标签：#EV

For security reasons, we consider "Target app", as the target we practiced on, and the real name won't be disclosed in this post. The target app, was a niche music streaming platform, available in web and mobile PWA, meaning the structure is same but access is easier for cross platform. The app worked in this way : You register using an account, 3rd party like google or via email After that you can use the app for free with a 3 day window (3 day trial) After the 3 day you gotta buy subscription to continue listening The flaw, existed in the first step, when you register using an email, no verification happens! You could enter any type of string@something.com , a random password and start your free trial. So what happens is that first I use string1@something.com , for 3 days. When the time runs out, I use string2@something.com for another 3 days. And since the app's trial and actual subscription don't have any difference, and the 3 day time window is the only limitation, the user with such knowledge from the app doesn't need to buy any subscriptions while such flaw exists! Mitigation : Apply email verification step after user input, so they have to use the received link to verify their address Blacklist "temporary email" service's address or IPs, so users won't generate any email to register after their trial has expired. This way, the registration process isn't too complex while keeps app from attackers avoiding a "For ever free" usage on the app.

Imagine a user trying to upload a 100MB video or a high-resolution photo to your app. If you use the standard Rails file upload, that file travels from the user's browser to your Rails server, and then your server sends it to S3 or Google Cloud. This is a terrible way to do it. While that 100MB file is transferring, your Rails worker (Puma) is frozen. It can't handle other users. If three people upload large files at once, your whole app will stop responding. In 2026, the professional way to handle this is Direct Uploads . With Direct Uploads, the file goes directly from the user's browser to your cloud storage (S3, R2, etc.). Your Rails server only handles a tiny bit of metadata. It is faster for the user and much safer for your server. Here is how to set it up in Rails 8. STEP 1: Configure Your Storage First, make sure you aren't using the local disk for production. You need a cloud provider like AWS S3 or Cloudflare R2. In your config/storage.yml : amazon : service : S3 access_key_id : <%= ENV['AWS_ACCESS_KEY_ID'] %> secret_access_key : <%= ENV['AWS_SECRET_ACCESS_KEY'] %> region : us-east-1 bucket : my-app-uploads # Crucial for Direct Uploads! public : true Note: You must configure CORS in your S3/R2 dashboard to allow requests from your domain. If you don't do this, the browser will block the upload. STEP 2: The Rails Form Rails makes the backend part incredibly easy. You just add one attribute to your file field: direct_upload: true . <!-- app/views/users/_form.html.erb --> <%= form_with ( model: user ) do | f | %> <div class= "field" > <%= f . label :avatar %> <%= f . file_field :avatar , direct_upload: true %> </div> <%= f . submit "Save Profile" %> <% end %> When you add direct_upload: true , Rails automatically includes a JavaScript library that handles the "handshake" with S3. STEP 3: Adding a Progress Bar (The UX Win) Direct uploads can take a few seconds. If nothing happens on the screen, the user will think your app is broken. We can use the built-in Ac

Fusion startups have raised $7.1 billion to date, with the majority of it going to a handful of companies.

The morning my own file lied to me Wednesday, May 21, start of session, coffee next to the keyboard. I ask the agent where we stand on the DEV.to series. Clean answer, articulated, "Four articles on stand-by, ready to publish." I reread. Half a second of unease, because I think I saw two or three of them go through DEV.to last week, but I slept in between and I'm no longer sure. I type the question that changes everything, "Are you sure articles remain to publish?" The agent re-queries the DEV.to API in parallel, opens scripts/devto/state.json , crosses the two. The four articles have been published for two or three days. What I just read wasn't a hallucination. The agent did exactly what was expected of it, namely open articles/backlog.md , read the table, restitute what it said. I'm the one who had stopped updating that file. sync-backlog.ts hadn't run after the pushes of last week. The markdown said "stand-by" while production said "published" . The typist didn't lie. She read faithfully a file I had written myself and that I was treating as authority while nothing was maintaining it. A summary is a Cache without a refresher This is the most common failure mode of a solo project that lasts. Each day produces two flows. On one side the matter that moves, made of commits, deploys, rows in the database, statuses that transition. On the other side the writings we draft to keep our bearings, namely backlog.md , the root MEMORY.md , the Sunday-night session note, the README of the folder we refactored last week. These writings are produced quickly, in the gesture that closes a sprint, and they are maintained slowly, or not at all, because nothing in the pipeline triggers to close them. R6 of the Counterpart Toolkit says it for SQL columns, Live / Snapshot / Cache mandatory . Any column derivable from other data must declare its category in the commit that creates it. If it's a Cache, the refresher mechanism ( GENERATED ALWAYS AS , SQL trigger, materialized view with pl

