SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Live Supabase service_role keys found committed in public MCP config files on GitHub

A security researcher scanned public GitHub repositories for MCP configuration files that contain database credentials. After decoding and verifying candidate matches, 12 files were found to hold real service_role keys, which bypass row-level security and grant full database access. Four of the associated Supabase projects were still live at the time of the scan, one of them pushed the same day. The author argues that developers treat .mcp.json files like editor settings rather than secret stores, and that the ecosystem lacks the secret-scanning safeguards that .env files have. The researcher recommends rotating exposed keys and moving them into runtime environment variables, and has released free local auditing tools for these configs.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

QuietQueue groups small chores into time-boxed plans using an on-device open-weight model

QuietQueue is a new open-source, browser-based app that turns a list of scattered to-do items into a short session of related tasks within a chosen time budget and energy level. An optional on-device AI, built on the open-weight MiniLM sentence-embedding model via Transformers.js, groups tasks by meaning, while a deterministic planner enforces the time and energy limits. The app does not send messages, book anything, or carry out the tasks themselves, and task text stays on the user's device. The project was built for a Hacktoberfest challenge and its code is MIT-licensed, with dependencies and model weights retaining their own licenses. The developer notes that the implementation and tests were produced by an autonomous AI assistant, and that the app has limitations, including unencrypted local storage.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds "Sloth", a Zero-LLM Memory System to Stop Agents Forgetting Context

A developer on DEV Community describes frustration with an AI agent that repeatedly lost track of prior information. In response, they built a memory component called Sloth that does not rely on a large language model. The system is designed so the agent does not need to re-explain previously established context. The article text on the platform did not render correctly, so further technical details about how Sloth works could not be confirmed from the source.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

PoA network: paid accounts per epoch fall for a third straight close, down 70.7% from peak

The first weekly report on the PoA (Proof of Agent) network, covering mainnet epochs 0 through 5, finds the number of accounts paid at each 6-hour close peaked at 468 in epoch 2. Paid accounts have declined at every close since, reaching 137 in epoch 5, a 70.7% drop from the peak, though the rate of decline is slowing. Over the same period 2,906 accounts registered, so the epoch 5 paid set equals about 4.7% of registrants. The report counts payouts but does not determine why accounts stop being paid. It was written by an independent assistant agent that mines on the network and is not affiliated with its operators, and it notes that PoA is experimental with no promised value.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

LabRobotBench v0.1 Introduces Benchmark for Wet Lab Robotics

A new benchmark called LabRobotBench v0.1 has been released to evaluate robotic systems performing wet lab tasks. The project was shared on Hacker News, where it gathered seven points and no comments at the time of the source material. The source material provides only the title, a link to the project page, and basic engagement figures, so details about its specific tasks, metrics, or results are not available. The benchmark is presented as a first version, suggesting it is an early-stage effort to standardize how wet lab robotics are measured.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Turning a Lovable App Into iOS and Android Apps: Store Fees and Build Costs

A Lovable app converted into iPhone and Android apps incurs about $124 in first-year store fees: $99 annually for Apple's Developer Program and a one-time $25 for Google Play. The article estimates a typical 10-screen app costs roughly $724 in year one including a fixed build fee, with $99 yearly renewal afterward, before store commissions on sales. Both stores take 15% of digital sales for developers earning under $1 million a year, and subscriptions sold via Stripe may need to move to in-app purchases. Two build approaches are described: wrapping the existing project with Capacitor, or rebuilding the front end natively in React Native or Flutter while keeping the same Supabase backend. Doing the work yourself is free apart from time, though iOS requires a Mac with Xcode and the process can involve signing errors and App Store rejections.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

OWASP BLT Moves Dozens of Repositories After GitHub Organization Goes Offline

Over 50 repositories under the OWASP BLT GitHub organization became inaccessible during Google Summer of Code, coinciding with a GitHub outage. The project applied an organization-wide ruleset for security consistency, but the team could not determine whether it or the outage caused the disruption. Repeated support requests to GitHub produced no clear explanation over several months. To keep contributors working, the team moved its code to GitLab, and later adopted ForkMesh, a self-hosted Git forge built by a community member, as its official source of truth.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Chatbot-to-human handoffs: how to transfer customers without making them repeat themselves

