SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Nearly 15,000 Kubernetes Dashboards Found Publicly Exposed on the Internet

A ZoomEye search using the query title="Kubernetes Dashboard" returned 14,913 matches on September 23, 2026, revealing thousands of Kubernetes administrative interfaces reachable from the public internet. Unlike standard web applications, these dashboards are designed to manage workloads and can allow users to list pods, read secrets, and execute commands inside containers, making unintended exposure particularly risky. Such exposures often occur accidentally through misconfigurations like changing a service type to LoadBalancer or setting up an incorrect ingress rule. Security researchers note that even a single exposed dashboard with weak access controls can pose greater risk than thousands of exposed static websites. Recommended mitigations include treating management interfaces as internal-only by default, enforcing VPN or authenticated proxy access, disabling skip-login options, and using external scanning tools to audit your own address space for inadvertent exposure.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why AI Coding Agents Lose Track Mid-Task and What One Tool Aims to Do About It

AI coding agents often appear to "forget" progress during long debugging sessions, but the root cause may be context pollution rather than model capability limits. As agents accumulate logs, stack traces, old errors, and completed investigation steps, the context window fills with outdated and irrelevant information. Even large context windows do not solve the problem if the content inside them is too noisy to be actionable. A developer has built an experimental tool called Tokenectomy that preprocesses environment output before passing it to the agent, filtering out noise while preserving relevant state. The goal is not to improve the underlying model but to ensure the information the agent receives is cleaner, more focused, and better suited to the current task.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Audit of 110 AI billing tools uncovers 45+ bugs, including 99% usage under-reporting

A month-long audit of 110 open-source AI tools used for token counting, cost tracking, and budget enforcement uncovered more than 45 verified bugs across five recurring categories. The most critical finding, independently confirmed by an external auditor, revealed a cache-accounting flaw that under-reported actual usage by roughly 99% on affected code paths. Common issues included stale pricing tables, incorrect cache-read multipliers applied across providers, retry double-counting in stream aggregation, and quota window boundary errors. So far, 23 fixes have been merged into upstream projects, including widely used tools like Langfuse and Codeburn. A separate check of 20 commercial AI vendors found that none published any formal process for disputing or correcting metering errors.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

New tool aims to make AI agent binary decisions testable and auditable

A developer has identified a core reliability problem in AI agent workflows: when an agent is asked to choose between two options inside a prompt, the decision cannot be logged, tested, or distinguished from a random pick. To address this, they built a dedicated decision tool that isolates the judgment into a separate API call, returning a chosen option, a confidence score, and a reason. The confidence score reflects how far apart the two options were rated, rather than how certain the model sounds about its own answer — a distinction the author argues is critical for building automated gates. Teams can set their own confidence thresholds to either accept a pick automatically or escalate to a human, depending on the cost of a wrong decision. A public MCP server is available for testing the tool, with self-service credentials and machine-readable error codes designed to let agents handle failures programmatically.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Security Review Flags High Governance Risk in Bybit DeFi Platform

A DeFi security research team published a governance attack surface review of Bybit, a custodial-exchange-derived DeFi platform with approximately $16.8 billion in total value locked on Ethereum and multiple Layer 2 networks. The review identified ten vulnerabilities across Bybit's on-chain and off-chain governance systems, assigning an overall governance risk score of 7.2 out of 10. Among the most critical findings was a single-key upgradeable proxy admin, rated 9 out of 10, which could allow an attacker to replace core contracts with malicious code while bypassing all governance checks. Reviewers also flagged token concentration as a major risk, noting that the top ten BYT token holders control roughly 68% of the total supply, making governance capture a realistic threat. Additional concerns included short timelock delays, flash-loan-driven voting exploits, and vulnerabilities in cross-chain bridge governance parameters that could enable fund siphoning across Layer 2 networks.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

ZoomEye Method Lets Security Teams Build Exposure Baselines Before Incidents Strike

A repeatable internet-exposure measurement method using the ZoomEye SDK was documented on September 22, 2026, covering eight products that featured in that month's vulnerability reporting. The approach involves running product-specific fingerprint queries rather than broad vendor searches, recording the exact query string, scope, timestamp, and matched asset count together for reproducibility. Asset counts varied widely, from over 2.8 million exposed MikroTik RouterOS instances to just 136 Kestra deployments, illustrating how population size informs but does not solely determine risk. The method also requires logging negative results — products like Starlette that return no fingerprint must instead be tracked through a software bill of materials. The core goal is to establish scoping facts in advance so that when a vulnerability is disclosed, analysts can immediately determine exposure scale rather than spending incident response time learning the tooling.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

OPA Bundle Loader Silently Ignores Typos in .manifest Keys, Misleading Developers