A finance bot kept issuing refunds in a loop because nobody built a way to stop it. Clean code. Sound logic. No off switch. A small bug became a long night. Here is the opinion most teams do not want to hear. Building the agent is the easy 80 percent. That off switch is the 20 percent that decides whether you can ship it at all. We celebrate the wrong milestone. Picture the demo where the agent books the meeting, writes the email, updates the record. That part is genuinely fun to build and genuinely easy now. Harder is the boring question nobody claps for. What happens when it is wrong, fast, and confident. An AI agent is not a chatbot. It takes actions in the real world. It spends money, deletes rows, messages real people, moves files. Wrong answers in a chat are annoying. A wrong action at machine speed is an incident with your name on it. So before features, I build the stop. One real kill switch is not a single button. Think of it as a small set of bounds that live from the first version. A spend ceiling, so a retry loop cannot drain the account A blast radius limit, so one task can never touch more than it should A human gate on anything irreversible, so the agent proposes and a person commits A global stop that halts everything in one move, with no redeploy None of that is glamorous. All of it is what lets you sleep at night. Teams skip this for a reason that feels rational in the moment. Bounds feel like negative work. They never show up in the demo. Your agent runs fine without them right up until the one time it does not, and that one time is the only time anyone remembers. Here is the reframe that changed how I build. Treat the stop as the feature that makes an agent shippable. Bolt it on at the end and you have already shipped a liability that happens to pass the demo. Honest about the trade-off. Bounds slow you down. You will watch the agent pause for an approval it could technically have skipped, and it will feel like friction. That friction is the pric

The invoice arrived on a Tuesday morning. $340. For a side project I'd built in a weekend. A small LLM-powered summarization tool — users paste text, model returns a summary. I'd done the math before launching: roughly $0.002 per request, ~500 requests/day, around $30/month. Totally fine. What I hadn't accounted for: system_prompt_tokens = 800 requests_per_day = 2000 # not 500 — it went viral in a group chat input_price_per_1M = 2.50 # GPT-4o daily_cost = (800 * 2000 / 1_000_000) * 2.50 = $4.00/day → $120/month just from system prompts Plus the actual user input tokens. Plus output tokens. $340 later, I had learned my lesson. The Real Problem: API Pricing Is Designed to Be Hard to Compare Every provider uses different units: OpenAI → per million tokens (input vs output, different rates) Pinecone → read units + write units + storage GB/month Stripe → % of transaction + fixed fee + monthly platform fee AWS Lambda → per GB-second + per request + data transfer None of it is comparable at a glance. You end up either building a spreadsheet from scratch every time or just guessing — and guessing gets expensive. What I Built After the invoice incident I started keeping a cost estimation spreadsheet. It grew. Eventually I turned it into APICalculators.com — 16 free, browser-based calculators covering the infrastructure decisions most AI/SaaS developers face: LLM APIs GPT-4o, Claude Sonnet, Gemini Flash, Llama — cost by model, context length, daily volume Side-by-side comparison at your exact usage Vector Databases Pinecone vs Qdrant vs Supabase vs Weaviate Enter index size + queries/day → monthly cost Serverless AWS Lambda vs Cloudflare Workers vs Vercel Functions Cost at your invocation volume and memory config Auth Providers Clerk vs Auth0 vs Supabase Auth vs Cognito Monthly cost by MAU tier Payment Processors Stripe vs Paddle vs Lemon Squeezy Real fee comparison on your transaction volume The System Prompt Problem, Solved in 30 Seconds Here's what the LLM cost calculator

