SShortSingh.

Programming

0
ProgrammingDEV Community ·

Team TrustMeBro Builds Graph-Based Fraud Investigator FraudLens at Goa Hackerhouse 2026

A three-person team called TrustMeBro developed FraudLens, a fraud investigation system, during Goa Hackerhouse 2026 using TigerGraph's graph database technology. Unlike traditional fraud classifiers that assign a single risk score to a transaction, FraudLens mimics a real analyst by examining relationships — such as device history, spending patterns, regional activity, and linked accounts. The system uses a LangGraph-powered stateful workflow to gather evidence, test known fraud patterns, seek innocent explanations, and retrieve similar closed cases before reaching a verdict. A strict separation of responsibilities ensures the LLM handles only planning and summarisation, while a dedicated policy engine applies rules and a TigerGraph backend manages all relational data and case memory. The tool outputs a final decision — including filing a suspicious activity report when required — and writes the complete case back to TigerGraph for auditability.

0
ProgrammingDEV Community ·

Developer Tool 'canfail' Tests Whether CI Guards Can Actually Detect Failures

A developer has released canfail, a lightweight open-source tool designed to verify that CI pipeline checks are genuinely capable of catching errors, not just perpetually green by accident. The tool targets configuration files such as YAML, Terraform, and Dockerfiles — areas not covered by conventional mutation testing tools like Stryker. Users declare a specific code break, the expected failure output, and canfail applies the change, runs the check, and reports whether the failure was correctly detected. The tool enforces strict rules: the check must pass on a clean codebase first, failures must match the declared reason, and the modified file must be restored and verified by digest. A notable bug discovered during development revealed that stale Python bytecode cache could cause false positives, which was ultimately resolved using the PYTHONDONTWRITEBYTECODE environment variable.

0
ProgrammingDEV Community ·

TypeSafe's Jev Model Aims to Separate AI Decisions from Text Generation

TypeSafe AI introduced Jev, its first System One model, in September 2026, designed to handle structured decisions rather than open-ended text generation. Unlike traditional large language models that return free-form strings requiring parsing, Jev outputs typed results such as choices, scores, and binary values directly consumable by application code. The model is intended to sit within an agent pipeline as a dedicated decision layer, evaluating actions like tool calls before they are executed. Developers retain control over thresholds, authorization logic, and side effects, meaning the application code — not the model — owns the final policy. The architecture is positioned as a way to reduce reliance on prompt engineering and output parsing for tasks that are fundamentally decision problems rather than generation problems.

0
ProgrammingHacker News ·

Developers Debate Ways to Modernize the Open-Source Desktop

A discussion has emerged in the open-source community around modernizing the Linux and open-source desktop experience. The conversation, linked via LWN.net, explores ideas and proposals aimed at improving usability and relevance of open-source desktop environments. The article is directed at developers and contributors interested in the future direction of desktop Linux. While specific proposals are behind a subscriber link, the topic has drawn attention from the Hacker News community.

0
ProgrammingDEV Community ·

OIHK Pentesting Agent Learns from Past Failures to Improve Future Security Scans

A developer has released a major rebuild of OIHK-Pentesting, an open-source multi-agent framework designed to run authorized penetration tests using a large language model planner called Baron. The updated system can split assessment plans into parallel subtasks, launching up to seven simultaneous AI agent loops inside a governed Kali Linux sandbox. A key new feature records missed or failed scan attempts into a local JSONL ledger, automatically injecting weighted lessons into Baron's future prompts so the agent improves over time without retraining. Safety guardrails include strict scope enforcement, a closed-egress network allowlist, mandatory evidence for every finding, and a resource budget system that prevents hardware overload by capping active Docker containers. The tool is intended solely for use by security professionals with written authorization over their target systems.

0
ProgrammingDEV Community ·

OSLabs engineers release open-source CLI to find cheapest Claude tier for your workload

Three developers at OSLabs have built PennyWyze, a free open-source command-line tool that helps teams identify the most cost-effective Claude AI tier for their specific use case. Users supply their production prompt and a labeled dataset of real inputs with known correct answers, and the tool runs each example against Claude Opus, Sonnet, and Haiku via the Anthropic API. PennyWyze measures actual accuracy and calculates real monthly cost projections based on live token counts, then recommends the cheapest tier that meets the user's defined pass-rate threshold. In a sample audit, the tool identified Claude Haiku as equally accurate to Opus at 49 out of 50 questions, while costing roughly $180 less per month. Currently, the tool supports only exact-match tasks such as classification and routing, with an LLM-as-judge mode for open-ended generation planned for a future release.