Open Policy Agent (OPA) v1.20.1 contains a silent failure mode where a one-character typo in a .manifest file key — such as 'rego_verison' instead of 'rego_version' — produces no diagnostic identifying the misspelled key. Instead of flagging the unknown key, OPA's bundle loader silently ignores it, and the resulting error surfaces as a 'rego_parse_error' pointing at the .rego policy file, misleading developers into investigating the wrong file. This behavior is consistent with OPA's documented design, which states the bundle loader has always ignored unknown top-level keys in .manifest files. By contrast, a similar typo in a sibling config.yaml file triggers an explicit 'unknown configuration option' warning, a feature available since OPA v1.19.0. The discrepancy was verified on OPA v1.20.1 and affects any bundle whose .manifest carries a mistyped or unrecognized top-level key.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Artist Augusto Creates Fine Art Series Inspired by Pareidolia

An artist known as Augusto has launched a fine art project called Augusto's Faces, centered on the phenomenon of pareidolia — the tendency to perceive faces in random objects or patterns. The project is showcased on Augusto's personal website, presenting visual artworks that explore this psychological effect. Pareidolia is a well-documented human trait where the brain interprets ambiguous stimuli, such as clouds or textures, as recognizable faces. The project appears to transform this everyday perceptual experience into a curated artistic medium. The work was shared on Hacker News, drawing initial attention from the tech and creative community.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Solo dev builds real-time translated caption Chrome extension for browser-based meetings

A solo developer has built a Chrome extension that displays live translated captions over browser-based meetings on Google Meet, Zoom, and Teams without any bot joining the call. The extension captures tab audio using Chrome's Manifest V3 architecture, which required an offscreen document workaround since service workers lack Web Audio and getUserMedia APIs. An early version used Deepgram for speech recognition and DeepL for translation, but sending incremental partial transcripts to DeepL inflated costs to roughly 2.53 times the characters of final-only translation, amounting to about $2.55 per hour of calls. The developer switched to Soniox's stt-rt-v5 model, which handles both recognition and translation in a single stream, eliminating the cost problem. Key limitations remain: the extension only works with browser tabs, excluding desktop Zoom and Teams apps and mobile devices, and tab capture permission resets after each page navigation.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Move DMARC Email Policy From Monitoring to Full Enforcement

DMARC is an email authentication standard that binds SPF and DKIM checks to a sender's visible From domain, instructing mail receivers how to handle messages that fail verification. Most organisations stall at the initial 'p=none' monitoring stage because aggregate reports arrive as unreadable XML files and no clear owner or exit conditions are defined. A successful rollout requires inventorying all legitimate sending sources, including third-party platforms like CRM and marketing tools, before tightening policy. Organisations should gradually shift to 'p=quarantine' using the pct= tag to limit exposure, then step up to 'p=reject' only after confirming all senders are properly aligned. Subdomains must also be explicitly covered, as a DMARC record on the primary domain does not automatically extend to them without a subdomain policy tag.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Google Renames NotebookLM to Gemini Notebook, Adds Sync and Interactive Tools

Google has rebranded NotebookLM as Gemini Notebook and expanded it into a connected knowledge workspace integrated with the Gemini app. Introduced on April 8, 2026, the updated product allows users to sync notebooks across the Gemini app and NotebookLM, organizing chats, files, and projects in a single knowledge base. On July 16, 2026, the official rename began rolling out across interfaces with no action required from administrators or users. A September 15, 2026 update introduced real-time conversations, mobile audio recording, interactive overviews such as quizzes and flashcards, and a free-access offer for eligible U.S. college students. Some features and benefits are tied to subscription plans and phased rollouts rather than being universally available at launch.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Tutorial: Build a Node.js Vendor-Risk Gate Using Domain Intelligence APIs

A new developer tutorial on DEV Community walks through building an explainable vendor-risk screening tool in Node.js that evaluates domains as they sign up. The system calls a domain-intelligence API to gather signals across RDAP registration data, DNS configuration, TLS certificates, HTTPS reachability, and HTTP security headers. Based on normalized evidence, the application returns one of three decisions — allow, review, or block — using configurable score thresholds and severity-based finding codes. The tutorial emphasizes building an adapter layer to isolate the external API response from application logic, improving maintainability and auditability. It also clearly outlines the tool's limitations, noting it cannot verify business legitimacy, detect malware, or predict future domain behavior.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer releases llm-sentinel, a deterministic open-source LLM guardrail library

A developer has released llm-sentinel v1, a deterministic replacement for the now-archived llm-guard library designed to scan both user inputs and AI model outputs for security threats. The library includes ten scanners covering prompt injection, secrets detection, PII, toxicity, gibberish, banned topics, code execution risks, URL allowlisting, token limits, and custom regex patterns. All scanners return scored findings with matched spans, avoiding black-box behavior and enabling detailed logging. The project benchmarked at perfect precision and recall across 133 labeled test cases, though the developer openly acknowledges this is a limited smoke test rather than a safety certification. Known limitations include gaps in non-English attack detection, narrow PII coverage, and context-blind toxicity filtering, with the developer encouraging community contributions to expand test corpora.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Keel AI lets operators override refusals while keeping a permanent audit trail