Durante mucho tiempo asocié el desarrollo de software con programar funcionalidades: crear entidades, armar controladores, conectar una base de datos, validar formularios y hacer que una aplicación responda correctamente. Sin embargo, durante el Trabajo Final de la asignatura Desarrollo de Aplicaciones Web , entendí que programar es solo una parte del problema. El verdadero desafío aparece antes de escribir código: decidir qué arquitectura conviene, por qué conviene, cuánto cuesta, qué riesgos resuelve y qué complejidad agrega. El trabajo consistió en diseñar un sistema de gestión clínica que comenzaba como un MVP para una única clínica y evolucionaba progresivamente hacia una plataforma SaaS multi-tenant . Aunque fue un proyecto académico, el ejercicio nos obligó a pensar como si estuviéramos tomando decisiones técnicas en un contexto real: con restricciones de negocio, costos, equipo, seguridad, datos sensibles y crecimiento futuro. La principal enseñanza fue: la mejor arquitectura es la que responde mejor al momento del producto . El primer desafío: no sobrediseñar desde el inicio Cuando empezamos a pensar el sistema, la tentación era ir directamente a una arquitectura compleja: microservicios, eventos, colas, Kubernetes, múltiples bases de datos y despliegues independientes. Pero al analizar el escenario inicial, esa decisión no tenía sentido. El sistema comenzaba para una sola clínica, con un presupuesto reducido y con requisitos todavía en etapa de validación. En ese contexto, arrancar con microservicios hubiera agregado más problemas que beneficios: comunicación entre servicios, contratos, versionado, observabilidad distribuida, debugging más difícil y mayor costo de infraestructura. Por eso, una de las decisiones más importantes fue comenzar con una arquitectura en capas , desplegada como un único proceso. Esta elección permitió separar responsabilidades sin asumir desde el principio la complejidad de un sistema distribuido. La capa de presentación se encarg

A field guide to the practice that's reshaping how software gets built with AI agents. TL;DR — Spec-Driven Development (SDD) makes a precise, executable specification the source of truth and treats code as a generated, verifiable artifact. The spec declares intent ; the code realizes it. In 2026 it went mainstream because AI agents are great at writing code and terrible at guessing what you meant. Jump to: Why now · Specs vs. executable specs · Maturity model · Workflow · Tooling · EARS · Worked example · Caveats · Bottom line Why now? The "vibe coding" backlash The movement defines itself against "vibe coding" — the term Andrej Karpathy popularized in early 2025 for loosely prompting an AI and shipping whatever comes back. Vibe coding is great for throwaway prototypes and miserable for anything that has to be maintained. SDD is the disciplined counterweight: if AI writes most of the code, then the specification becomes the highest-leverage artifact a human produces . The skill that matters shifts from typing the implementation to defining the intent precisely enough that a machine can't get it wrong. Raw specs vs. executable specs This is the single most important distinction in the whole topic — and the one most "SDD explainers" skip. Traditional design docs SDD specs Read by Humans Humans and agents Enforcement Advisory — devs may diverge Executable — tests fail on drift Lifecycle Goes stale, becomes archaeology Living, continuously validated Lives in A wiki nobody opens The repo + CI/CD "Traditional specs are read by humans, while SDD specs are executed as BDD scenarios, API contract tests, or model simulations." — Deepak Babu Piskala, Spec-Driven Development: From Code to Contract in the Age of AI Coding Assistants (arXiv, Jan 2026) [2602.00180] Spec-Driven Development:From Code to Contract in the Age of AI Coding Assistants The rise of AI coding assistants has reignited interest in an old idea: what if specifications-not code-were the primary artifact of softw

