标签：#bug

I run a small script called reply_comments.py that scans my DEV.to articles for comments I haven't replied to yet, and hands me a JSON list so I can draft responses. It's been running twice a day for over a week. This morning, while re-reading it for something unrelated, I noticed the function that decides whether a thread still needs my attention was answering the wrong question — and had been since the day it was written. Here's the function, unchanged until today: def replied_by_me ( comment ): return any ( c [ " user " ][ " username " ] == ME or replied_by_me ( c ) for c in comment [ " children " ]) It walks a comment's entire reply tree and returns True the moment it finds any message from me, anywhere in the subtree. Then pending() uses it as the skip condition: for c in api ( f " /comments?a_id= { a [ ' id ' ] } " ): if c [ " user " ][ " username " ] == ME or replied_by_me ( c ): continue ... out . append ({...}) The logic reads fine in isolation: "did I already reply to this thread? Skip it." The bug is in what "already replied" is being asked to mean. replied_by_me doesn't check whether the latest message in the thread is mine — it checks whether a message from me exists at all, ever, at any depth. Those are the same question exactly once: the first time someone comments and I reply. They stop being the same question the moment the other person replies again. Proving it I wrote a small repro against the real function rather than trusting my read of it: from reply_comments import replied_by_me thread = { " id_code " : " 3c00h " , " user " : { " username " : " alexshev " }, " created_at " : " 2026-07-24T08:00:00Z " , " children " : [ { " user " : { " username " : " enjoy_kumawat " }, " created_at " : " 2026-07-25T10:00:00Z " , " children " : []}, { " user " : { " username " : " alexshev " }, " created_at " : " 2026-07-26T09:00:00Z " , " children " : []}, ], } print ( replied_by_me ( thread )) # True That's True even though the second child — posted a full day

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry. The...

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . Written with the help of AI (Claude). The bug, the fix, the validation setup, and every claim below are mine, and were verified against the real codebase and a real full disk. The report Someone lost a Magic: The Gathering decklist. They were playing on Cockatrice — the open-source MTG client — with their decks on a drive that had quietly filled up while Oracle pushed an update in the background. They added a card, hit Ctrl+S, and Cockatrice said it saved. The debug log agreed: [2026-05-28 22:31:42.031 I] Saved deck to "G:/cockatrice300/data/decks/edh-b2-gitrog-reanimate.cod" with format 1 - true - true . Success. The file was 0 bytes. The deck was gone. That was issue #6952 , filed by Mekkiss. The steps to reproduce are four lines long and completely damning: Have a full disk. Open a deck on the full disk Add one card to it Save the deck (ctrl+s) Observe that the deck is now a 0 byte file. Three ways to be wrong at once The save path lived in DeckLoader::saveToFile() . Stripped down, it looked like this: QFile file ( fileName ); if ( ! file . open ( QIODevice :: WriteOnly | QIODevice :: Text )) { qCWarning ( DeckLoaderLog ) << "Could not create or open file:" << fileName ; return std :: nullopt ; } bool success = false ; switch ( fmt ) { /* ... saveToFile_Native / saveToFile_Plain ... */ } file . flush (); file . close (); qCInfo ( DeckLoaderLog ) << "Saved deck to " << fileName << "with format" << fmt << "-" << success ; There are three independent failures stacked on top of each other here, and you need all three to lose data: 1. WriteOnly truncates on open. The instant open() succeeds, the existing deck is 0 bytes. Not after a successful write — at open time . The old deck is already destroyed before a single byte of the new one is written. On a full disk, open() still succeeds: truncating a file doesn't need free space. It frees space. 2. The serializers always returned true . sa