Keel is an AI system designed to hard-stop when it cannot answer a question honestly, parking the refusal with a timestamp and named reason. Rather than making the machine fully autonomous, Keel includes a formal override mechanism that allows a designated operator to unlock a specific refusal. Each override is logged as a separate record on top of the original refusal, preserving both entries in order with full attribution — including who issued the override and when. The override is tightly scoped: it must explicitly name the refusal it addresses and cannot serve as a blanket permission, and silence is never treated as approval. The project is open-source under the Apache-2.0 license and available at https://github.com/KeelDev-tech/keel.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

GitHub's 500MB Storage Cap Silently Broke a Fully Automated Android Release Pipeline

A developer building a multi-app Android release pipeline on GitHub Actions hit an unexpected storage quota failure weeks after the system appeared to be running smoothly. GitHub's free organization plan caps Actions storage at just 500MB org-wide, a limit the pipeline quietly exhausted within about ten days. The primary culprit was ten duplicate copies of the Gradle dependency cache — one per active branch — because GitHub scopes caches per branch by default, meaning no sharing occurred across runs. A broken cache key that had never worked as intended compounded the problem, alongside accumulated release artifacts totalling nearly two gigabytes. The incident prompted a decision to remove the pipeline's dependency on GitHub's shared storage and minutes entirely, with a full redesign covered in the next part of the series.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Over 45,000 Printers Exposed Online via Unprotected Raw Print and IPP Ports

A ZoomEye scan conducted on 22 September 2026 found 44,897 devices with port 9100 (raw print) and 314 with port 631 (IPP) openly accessible on the internet. Port 9100, historically linked to HP JetDirect, requires no authentication or encryption and is enabled by default on most network printers, making it difficult to disable without reconfiguring every connected client. The modern IPP protocol on port 631 appeared far less frequently, likely because it is often restricted to local networks and may require authentication. Beyond printing, exposed devices can leak stored documents, address books, scan-to-email credentials, and firmware update access — effectively making them full attack surfaces. Security researchers recommend auditing internal network ranges for all three ports — 9100, 631, and 161 — and treating any open result as a vulnerability requiring immediate attention.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Python Remains Optional for Building AI Agents but Near-Essential for Security Testing

While Python dominates AI development with frameworks like LangChain and LlamaIndex, developers can now build functional AI agents using TypeScript, low-code tools like n8n, or language-agnostic protocols such as MCP. AI agents present a larger attack surface than simple chatbots, as they can read untrusted content, hold credentials, and execute real-world actions, making security testing critical. Key red-teaming tools like garak, PyRIT, and DeepTeam are Python-based, though promptfoo offers meaningful YAML-driven assessments without requiring Python. However, advanced security work — including custom attack loops, multi-turn scenario replay, and bulk result analysis — relies heavily on Python's ecosystem. The practical takeaway is that language choice for building agents should follow existing product stacks, but serious AI security assessment will almost inevitably lead back to Python.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds AI-Driven Software Lifecycle That Runs and Tests Code on Xbox

A developer has created XCP, a system that turns AI code generation into a continuous software lifecycle by executing, observing, and refining projects on a real Xbox Series X. Rather than treating AI-generated code as a one-time output, XCP loops evidence from actual console runs back into the development process for iterative correction. The system operates with the AI agent working from the PC side while the Xbox handles execution, ensuring changes are validated against real hardware behaviour. In public testing, XCP completed all 28 lifecycle operations on an original project and all 14 operations on a port of Minilens, an authorized Godot 2 title. The project also demonstrated version control within the lifecycle, allowing developers to produce, test, and roll back between software versions as part of normal workflow.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Reliably Send Order-Shipped Email Attachments and SMS Alerts

When a gaming studio's order-shipped event triggers email and SMS notifications, missing report attachments often go undetected because API success metrics do not confirm actual delivery. Developers are advised to validate and generate reports before queuing, assign each notification job a durable database identity, and track distinct states from report generation through delivery confirmation. Alerts should be tied to specific report periods, recipients, and pipeline stages rather than blended success rates, so on-call engineers can pinpoint failures quickly. SMS delivery should never be treated as confirmation that an email attachment was successfully received, as the two channels must be tracked independently. Using a unified REST API for both email and SMS can reduce integration complexity by consolidating credentials and ensuring consistent attachment validation across different runtimes.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds Single API to Access Jobs, Tenders, and City Population Data

A developer has created a consolidated Data-as-a-Service platform that combines three commonly needed public datasets behind a single API endpoint. The platform provides access to remote tech job listings with normalized salary benchmarks, government procurement tenders, and demographic data for over 48,000 cities worldwide. It is built using FastAPI running inside Docker, with SQLite databases optimized for fast retrieval through compound indexes. The API is routed through Cloudflare Tunnel to RapidAPI, which handles authentication and rate limiting. The project aims to eliminate the need for developers to rely on multiple fragile scrapers or paid services to access public data.

0 comments Read more at DEV Community
← NewerPage 1006 of 3191Older →