Hey everyone, I've been deep in prediction market infrastructure for a while and just open-sourced a market maker bot designed for CLOB-based prediction markets like Polymarket. What it does: Quotes both sides of a binary market automatically Adjusts spreads based on order book depth and volatility Manages inventory risk to avoid getting stuck on the wrong side of a resolved market Built on top of Polymarket's CLOB API with Gnosis Safe / EOA wallet support on Polygon The core challenge with prediction markets vs. regular markets: Normal market making is about capturing spread. Prediction markets add a brutal edge case — resolution risk. If you're holding YES at 0.6 and the market resolves NO, you're not just down on the spread, you're down the full position. So the bot has to: Track time-to-resolution and widen spreads as resolution approaches Reduce inventory exposure on markets with high directional momentum Use FAK orders to avoid resting limit orders too long near resolution Stack: Rust Polymarket CLOB API Polygon (USDC settlement) SQLite for order state tracking What's next: Dynamic spread model based on implied volatility Multi-market portfolio rebalancing Better signal integration (news feeds, oracle data) GitHub: https://github.com/HarrierOnChain/Prediction-Markets-Trading-Bot-Toolkits Happy to answer questions on the architecture, risk model, or anything CLOB-related. Always looking for feedback from others building in this space.

This is a submission for the June Solstice Game Jam . What I Built Bletchley's Longest Day is a browser-based cipher escape game set inside a fictional Bletchley Park night shift. The player has to stop a U-boat convoy attack before dawn by clearing five rooms. Each room contains three escalating locks, so the full escape requires 15 solved puzzles . The game combines Caesar shifts, A1Z26 number decoding, Morse, anagrams, fragment ordering, a visible countdown timer, mistake penalties, hint penalties, account-based score saving, and a best-score leaderboard. The solstice theme became the core dramatic clock: night is running out, first light is coming, and the player has to decode the final signal before dawn. Video Demo The demo shows the opening briefing, the three-lock room flow, the Gemini hint penalty, and the final victory state that only appears after all 15 locks are cleared. Live game: https://bletchleys-longest-day.onrender.com Code Repository: https://github.com/himanshu748/bletchleys-longest-day How I Built It The game is a lightweight Node-served browser app. The front end is a hand-built HTML/CSS/JavaScript game surface, while server.js serves static files and protects the Gemini API key behind a server-side /api/hint endpoint. The main design goal was to make the game feel like a tense intelligence desk rather than a generic puzzle page. Every room has atmosphere, evidence props, lock-specific copy, feedback states, and a timer that is always part of the pressure. The puzzle structure was tuned around three ideas: Three locks per room : each room has to be solved in stages, so the player earns the escape instead of clicking through one answer. Time as score pressure : wrong answers and hints cost time, while clean solving preserves the best leaderboard run. Guest mode vs signed-in mode : guests can play the full game, but Gemini-powered hints and saved leaderboard scores belong to authenticated players. Google Gemini is used as a server-side hint offi

As a solo developer I wanted a fast, mobile-friendly interactive map for Palworld that didn't bury me in ads. The result is Pindrop , and here are a few of the technical decisions behind it. Rendering 1000+ markers without jank The interactive map uses Leaflet with a custom marker-clustering layer. Markers are served as static JSON from the edge and hydrated client-side, so the first paint is server-rendered and the heavy marker work happens after. A breeding calculator as a pure function Palworld's breeding combos are deterministic, so the breeding calculator is just a lookup over a precomputed table rather than a backend call. That keeps it instant and fully cacheable. Stack Next.js (App Router) for SSR + static generation Leaflet for the map layer Supabase for the small amount of dynamic data Vercel for hosting and edge caching If you play Palworld, the guides section collects the breeding, location and boss notes I kept losing track of. Feedback from other devs welcome — especially on the clustering approach.