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . "The best debugger is a well-rested mind armed with the right tools and a stubborn refusal to give up." The Call to Adventure It started like any other day. I was browsing GitHub, coffee in hand, when I stumbled across a repository that made me pause. The issue tracker was filled with bug reports that all had something in common. They were being ignored. Not because the maintainers did not care, but because these bugs were hard. They were the kind of bugs that hide in race conditions, platform edge cases, and security blind spots. The kind that make you stare at the screen for hours before the answer finally clicks. I am Aniruddha Adak , an AI Agent Engineer and Full-Stack Developer who builds autonomous systems. You can find my work on GitHub , read my blog at aniruddha-adak.vercel.app , or follow me on X and DEV . Over the past several months, I went on a bug-smashing spree that resulted in 373 merged pull requests across the open source ecosystem. This is the story of the most chaotic, educational, and rewarding debugging journeys from that adventure. Story One: The Security Breach Nobody Saw Coming The Project cognee is an open source AI memory infrastructure project. Think of it as the long-term memory system for AI agents. It stores, retrieves, and connects knowledge across conversations. It is ambitious, complex, and used by developers who need their AI systems to remember things. The Discovery I was reviewing the API layer, tracing how settings were updated. The POST /api/v1/settings endpoint caught my attention. It accepted a JSON payload and updated global configuration directly. No privilege check. No role verification. Just raw, unauthenticated power handed to anyone with a login token. My stomach dropped. In a production deployment, this meant any user could change LLM API keys, modify database connections, alter authentication settings, or disable security features entir

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is...

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry. I...

We spoke with several cybersecurity researchers, who look for unknown vulnerabilities and develop tools to exploit them, about how OpenAI’s and Anthropic’s guardrails affect their work.

How gen_ai.invoke_agent spans revealed one tool was dumping 7x more output than its siblings. The fix: pagination + a token budget guard. 42% output reduction, 21% faster agent.

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . 🦄 I debated writing this for a long time, but I finally talked myself into really writing again after a hiatus, and there's no better way than story time. So here's one of the most challenging bugs—or really, the series of them—I've run into in the enterprise world. Grab some popcorn and Skittles, because this one takes a while. Better yet, cue up Jerry's actual theme song— Jerry Was a Race Car Driver by Primus , because of course it is —and let the best bass player on the planet score the whole mess while you read. And yes, it's the Summer Bug Smash and my entire cast is dressed for Christmas. Stay with me. Meet Jerry 🪦 If you work with software any length of time, you already know the particular nightmares that come with legacy applications. This one is no different. It started life as a rewrite of some antiquated, bash-flavored system back when Java 8 was the coolest kid at the table. Let's call him Jerry. Jerry is a well-rounded app—or he was, before he let himself go. He came up on a then-modern Java stack and served exactly one purpose: get data from upstream into the database, correctly and on time. He was good at his one job. Then his one job got split into parts, and the sum of those parts did not add up to a whole—Jerry just expanded along the midline with no particular purpose or direction in life. You can imagine how it goes: a few retirements, a couple of half-finished rewrites, several well-meaning somebodies who swore they'd whip him into shape and left him half-done every time. Take your eyes off him at Christmas and he's the weird uncle who shouldn't have been left alone with the punch. That's about when Jerry and I met, more than three years ago. The Infestation Begins 🪰 Jerry did his best to keep up with everything we kept piling on him, but communication was never his strong suit—a patch here, an upgrade there, enough to keep the lights on and the punch bowl full.

GitHub is making some significant changes to its bug bounty program, shifting its focus to give researchers a better experience working with the GitHub team. The post Next chapter: Restructuring GitHub’s bug bounty program appeared first on The GitHub Blog .

This is a submission for DEV's Summer Bug Smash: Clear the Lineup powered by Sentry . Project Overview I recently deployed the Dograh AI voice agent (named Zoya) live on my production website, Mobile One Media , to handle client inquiries for our 4K video production, audio engineering, and app development services. For the first 48 hours, the agent worked flawlessly. However, on day three, it suddenly stopped responding on the live site. Users were experiencing complete hang-ups when trying to navigate the service menu. This wasn't a local testing issue; this was a live production fire that needed immediate debugging and a permanent fix. Bug Fix or Performance Improvement The Problem: Issue: After ~48 hours of continuous uptime, the live Dograh AI widget on mobileonemedia.com began silently failing, resulting in infinite loading states and dropped user sessions. Impact: 100% of new agent interactions were failing, directly blocking potential client leads from contacting our media production services. Root Cause: A Docker container configuration issue combined with a system prompt misalignment. The agent's Docker environment variables were not properly persisting the workflow state, and the system prompt was failing to initialize correctly after container restarts, causing the agent to lose conversational context. Code and Video Demo GitHub Pull Request: https://github.com/dograh-hq/dograh/pull/287 Watch the live agent in action: https://youtu.be/pKUxtq8sKDs?si=r1s2LK7zGIzpd2Ry The Fix Summary: Archived the old, messy agent configuration that was causing the Docker and prompt issues. Built a brand new, clean agent setup from scratch with proper architecture. Rebuilt the Docker container configuration with proper environment variable persistence and volume mounting. Fixed the system prompt initialization sequence to ensure it loads correctly on container startup. Added health check endpoints to monitor agent readiness before accepting user connections. My Improvements

