Why Two Security Scanners Give Your Site Opposite Grades — And How to Investigate

·2 views

Security header scanners can return conflicting grades for the same website because they may be evaluating different URLs, HTTP status codes, or redirect responses rather than the actual page visitors see. Differences in how scanners parse header values — such as where 'unsafe-inline' appears in a Content Security Policy — can also lead to contradictory results. Headers like Content-Security-Policy-Report-Only do not enforce any restrictions, so a scanner detecting the header name alone may award undeserved credit. Developers are advised to manually inspect the full response chain using curl before making server configuration changes based on a single scanner's output. Analyst work on the IsSiteSafe project highlighted how failed fetches and error responses are often misclassified, further skewing automated security assessments.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Horizontal vs Vertical Scaling: When to Use Which for Growing Apps

As applications grow to serve millions of concurrent users, a single server often struggles with load, crashes, and data inconsistencies, making scaling essential. Vertical scaling solves this by upgrading a single machine's CPU, memory, and storage, but hits a hard limit and creates a single point of failure. Horizontal scaling adds more machines and uses a load balancer to distribute traffic, theoretically allowing unlimited growth and better fault tolerance. However, horizontal scaling requires applications to be stateless, as session-based authentication can break when requests are routed to different servers. A common fix is to store sessions in a shared external database like Redis, which also supports automatic session expiration via its TTL feature.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Small Teams Can Build a Minimal AI Agent Training Dojo on a Weekend

A five-part series on building AI agent training environments concludes with a practical guide aimed at small teams with limited budgets and no GPU infrastructure. The author outlines four core components of a minimal dojo: a task set drawn from real team work, an automated checker, a lesson log, and a defined practice cycle. Using content writing as a concrete example, the guide shows how mechanical checks such as verifying citations and paragraph length can be scripted, while subjective quality judgments still require human review. Teams are advised to run weekly one-hour practice rounds, comparing each cycle's results against the previous to track incremental improvement. The author cautions that this approach is not suitable for every team, particularly those whose tasks change too frequently or whose work carries high stakes requiring mandatory human sign-off.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds and ships MarkdownStack, a self-made markdown notes and publishing app

A software developer has launched MarkdownStack, a personal side project built to solve frustrations with existing note-taking and publishing tools. The app offers a private markdown workspace with nested folders, wiki-style note linking, hashtag organization, and a quick search switcher. Users can publish notes or entire folders to public URLs with a single click, allowing readers to comment and upvote without needing an account. An AI assistant feature lets users generate and save markdown notes directly to their vault using their own API key. The app is built on React and FastAPI with PostgreSQL full-text search, deployed on AWS via Docker Compose and GitHub Actions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a Simple Kotlin Validator Prevents Silent Data Corruption in Distance Tracking

A software engineering team discovered that five distance metrics in their tracking system — original, cleaned, mock, abnormal, and spike — had no code-level checks ensuring their mathematical relationships held true. To fix this, they built an 80-line Kotlin validator that enforces key invariants, such as cleaned distance equaling original minus mock and abnormal, while deliberately excluding spike to avoid double-counting. The validator uses a 0.1-metre floating-point tolerance to avoid false failures and separates hard errors, which block data submission, from warnings that flag unusual ratios without stopping the pipeline. Ratio-based warnings catch a different class of problem: cases where all numbers are internally consistent but a classification filter is quietly discarding large portions of a genuine journey. The team argues that asserting system invariants explicitly in code is far cheaper than discovering silent data corruption weeks later through customer support complaints.

0 comments Read more at DEV Community