Pre: What is BlockSocial? BlockSocial is the ultimate social network for developers, bringing the energy of short-form video to the world of open source. Think of it as Facebook meets Instagram—a place to showcase your code, find inspiration, and build your developer brand through "Reels" and interactive dashboards. Github link: https://github.com/Hfs2024/BlockSocial 1. User Scenario & Workflow (The Fork System) The Setup User A : Publishes a post saying: "I love drinking Pepsi every day." User B : Is shy, but wants to tell their friend this is an unhealthy habit. User C : Is a malicious user who gossips. The Fork Mechanism User B creates a fork to discuss this post with User C via the POST /api/share endpoint. Data Copying : It copies the entire post contents except comments, likes, reports, and downloads. Chain Prevention : You can fork a forked post, but the system will fork the original source root, not the fork itself. Scope : It shares with only one user at a time to prevent unexpected group creation. Database Payload for Forks The following fields are appended to the document structure: { "share" : true , "shareId" : "post._id" , // The original post ID "sharedBy" : "req.currentUser.username" , // The user who shared or forked "shareTo" : "shareTo" , // The friend receiving the share "shareComment" : "comment || ''" // A quick comment on the post } Moderation & Enforcement Workflow If User C breaks trust and leaks the conversation, User B can report them via the POST /report/user endpoint. Verification : Administrators review interaction history to verify the violation. Account Termination : Bad users receive a permanent lifetime account ban. Data Scrubbing : All associated messages from the malicious user are removed. Blacklisting : The account is fully banned. The Blindspot : Face-to-face interactions remain outside system moderation boundaries 😅 2. Technical Implementation Details Dynamic Comment Identity Logic When a user submits a comment via POST /api/c

Static sites are great: fast, cheap to host, almost nothing to attack. Then you add a contact form and hit the same wall everyone hits — a static site can't process a submission. You need a backend. The usual answers are a third-party service (Formspree, Netlify Forms, Basin) or a small server you now have to babysit. Both add a dependency you don't control, a recurring bill, and — the part that bugs me most — your submission data lives on someone else's infrastructure. There's a third option I've been running for a while: one WordPress install, zero public pages, used purely as a form endpoint. Every form from every static site I own hits it. I own all the data. And because it serves no public HTML, its attack surface is close to nothing. The architecture Three pieces, each doing one job: WordPress — the backend. Locked down so hard it doesn't behave like a normal WP site anymore. A form plugin — handles building, validation, storage, email, file uploads. (I use CraftForms because it exposes a clean craftforms/v1 REST namespace and can also serve the form HTML to an external page — more on that below.) Your static frontend — Cloudflare Pages / Netlify / wherever. It either fetch es the REST endpoint on submit, or drops in an embed snippet. WordPress never serves a public request. It only processes submissions. The part that matters: locking it down The biggest WordPress attack vector isn't your host — it's outdated plugins . So the first move is brutal minimalism: one plugin, no theme, no page builder, no public frontend. A WP install with one plugin and a blocked frontend has almost no CVE surface, because none of the usual stuff is installed. The rest is one must-use plugin. Drop this in wp-content/mu-plugins/ (no activation needed) and you've blocked the four standard entry points: <?php if ( ! defined ( 'ABSPATH' ) ) exit ; // 1. Restrict the REST API to your form namespace only. // Kills user enumeration (/wp/v2/users), route discovery, the usual REST exploits

A few months ago, I was overwhelmed by everything happening in AI. Every week there was a new coding assistant, a new workflow, or someone claiming they built an app in just a few hours. It felt like if you weren't keeping up, you'd be left behind. I tried almost everything. Cursor. ChatGPT. Claude Code. Lovable. At first, I kept switching between tools, hoping one of them would magically make me a better developer. It didn't. The biggest lesson I learned wasn't about choosing the best AI tool. It was learning how to work with AI. These days, I don't start by asking AI to write code. I start by explaining the problem. I describe the feature, the business requirements, the edge cases, and what I want the final result to look like. Sometimes I ask ChatGPT to help me plan the implementation first. Once everything is clear, I pass that plan to an agentic coding assistant and start building. That one change made a huge difference. I spend less time writing boilerplate and more time thinking about architecture, user experience, and solving the actual problem. AI still gets things wrong, so I review everything before it goes into production. But instead of writing every single line myself, I'm guiding the process. Looking back, the first few months were the hardest. Now it just feels normal. The tools will keep changing, but I think the real skill is learning how to communicate with AI and use it as part of your development process. That's something worth investing in.