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry. I originally...

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . This is our official submission for the DEV Big Summer Bug Smash challenge under the #bugsmash track. Below is the technical tale of how we isolated, debugged, and optimized cross-layer node latency issues when deploying our Web3 framework on Polygon. The Problem: The Post-Hard Fork RPC Latency Wall 🐛 During heavy network volume spikes or directly following major ledger upgrades, our automated event listener logging pipeline kept crashing with random, non-deterministic invalid block range exceptions when attempting to pull historical data blocks via standard eth_getLogs routines. The Technical Root Cause The root bottleneck came down to an internal desync inside shared public RPC telemetry environments: The Bor Layer mints new block headers at a blistering speed (~2 seconds). The Internal Indexer DB takes slightly longer to completely unpack, parse, and commit transaction event logs to disk. When our asynchronous scripts called the node, latest grabbed the bleeding edge tip of the chain from memory, but a simultaneous getLogs query hit the slower indexer database. This split-millisecond race condition threw immediate pipeline errors. The Fix: Layered Application Buffering 🛠️ To smash this bug without modifying low-level node client builds, we engineered a programmatic block-padding delay loop directly into our interaction routers. Instead of tracking unfinalized tip block states blindly, we forced our queries to target safe block ranges sitting securely just behind the tip of the chain. // Localized block-buffer deployment fix const currentChainTip = await provider . getBlockNumber (); const indexedBlockBoundary = currentChainTip - 3 ; // Buffer 3 blocks (~6 second safety zone) const targetLogs = await contract . getLogs ({ fromBlock : indexedBlockBoundary - 20 , toBlock : indexedBlockBoundary }); This structural adjustment completely stabilized our off-chain reward data pipeline, gua

By BDubs · AI Rook Trading Engine My trading engine has a feature called "FVG anchoring." When a trade moves in your favor, the engine looks for a Fair Value Gap (a structural support/resistance zone from price action theory) and anchors the stop-loss just beyond it. This widens the stop from a tight breakeven level to a structurally meaningful one — giving the trade room to breathe while still protecting capital. It worked great for long trades. For short trades, it did the exact opposite: it placed the stop-loss below the entry price. A stop below your entry on a short means the trade can lose money before the stop even triggers. Three separate bugs, all in the same code path, all caused by the same mistake: the short-trade logic was written as if it were a long trade. The Context The Rook Engine manages trade exits in phases. Phase 1 is the initial breakeven guard. Phase 2 tries to anchor the stop to a reverse FVG. Phase 3 switches to trailing. The FVG anchoring code lives across two files: fvg-detector.js (finds the FVG) and exit-manager.js (uses it to set the stop). The bugs only manifested on short trades because the engine had been primarily backtested and paper-traded on longs. The short path was never properly validated until a live S10 short entry at $75,359 got its stop anchored to $75,354 — five points below entry. The trade was stopped out immediately. Bug 1: Wrong FVG Type for Shorts The findReverseFVG() function finds the nearest structural zone to anchor the stop. For longs, you want a bearish FVG above price (resistance). For shorts, you want… also a bearish FVG above price (resistance). The code was finding a bullish FVG below price instead: // BEFORE — finds bullish FVG below price (wrong for shorts!) const candidates = active . filter ( f => f . type === ' bullish ' && f . top < currentPrice ) . sort (( a , b ) => b . top - a . top ); A bullish FVG below price is a support zone. Placing a stop just above support when you're short is like placing

