SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

docs-governance Helps Preserve Project Context Across AI Coding Agent Sessions

A developer has released docs-governance, an MIT-licensed open-source tool designed to retain project decision context across AI coding-agent sessions in Claude Code and Codex. The tool uses a set of small, purpose-specific Markdown files — covering project rules, navigation notes, current status, and change logs — to give each new session structured context without overloading a single instruction file. It also includes reusable skills, templates, and audit scripts, with support for larger projects needing architecture documents and decision records. The project is available on GitHub with installation instructions for both Claude Code and Codex. The developer is seeking community feedback on whether the audit tooling surfaces useful issues and whether maintaining the files remains practical in real-world projects.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer's AI answer-checker missed all injection attacks until one overlooked fix caught them

A developer building an AI-powered checker for retirement advice discovered a critical blind spot: the system had no way to detect prompt-injection attacks carried inside AI-drafted answers. Initial red-team testing showed the checker's judge models successfully blocked all 12 planted factual errors, but 3 of 4 correct answers containing injected instructions were sent to customers without review. The core problem was that the system never treated the incoming draft as untrusted data, meaning malicious text embedded in it could potentially manipulate the checker's output. Three fixes were applied: judge prompts were updated to treat drafts as untrusted, a fail-closed rule was added for missing or malformed outputs, and a regex layer was introduced to flag known injection markers. A second independent red-team round confirmed the updated system blocked all 20 new attacks without falsely flagging legitimate answers.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

BrighTO-Router: Open-Source Rust-Based LLM Gateway for Self-Hosted AI Traffic

A developer has released BrighTO-Router, a free open-source AI traffic gateway written in Rust, designed to give teams a single self-hosted API endpoint for managing large language model requests. The tool supports routing for OpenAI-compatible endpoints, Anthropic Messages, local models, reranking, and speech transcription, along with team API keys and token budgets. Built with Rust for predictable memory usage and fast async networking, the entire solution deploys via a single Docker image to minimize operational complexity. The project includes a PostgreSQL-backed usage ledger and supports round-robin and weighted load balancing across model groups. Benchmarks testing up to one million token payloads have been published, measuring router overhead rather than model inference speed to ensure reproducible results.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Exploring How Yemen's Size Compares to Other Countries

A 2024 piece published on the Substack blog 'theborys' examines the geographical size of Yemen. The article puts Yemen's land area into perspective by drawing comparisons with other nations or regions. The post gained modest traction on Hacker News, receiving 7 points and 2 comments. Such size-comparison analyses help readers develop a more intuitive understanding of countries they may be unfamiliar with.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

UK, US, Dutch agencies warn of Iranian spyware families targeting users via Telegram

The UK NCSC, FBI, and Dutch AIVD jointly published an advisory on 15 September 2026 detailing two Windows spyware families, Chosen Brick and HEAVYGRAM, linked to Iranian intelligence. The malware has been actively deployed since at least 2025, with the broader campaign traced back to autumn 2023. Attackers use WhatsApp and Telegram to impersonate trusted contacts or technical support staff, tricking victims into running a malicious file disguised as a legitimate installer. Once installed, the spyware can capture screenshots, record audio, harvest messaging app data, steal saved passwords, and download additional malware. Agencies noted that unusual Telegram API requests in network logs and unauthorised Windows Defender exclusions in the registry serve as key detection indicators.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Apple's iPhone Duo Launches with Same Black Bar Problem It Mocked in Android Foldables

Apple's newly released iPhone Duo, priced at $1,999, displays black bars occupying roughly 20% of its 7.6-inch inner screen when playing standard 16:9 video — the same issue Apple executives publicly criticized in Android foldables for years. The device's A4-paper-shaped aspect ratio suits documents and web browsing but is a poor match for the video format most users consume. Apple released the SDK needed for developers to properly optimize apps for the Duo's unique display only after the phone had already been announced, leaving developers just weeks to adapt. Without the update, apps render as a standard phone-sized window centered on the larger panel, surrounded by unused black space. iOS 27.1 is expected to address the software side of the problem, but the delayed developer tools meant the issue was effectively unavoidable at launch — mirroring challenges previously faced by Samsung and Google with their own foldable devices.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds 4-Agent AI Research System FORGE in Three Days at Home

A developer built FORGE, a locally hosted multi-agent AI system designed to answer research questions using a pipeline of four agents: a planner, researcher, writer, and reviewer. The project took three days, with most of the time spent identifying parts of the app that appeared functional but were actually simulated or broken. Early builds used a fake simulator to populate the dashboard, while a key architectural decision — logging all activity as immutable events rather than updatable records — allowed live and replay views to share the same code. When real AI models replaced the simulator, issues emerged including IPv6 timeout failures, agents exhausting output budgets before answering, and runaway research loops, all of which were fixed with targeted patches. The final system runs on affordable models like GLM-5.3 Flash via OpenRouter and uses free tools such as DuckDuckGo search and open-source page-scraping libraries.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