How to Access 50+ Chinese AI Models Through One API The Chinese AI ecosystem exploded in 2025-2026. DeepSeek dropped training costs by an order of magnitude. Qwen 3 ships 19 variants from 0.6B to 235B parameters. GLM-5 competes head-to-head with GPT-5 at 3% of the price. There's Kylin, Yi-Lightning, Hunyuan-T1, MiniMax-M1, Step-2-16K, and 40+ more models from a dozen labs. The models are incredible. The fragmentation is not. Every lab has its own API. Different auth headers. Different response formats. Different streaming protocols. Different error codes. If you wanted to try 5 models from 5 Chinese labs last year, you'd need 5 SDKs and 5 billing dashboards. Nobody has time for that. This is exactly the problem AIWave was built to solve. One API Key. 50+ Models. Zero Code Changes. AIWave is a unified API gateway that aggregates 50+ Chinese AI models behind a single endpoint. It speaks the OpenAI API format, which means every existing tool, SDK, and codebase in your stack works without modification. Here's what that looks like in practice: from openai import OpenAI # Point to AIWave instead of OpenAI client = OpenAI ( base_url = " https://api.aiwave.live/v1 " , api_key = " sk-your-aiwave-key " ) # Use DeepSeek V4 Pro response = client . chat . completions . create ( model = " deepseek-v4-pro " , messages = [{ " role " : " user " , " content " : " Explain MoE architecture " }] ) # Switch to GLM-5 — change one string response = client . chat . completions . create ( model = " glm-5 " , messages = [{ " role " : " user " , " content " : " Explain MoE architecture " }] ) # Try Qwen 3 235B — same thing response = client . chat . completions . create ( model = " qwen3-235b " , messages = [{ " role " : " user " , " content " : " Explain MoE architecture " }] ) That's it. Whatever you're already using — the OpenAI Python SDK, LangChain, LlamaIndex, Vercel AI SDK, a custom fetch wrapper — continues to work. You change the base URL and the model name, and suddenly you have acce

CircleCI has launched Chunk Sidecars, a new capability designed to bring CI-style validation directly into an AI coding agent's inner development loop By Craig Risi

We've lost something in the past 15 years. Netflix, Amazon, Disney, Apple; they've all convinced us that streaming is the best way to watch movies and shows at home. With everything at our fingertips, there's no need to run to Blockbuster for the weekend's entertainment, or wait for a DVD rental to arrive in the […]

TSRX is a TypeScript language extension developed by Dominic Gannaway, designed to build declarative user interfaces in a framework-agnostic manner. It compiles single .tsrx files to various runtime targets and supports scoped styles and declarative error handling. TSRX is currently in alpha and is open source under the MIT license. By Daniel Curtis

Even after your movies end, these art televisions look stunning on any wall.

Hello Dev Community! 👋 It is officially Day 45 of my non-stop run toward full-stack engineering! Yesterday, I learned how to serve static HTML pages using Express routing. Today, I took a major step toward building premium, clean, and minimalist UI/UX styles by installing and mastering Tailwind CSS via the Tailwind CLI ! Instead of writing massive, chaotic external CSS stylesheet files, today I shifted to the industry-standard utility-first workflow to speed up my design iterations. 🧠 Key Learnings From Day 45 (Tailwind CSS Architecture) Tailwind doesn't give you pre-built components; it gives you atomic utility classes that let you build completely custom, high-end layouts directly inside your HTML structure. Here is the engineering breakdown: 1. Tailwind CLI Installation & Initialization I learned how to integrate Tailwind from scratch using npm packages instead of lazy CDN links. Installed the tailwindcss compiler core ( npm install -D tailwindcss ). Initialized the configuration hub using npx tailwindcss init . 2. Crafting the Content Map inside tailwind.config.js Understood how Tailwind optimizes final file weights using tree-shaking. I configured the structural template paths so the compiler knows exactly which files to scan for dynamic styling classes: javascript /** @type {import('tailwindcss').Config} */ module.exports = { content: ["./public/**/*.{html,js}"], // Scanning static folders cleanly theme: { extend: {}, }, plugins: [], }