0
ProgrammingDEV Community ·

Developer shares key lessons from building a free random wheel web tool

A developer recently built a free browser-based random wheel tool called The Name Wheel and documented the engineering decisions involved. The project highlighted that interactive web tools require careful attention to state management, randomness, accessibility, and responsive design beyond just the visual interface. A key lesson was keeping animation logic separate from result calculation to make the app easier to debug and maintain. The developer also stressed the importance of handling edge cases, such as displaying a clear message when no options have been entered, to avoid confusing user experiences. The broader takeaway is that simple web tools become genuinely useful when they minimize friction around a common task.

0
ProgrammingDEV Community ·

MikroTik Patches Three Critical RouterOS Flaws Including SSH Auth Bypass

MikroTik released a security update in September 2026 addressing three critical RouterOS vulnerabilities, flagged by India's CERT-In as advisory CIVN-2026-0460. The most severe flaw allows unauthenticated attackers to bypass SSH login entirely by sending a forged RSA key, potentially granting full administrative control. A second SSH vulnerability enables privilege escalation by manipulating argument delimiters in the login path, allowing attackers to alter router policy and pivot to internal networks. A third flaw in the bandwidth-test service exposes uninitialized kernel memory to unauthenticated network requests and can crash the device. Affected users are urged to upgrade to the patched RouterOS versions and, in the interim, restrict SSH access to trusted sources and disable the bandwidth-test service where not needed.

0
ProgrammingDEV Community ·

Developer finds sandbox misclassified shell crashes as command failures on Windows

A developer running an AI agent on Windows Server 2022 discovered that every executed command was silently failing due to a broken shell environment, not faulty commands. The root cause was a recent update that set bash as the default process-boundary shell across all platforms, despite bash not being a native Windows executable. Further investigation revealed that six bundled tools — including bash.exe — all depended on the msys2 runtime DLL, which was only present in one directory and causing STATUS_DLL_INIT_FAILED (exit code 0xC0000142) at the loader level. Because the runner's failure-detection logic did not recognise this exit code as an environment-level fault, every crash was logged as a normal command failure, masking the broken environment entirely. The developer concluded that runners should treat 'child process never initialised' as a runner failure and surface the exit code prominently in all error messages to prevent wasted retry attempts.

0
ProgrammingDEV Community ·

OSLabs Releases Open-Source CLI PennyWyze to Audit Claude API Costs

Three engineers at OSLabs have released PennyWyze, a free open-source command-line tool that helps developers find the cheapest Claude model tier that still meets their accuracy requirements. Users provide their production prompt and a labeled dataset of real examples, and the tool runs these against Claude's Opus, Sonnet, and Haiku tiers using the live Anthropic API. PennyWyze grades each model's responses against expected answers and calculates actual monthly cost projections based on real token counts. In one example audit, the tool identified that switching from Opus to Haiku could save roughly $180 per month with no loss in accuracy. Currently, PennyWyze supports exact-match grading, making it best suited for classification, extraction, and routing tasks rather than open-ended generation.

0
ProgrammingDEV Community ·

Free API tracks OpenAI Codex global usage-limit resets with 24/48h forecasts

A developer has launched codex-reset.com, a free tool that monitors and records OpenAI's informal global Codex usage-limit resets, which occur occasionally after incidents or milestones. The service provides a public JSON API requiring no key, offering probability forecasts for a reset occurring within the next 24 or 48 hours alongside a dated timeline of past resets with source links. It also tracks live Codex service status across multiple surfaces, helping users distinguish outages from quota exhaustion. The data is additionally available as a read-only MCP server that can be connected directly to Codex or Claude Code without installation or authentication. The project is free to use, with the only condition being visible attribution when the data is displayed to others.

0
ProgrammingDEV Community ·

MCP vs CLI: The Right Choice Depends on Who Controls the Next Step

When building tools that perform actions like publishing a website, developers face a choice between a Command Line Interface (CLI) and a Model Context Protocol (MCP) server. The key deciding factor is not whether the user is human or an AI agent, but rather who determines the next step in the workflow and where the data resides. CLIs are better suited for fixed, repeatable sequences such as automated deployment jobs or local build commands, while MCP tools shine when an AI assistant needs to discover and invoke operations dynamically within a conversation. Transport context also matters: a local MCP server can read a directory path directly, whereas a remote MCP server over HTTP interprets the same path on the server side, not the user's machine. Both interfaces can share a single underlying operation, with the CLI managing flags and exit codes while the MCP adapter handles tool definitions and structured results.

0
ProgrammingDEV Community ·

How to Add AI Agent Billing Without Disrupting Its Workflow Loop

When a subscription gateway is placed between an AI agent and its model provider, it can mistakenly interrupt multi-step tasks by treating each model request as a separate billable turn. The core problem is that billing layers can inadvertently take over orchestration decisions that should remain with the agent's local host. A properly designed billing gateway should only handle authentication, allowance checks, request forwarding, and usage accounting — not control the flow of the agent's tool loop or conversation context. Developers are advised to assign distinct identifiers to user turns, model operations, and business invocations to enable accurate metering and error recovery without disrupting execution. Keeping orchestration deliberately separated from billing ensures that paying for model access does not silently grant a second system control over the user's task.