PiFl Labs fixes schema error that tagged recall articles as product pages

PiFl Labs identified a structured-data error on its Astro-based multilingual site where recall-notice pages were inadvertently flagged as product pages due to a nested Product node in their JSON-LD schema. Google Search Console had reported nine invalid product-snippet URLs missing required commercial fields such as offers, reviews, or ratings — data that was absent because the pages were public-safety recall articles, not sales or review pages. The fix removed the nested Product object from the Article schema template rather than fabricating commercial data to satisfy rich-result requirements. Automated tests were added to verify that no Product node appears across 357 page-locale combinations spanning 119 recall records in Korean, Japanese, and English. The corrected markup has been deployed and confirmed live on representative URLs, though Google has not yet recrawled and revalidated the pages.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Idempotency Keys Prevent Duplicate Charges and Errors in ASP.NET Core APIs

When a client retries a failed HTTP request, side-effecting API endpoints can process the same operation twice, leading to duplicate payments, repeated notifications, or corrupted inventory data. Idempotency keys — unique identifiers generated by the client per logical operation — allow servers to detect and skip already-processed requests by returning a cached response. Developers can implement this in ASP.NET Core 8 using middleware that checks a distributed cache like Redis before executing any business logic. The cached response is stored for a set duration, typically 24 hours, so all subsequent retries receive the original result without re-triggering backend operations. This pattern is especially critical for financial transactions, order creation, and third-party integrations, while read-only endpoints generally do not require it.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds open-source job search dashboard to track and automate applications

A software developer has created a personal job search dashboard by forking the open-source project ApplyPilot, with the public fork available at github.com/msohailse/ApplyPilot. The tool helps manage the record-keeping side of job hunting, with the developer committing to submitting five applications per day. Key features include a pipeline view, per-stage success rates, a daily application streak tracker, and AI-generated tailored resumes and cover letters from job postings. An integrated LLM scores job listings and extracts key concepts, while the dashboard also supports multiple resume versions for different regions. The developer emphasizes tracking one honest metric — applications sent — as the core discipline behind the system.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

ShinyHunters Exploits Critical Oracle PeopleSoft Flaw to Deploy Web Shells via WAF Bypass

Threat group UNC6240, linked to ShinyHunters, has been actively exploiting a critical pre-authentication remote code execution vulnerability (CVE-2026-35273, CVSS 9.8) in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62, according to a September 25, 2026 report by Google Threat Intelligence Group and Mandiant. Attackers bypass web application firewalls by percent-encoding the letter 'P' in the target URL path as '%50', causing WAF string-matching rules to miss the request while the backend WebLogic server decodes and processes it normally. JSP web shells have been confirmed on dozens of compromised systems, with some intrusions also involving fileless command execution that leaves no shell files on disk. Following initial access, attackers deployed multiple post-intrusion tools including SIDEEYE for credential theft, Neo-reGeorg for internal SOCKS tunneling, and MeshAgent for remote management on Linux hosts. Oracle has issued a security advisory, and organizations running affected PeopleSoft versions are urged to apply patches and review WAF rules to detect encoded URI variants.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Re-Enabled GitHub Actions Repos Trigger Malicious Code Re-Execution in CI Pipelines

Two GitHub Actions repositories — actions-cool/issues-helper and actions-cool/maintain-one-comment — were re-enabled on September 16, 2026, weeks after being disabled following a supply chain attack discovered in May 2026. The repositories were restored while still carrying malicious tags from the original compromise, meaning no new attacker activity was needed to resume the threat. Security firm Socket confirmed through execution logs that workflows referencing issues-helper re-ran the malicious payload upon the repositories being restored. GitHub's dependency graph shows approximately 15,000 repositories relied on issues-helper, though this figure reflects potential exposure rather than confirmed cases of code execution or data theft. GitHub disabled both repositories again on September 25, 2026, after the renewed risk was identified.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Claude Code subagent frontmatter tested: which model settings actually take effect

A developer running Claude Code 2.1.278 on macOS tested whether YAML frontmatter settings in custom subagent files — specifically model and effort fields — are actually honored at runtime. Three subagents were examined: a bulk reader pinned to Sonnet, a deep reviewer pinned to Opus, and a preflight reviewer set to inherit its model. Testing was conducted on September 22, 2026, using seven CLI invocations in an isolated throwaway directory to avoid contamination from existing config files. The experiment tracked which model actually responded to each subagent's first API request, whether effort levels survived a parent session running at a different setting, and how Claude Code handled an unrecognized frontmatter key. Findings revealed measurable per-launch token costs and showed that the validator passed through at least one frontmatter field it did not recognize without raising an error.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds update notifier for ChatGPT Linux app missing built-in checker