A common support chat shows a customer asking for a person several times while the bot keeps answering, then a long wait and an agent with no context. The article argues the fixes are written rules for when the bot hands off, a brief that travels with the customer, and a first human reply that shows someone read the chat. It recommends routing on the customer's first request for a human, using phrasings drawn from the company's own transcripts. It also sets out triggers such as counting failed tries per problem, noticing a shift in the customer's mood, and sending certain sensitive topics to a person immediately. Example scripts for the bot's handoff messages are provided, with company names and people in the examples being fictional.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Reverse-engineering a login password's RSA encryption in a JS case study

A sanitized educational write-up examines how an enterprise office platform encrypts login passwords on the client side. The site routes logins through a third-party identity-as-a-service provider, and captured traffic shows the account sent in plaintext while the password appears as a variable-length hex string, consistent with RSA. The analysis notes that the core difficulty lies not in the standard algorithm but in a big-integer RSA implementation, a choice among three hard-coded public keys, and a single webpack bundle that must be environment-shimmed before running. It also highlights that the plaintext is URI-encoded before encryption and that a separate captcha verification ticket is needed alongside the password. The author describes locating the relevant function by searching for keywords like RSA and encryptedString in the bundle. All domains and site-specific constants are replaced with placeholders, and the piece frames itself as an explanation of the technique rather than a guide to abusing any service.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

MCP servers can now connect via OAuth 2.1, removing the need for manual API keys

Panth, who leads software at Oizom, describes an open-source ticket tracker that lets users add its MCP server to Claude with one URL and a consent click. The design uses OAuth 2.1 with PKCE, dynamic client registration, and protected-resource metadata, as the MCP authorization spec expects. Users can review and revoke access in their account settings, and API keys remain available for headless setups without a person present. The flow relies on discovery documents so a client can follow a 401 response through to a working token. Access tokens last one hour and refresh tokens 30 days, with tokens stored only as hashes.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Case study: reconstructing custom request-header signatures on a government procurement site

A DEV Community write-up, part of a 30-case JavaScript reverse-engineering series, walks through how the author reconstructed custom request headers used by a provincial government procurement e-marketplace. The target endpoint for its announcement list required four non-standard headers, one produced by RSA encryption and another by a nested md5(sha1(...)) hash. The author located the header-generating logic by setting XHR breakpoints and searching for encryption-related identifiers in obfuscated JavaScript. The article presents the approach as an educational explanation of the technique, with real domains and site-specific constants replaced by placeholders.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developers Explore Running Local AI Coding Agents with Ollama and Claude Code

A DEV Community author describes a method for running an AI coding agent on a personal Windows machine without a monthly AI subscription, pairing the Ollama tool with Claude Code. Ollama hosts a local model, such as qwen3.5:0.8b, while Claude Code supplies the agent interface that can read project files, edit code, and run commands. The guide walks through installing and testing Ollama, installing Claude Code, and configuring the two through Ollama's documented integration. The author stresses that this setup does not run Anthropic's Claude model locally and that results depend on whether the chosen model supports tool calling. The write-up is aimed mainly at students and beginners interested in AI-assisted coding.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Efforts to Quit Benzodiazepines Highlight a Largely Overlooked Epidemic

An article in The Believer examines the difficulties people face when trying to stop taking benzodiazepines. It frames dependence on these drugs as a public health problem that receives less attention than other drug crises. The piece draws attention to the challenges of tapering off the medication. The source material provided only the headline, link, and basic engagement metrics from Hacker News, so the full details of the article's arguments and examples could not be verified here.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

AWS Releases ExtendDB, a DynamoDB-Compatible Server That Stores Items in PostgreSQL

On May 20, 2026, two members of the DynamoDB team published ExtendDB, an Apache 2.0 server that implements the DynamoDB wire protocol. Applications using standard DynamoDB SDKs connect to it, while items are actually kept in ordinary PostgreSQL tables that can be inspected directly. The project is written in Rust and is described by its maintainers as a clean-room implementation, currently at the 0.1 development stage. The author walks through a Docker Compose setup, user and access-key creation, and pointing the AWS CLI at a local endpoint. The release is explicitly labeled not a replacement for DynamoDB.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Japan Sees Record Data Breaches in 2026; Experts Urge Individuals to Limit Leak Spread