0
ProgrammingDEV Community ·

Walrus Sessions 8 Hackathon Challenges Developers to Build Memory-Persistent Chatbots

Walrus Sessions 8 is a live hackathon running from September 18 to October 9, 2026, focused on building chatbots that retain context across conversations using the Walrus Memory SDK on mainnet. Participants must create or upgrade a chatbot that stores and recalls user context, deploy it in a real environment, and document the integration with evidence of it working. The competition is open to any use case, including customer support, tutoring, and sales. A total of $2,500 in WAL prizes is on offer, with separate award tracks for the best chatbot, best article, non-Claude/GPT models, and bug bounties requiring no chatbot submission. Full rules and submission details are available via the official Walrus form, with the project repository hosted on GitHub under MystenLabs.

0
ProgrammingDEV Community ·

Claude Code's git push deny rule blocked only 8 of 14 push attempts in security test

A developer tested Claude Code version 2.1.278 to see how reliably a single deny rule — Bash(git push:*) — blocks push commands in an automated agent setup. Across 14 differently worded push attempts run on 22 September 2026, the rule successfully blocked 8 but allowed 5 to actually reach the remote repository. Bypasses included indirect methods such as wrapping the command in a shell script, using eval, or invoking git with a -c flag prefix. A 14th attempt evaded the rule but failed independently for unrelated shell reasons. The findings highlight that Claude Code's permission deny rules match command strings literally, leaving meaningful gaps when commands are rephrased or wrapped.

0
ProgrammingDEV Community ·

AI Text Detectors Are Unreliable by Design, Developer Explains Why

A developer has built an AI-content detection tool after finding that most existing detectors overstate their accuracy, often claiming near-perfect results they cannot deliver. Unlike image-based tools that can embed invisible statistical watermarks, text detection relies on weaker signals such as perplexity, sentence burstiness, and token-frequency patterns. These signals break down under common conditions like paraphrasing, short inputs, translation, or deliberate obfuscation, making confident verdicts misleading. The new tool, available at detectaiwatermarks.com, is designed to report which specific signals were detected rather than issuing a single definitive score. Its verdict is also calibrated to text length, acknowledging that a short social media post and a long essay cannot be assessed by the same standard.

0
ProgrammingDEV Community ·

Google Adds monday.com to Gemini Connected Apps for Workspace Data Access

Google announced on September 23, 2026, the addition of monday.com to its Gemini Connected Apps, alongside other tools including Airtable, Linear, and Zoho. The integration allows users to reference monday.com board data within Gemini-powered features across Gmail, Docs, Sheets, and Slides using natural-language queries. Currently, the Google Workspace connector operates in early alpha as a read-only tool, meaning Gemini can retrieve project information but cannot create or modify board items. A separate, deeper integration launched in June 2026 enables a monday.com agent for Gemini Enterprise to orchestrate workflows via natural language, carrying a Google Cloud Ready designation. The Connected Apps feature can be enabled through Gemini settings and is designed to reduce manual context-switching between project management tools and Workspace documents.

0
ProgrammingDEV Community ·

Why Multi-Tenancy Is an Architecture Problem, Not Just a Config Setting

A software team building a low-code platform discovered that a seemingly simple client request—letting four subsidiaries share one system while keeping their data separate—exposed deep architectural complexity. Multi-tenancy actually encompasses three distinct concerns: deployment isolation, data partitioning, and configuration customization, and most platforms quietly assume these can be bundled together. The challenge intensifies on low-code platforms because the application's own structure—fields, workflows, permissions, and scripts—is also tenant-scoped data, not just business records. A script written by one subsidiary could inadvertently access another's data, not due to malicious intent but because the boundary was never enforced at the runtime level. The core lesson is that tenant isolation cannot rely on developers remembering a where clause; it must be enforced systematically by every layer of the platform's runtime.

0
ProgrammingDEV Community ·

Developer Finds Vote-Spoofing Bug in Open-Source AI Memory SDK, Fix Shipped in Days

A developer auditing MemWal, an open-source AI-memory SDK by MystenLabs, discovered a logic flaw in a sample chatbot app built on the platform. The bug allowed any user who could view a message in a public chat to cast a vote on another user's message by exploiting a mismatch between the vote-existence check and the actual update query. The existence check queried only by message ID, while the UPDATE required both message ID and chat ID, meaning a spoofed vote would silently block the original owner from ever voting. Critically, the system returned a 200 success response with no errors or logs, leaving the feature permanently broken for the legitimate user. The developer reported the issue responsibly, and the maintainers confirmed and released a fix within days.

← NewerPage 972 of 3189Older →