools Fix It

·4 views

The .env.example file is a common developer convention for documenting required environment variables, but it has no built-in mechanism to stay in sync with the codebase that depends on it. When a developer adds a new variable like STRIPE_WEBHOOK_SECRET, nothing in the workflow enforces an update to the template, so it silently drifts over time. New team members who clone the repo and copy the file often end up with incomplete configurations, causing runtime crashes. Approaches like manual code review checklists or custom diff scripts offer partial relief but cannot detect variables missing from both files or validate value formats. A schema-based approach, as implemented by tools like EnvShield using an env.schema.toml file, generates and validates .env.example automatically, catching drift at commit time rather than after the fact.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Critical miniOrange SAML SSO flaws let attackers hijack WordPress admin accounts

Two critical authentication bypass vulnerabilities, tracked as CVE-2026-61979 and CVE-2026-15981, have been discovered in the miniOrange SAML 2.0 Single Sign On plugin across seven WordPress editions. The flaws allow attackers to forge SAML responses and obtain valid WordPress administrator session cookies without needing a password, MFA, or access to identity provider credentials. The first vulnerability exploits algorithm confusion by using the RSA public key as an HMAC secret, while the second abuses PHP's openssl_verify() returning -1 on error, which the plugin incorrectly treats as a successful verification. Real-world exploitation was detected by DigitalOcean, where an external actor obtained an admin session cookie, though further damage was prevented by network-level restrictions on the WordPress admin panel. Opportunistic scans targeting miniOrange SSO endpoints have been observed from multiple IP regions, indicating widespread, indiscriminate attack attempts.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Calix GS7 Router Flaw Lets Attackers Expose Home Devices via Unauthenticated UPnP

A high-severity vulnerability, tracked as CVE-2026-75501, has been disclosed by CERT/CC affecting the Calix GS7 XGS GS5239XG residential router running EXOS 6.6.47. The flaw stems from MiniUPnPd 2.3.7 exposing UPnP controls on WAN-side TCP port 5000 without any authentication, a service normally restricted to local networks. Remote attackers can send unauthenticated SOAP requests to create persistent port forwarding rules, effectively bypassing NAT and firewall protections to reach internal cameras, NAS devices, and IoT equipment. Critically, forwarding rules set with a zero-second lease duration survive router reboots, meaning exposure persists without user awareness or notification. No active exploitation has been reported yet, and users are advised to disable UPnP on affected devices as no patch has been issued.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Maintaining a Government Custom GPT Demands More Skill Than Building It

A custom GPT built for a government ministry training program may appear complete once the training session ends, but real challenges emerge months into actual use. As procedures are revised, terminology shifts, and departments are reorganized, the tool's knowledge base quietly drifts out of sync with current reality. Unlike outright failures, this degradation is hard to detect because the system continues responding confidently even when its information is outdated. Maintenance requires periodically auditing the existing knowledge base against live source material — a more delicate task than the original build, since it must identify what has become inaccurate without disrupting what remains correct. Yet this ongoing work rarely receives the same resources or attention as initial development, as it lacks the visibility of a concrete deliverable.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Security Risks of Using Free Remote Servers for AI Coding Agents

A developer recently ran a coding agent on a free remote server, accidentally exposing a staging database password and personal git credentials in the run directory without realising it. The incident highlights a broader security gap: most agent workflows treat the boundary between a local machine and a remote host as if it does not exist. Free servers are typically shared, monitored, and eventually recycled, meaning users have no control over who accesses logs or how long data persists. Common mistakes include passing environment variables explicitly into run logs, reusing personal git identities for agent commits, and overlooking temporary files that may contain sensitive configuration. Security experts recommend building a minimal, isolated environment for each remote agent run — using tools like env -i to restrict what variables the agent can access — and relying only on short-lived, scoped credentials rather than production keys.

0 comments Read more at DEV Community