Listed Japanese companies have already announced ten breaches exceeding one million records each in 2026, the worst pace on record. Ransomware incidents reached 123 in the first half of the year, the highest for any half-year period. Over 90% of solved unauthorized-access cases involved stolen IDs and passwords, showing attackers often log in rather than break defenses. The article argues individuals cannot prevent breaches but can limit how far a leak spreads, such as by changing reused passwords and watching card statements. It also introduces a free, browser-based tool that records leak notices and generates timed action checklists.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Solo Developer Shares Backup Strategy for a 2 GB Server Running 39 Stock Products

After a nightly snapshot that retained only seven days failed to recover an eleven-day-old upload CSV, the author rebuilt their backup approach. Their catalogue of 39 products totals 856 MB, but the underlying pipeline code and research notes would be lost without separate protection. The author splits data into three tiers: small, irreplaceable metadata synced daily; regenerable product archives synced weekly off-server; and large raw assets rebuilt rather than duplicated. Because the server has a single vCPU, backup jobs are run sequentially to avoid memory exhaustion and corrupted archives. The author also emphasizes monthly restore tests over simply confirming that backups exist.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

DentaNote turns dental visit audio into structured clinical notes entirely on a local machine

The author built DentaNote, a tool that converts dictated dental visit audio into a structured clinical note without sending any data off the device. The pipeline combines local Whisper transcription with Gemma running through Ollama, followed by schema validation and a deterministic template for rendering. In the author's test, a 30-second clip produced a complete note in 11.2 seconds, and the author estimates it saves roughly nine minutes per appointment compared with typing notes manually. Benchmarks on 12 synthetic cases compared two Gemma models, with gemma4:e4b outperforming gemma3:4b on precision, recall, and hallucination rate. The design flags ambiguous items for clinician review and is presented as a way to meet Brazil's LGPD data protection requirements through architecture rather than policy.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Oizom stores coding agent prompts in tickets so teams can review them like pull requests

Oizom's software team keeps every prompt sent to its coding agent in the ticket that requested the work, since the ticket thread is the only channel for developer-agent communication. Developers write requests in plain English and move tickets through approval, preview testing, and deployment stages without opening an IDE or terminal. The thread records each exchange, including the preview links, feedback, per-turn cost, and final PR and commit links. Because the prompts are stored alongside their outputs, the team lead can review how people phrase requests and coach them accordingly. The company says this has proven more practical than general prompting guides.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Citrix NetScaler Exposure Skews to US and Germany, but Geolocation Reflects Hosting, Not Operators

On 20 October 2026, queries in a single session counted 239,739 exposed Citrix NetScaler assets globally, with 72,548 registered to the United States, 20,655 to Germany, and 14,157 to China. Together those three countries account for about 45 percent of the global total. The figures rely on IP-based geolocation, which records where address blocks are registered rather than where the operating organization is based, so cloud deployments can distort national totals. For comparison, WordPress showed 63 percent of its assets in the United States against 30 percent for NetScaler, a difference the author attributes to hosting patterns rather than measured security posture. One F5 BIG-IP query failed with an internal error and was logged as an error rather than a zero, so it could be retried. The piece argues that exposure data should be read as infrastructure placement, not as a national security assessment.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Autonomous LLM Agents Placed Inside Temporal Sagas for Core Banking Decisions

Core banking platforms are beginning to use generative AI and large language model agents for complex tasks such as reviewing unstructured trade finance documents, triaging fraud cases, and handling cross-border exceptions. This creates a conflict, because Temporal workflows require deterministic replay to stay fault tolerant, while LLM outputs vary with temperature, hardware, and model versions. The proposed Xenon Architecture Standards resolve this by isolating LLM agents within Temporal Activities governed by strict JSON schemas, validation guardrails, and deterministic fallbacks. The paper also maps which banking domains suit varying levels of AI autonomy, keeping payments and ledger posting fully deterministic, and examines reliability models and compensation patterns.

0 comments Read more at DEV Community
← NewerPage 264 of 3047Older →