OpenAI recently launched a Linux version of its ChatGPT Desktop app, but unlike the Windows counterpart, it lacks a built-in update checker. A developer who switched from Windows to Linux noticed the gap after missing the GPT-6-Astra rollout for several days due to an outdated app. To address this, they built an open-source utility that monitors the system's package manager for ChatGPT updates and sends notifications when a new version is available. The tool also supports one-click installs and rollbacks, along with a control panel for managing upgrade settings. The project has been published on GitHub for other Linux users facing the same issue.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Shrinks 2,300-Character AI Image Prompt to One Sentence With Better Results

A developer behind the web tool SparkPix.ai reduced their AI image humanizer prompt from 2,300 characters to a single sentence, achieving better output quality. The original prompt listed dozens of specific instructions to remove AI-like artifacts, but the overlapping clauses caused the model to over-apply each rule, producing unnatural results like excessive freckles or washed-out skin tones. The replacement prompt simply instructs the model to make the image look as if it was taken with an iPhone 12 camera, leveraging the model's existing training on millions of real phone photos. The developer found that referencing a specific device name effectively conveys sensor noise, color science, and lighting characteristics without explicit instruction. An additional clause was later added to preserve non-photographic art styles, such as illustrations or anime, after the short prompt began converting those formats into photographs.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Silent CI Bug: A Security Scanner Passed for Two Months While Scanning Nothing

A software developer discovered that a secrets-scanning script was silently passing CI checks for two months because it was receiving file paths instead of directories, causing its glob pattern to match zero files. Since both a clean scan and an empty scan exit with code 0 and print 'PASS', the failure was completely indistinguishable from a genuine pass. The only honest signal — a log line reading 'files scanned: 0' — was overlooked repeatedly because the word 'PASS' appeared immediately after it. The developer fixed the issue by adding an explicit check that exits with a distinct error code when zero files are scanned, refusing to report success. The key lesson: any verification step that gates a release must print how many items it examined and treat a zero-match result as a hard failure, not a silent pass.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Cisco Secure Email Gateway Hit by Critical Access Control Flaw CVE-2026-76441

A critical improper access control vulnerability, tracked as CVE-2026-76441, has been identified in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager versions 15.5 and earlier. India's CERT-In disclosed the flaw on 17 September 2026 via advisory CIVN-2026-0461, rating it critical alongside four related issues affecting the same product family. The vulnerability allows a remote, unauthenticated attacker to bypass authorization controls and gain unauthorized access to restricted functions or resources. Depending on the privileges tied to the compromised functionality, potential impacts include unauthorized data access, modification, or broader security consequences. No fixed release was specified in the CERT-In advisory, and administrators are urged to consult Cisco's official hardening advisory cisco-sa-hardening-esa-dfCrfXkm for remediation guidance.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Engineer Builds AI-Ready E2E Test Suite and Rethinks Technical Debt in the Age of Agents

A software engineer this week built a lightweight end-to-end test suite using Pytest and Playwright, eliminating the need for manual testing before risky releases on a backend project. The suite runs locally, allowing AI agents to execute tests and validate their own code changes autonomously against both local and QA environments. To overcome an authentication barrier that blocked local access to the service, the engineer added an API key authenticator restricted to non-production environments, keeping production security intact. Working simultaneously on a technical debt management process, the engineer identified the absence of proper test harnesses and guardrails as a fast-growing source of technical debt in AI-assisted development. The engineer argues that while coding agents accelerate implementation, review, testing, and deployment remain bottlenecks that guardrails and broader automated validation must address to fully realise that speed gain.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds Low-Power Android App That Auto-Silences Phone by Location

A developer created Muffle, an Android app that automatically adjusts phone sound profiles based on the user's physical location, eliminating the need for manual volume management. The app uses Google Play Services' GeofencingClient instead of continuous GPS polling, keeping battery consumption low by triggering alerts only when a location boundary is crossed. To ensure reliable execution under Android's background restrictions and Doze mode, the architecture chains a PendingIntent, BroadcastReceiver, and ForegroundService to deliver AudioManager commands. A key challenge emerged with custom Android ROMs from certain manufacturers, whose aggressive battery optimization settings blocked the BroadcastReceiver before it could act on geofence events. The developer ultimately had to prompt users to manually exempt the app from battery optimizations, a compromise that undermined the intended zero-setup experience.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds AI Tool to Generate ASL Sign Videos, Flags Accuracy Concerns

A developer with years of ASL experience has created SignBridge, a prototype that uses generative AI to produce videos of individual American Sign Language signs. The tool accepts a word as input and attempts to generate a corresponding signing video, using detailed prompts about handshape and movement. However, the creator acknowledges a key limitation: generated videos can appear convincing while containing errors in handshape, position, or motion, and results vary across generations. Sentence-level signing remains out of scope for now, with the project focusing solely on single words. The developer is seeking input from experts in pose estimation, animation, and sign language technology, with a preference for verification methods involving Deaf signers rather than visual plausibility alone.

0 comments Read more at DEV Community
← NewerPage 881 of 3177Older →