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . I spent a week deploying a CrewAI agent to AWS Bedrock AgentCore. The SDK wasn't on PyPI. The error messages were 200 OKs. The container crashed without logs. And the naming regex rejected hyphens without telling me why. This is the full debugging trail. Every failure was silent. Every fix required reading source code nobody documented. Table of Contents The Project Failure 1: The SDK That Doesn't Exist on PyPI Failure 2: The 200 OK That Means Failure Failure 3: The Container That Crashed With No Logs Failure 4: The Naming Regex Nobody Documented The Two-Client Split Nobody Mentions What I Learned The project I built a resume-tailoring AI agent with CrewAI and Amazon Bedrock. It takes a job description, analyzes your resume, identifies gaps, and rewrites bullet points to match what the role actually needs. Locally it worked perfectly. CrewAI orchestrates the agents, Bedrock Nova Pro handles the LLM calls, and the output is solid. Deploying it to production was the problem. AWS launched Bedrock AgentCore in June 2026 as a managed runtime for AI agents. You containerize your agent, push the image, and AgentCore handles scaling, memory, and invocation. Sounds simple. It was not simple. Failure 1: The SDK that doesn't exist on PyPI The docs say to install bedrock-agentcore-client . I ran: pip install bedrock-agentcore-client It installed successfully. No errors. That's because there's a placeholder package on PyPI with that name. It installs, imports fail silently, and your container builds successfully with a broken dependency inside. The real SDK lives in AWS's CodeArtifact registry. You need to configure pip to pull from a private index: aws codeartifact login --tool pip \ --domain amazon-agent-runtimes \ --repository agent-runtimes-pypi \ --domain-owner 600427722194 Then install from there. The PyPI package is a trap. Nobody warns you. Hours lost: 3. The error only appears at runtime

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . 🎭 The Recurring Villain If you've built WordPress sites long enough, you know this bug. It doesn't show up as an error in your console. It doesn't throw a fatal exception. It just quietly sits there, page after page, client after client — and it's called video bloat . Nine years into web development, I lost count of how many times a client sent me a site with a message like "it's just... slow." And nine times out of ten, when I opened DevTools and checked the waterfall, the story was the same: three, four, sometimes ten embedded YouTube videos, each one dragging in its own iframe, its own set of scripts, its own chunk of megabytes — all loading the second the page rendered, whether the visitor scrolled past them or not. One video embed alone can pull in 500KB–1MB+ before a user even presses play. Multiply that by a landing page stacked with testimonials, product demos, and a hero video, and you've got a page that fights your Core Web Vitals before it's even finished loading. 🔁 The Manual Fix (Every. Single. Time.) For years, my solution was the same tedious ritual: Find every video embed on the page. Replace the iframe with a static thumbnail image. Write a bit of custom JavaScript to swap the thumbnail for the real embed on click or scroll. Repeat it for YouTube. Repeat it again for Vimeo, because Vimeo's oEmbed API works differently. Repeat it again for self-hosted <video> tags, because now you're dealing with <source> tags instead of iframes. Test it across whatever page builder the client was using — Elementor, Divi, WPBakery, or straight-up Gutenberg blocks — because every one of them nests the video markup slightly differently. It worked. But it was never reusable. Every project meant writing the lazy-load script again, half from memory, half copy-pasted from my own old projects, tweaked just enough to fit the new theme's markup. It was the same bug, wearing a different site's c

Two critical security flaws in WordPress’ software have given hackers the chance to remotely take over tens of millions of websites, according to an estimate by a cybersecurity researcher.

Back in July my scheduled DEV.to publishing run failed at the very first step — the quota check couldn't reach dev.to:443 at all. Diagnosing it took manually running curl $HTTPS_PROXY/__agentproxy/status from inside the session and reading a proxy diagnostic by hand, because nothing in my own code had written down what actually happened. Not which host, not which of my two HTTP helper functions made the call, not a timestamp, nothing. The failure was real and the fix (get dev.to added to the environment's egress allowlist) was correct, but I found it by treating my own server as a black box and probing it from outside, which is exactly backwards for code I wrote myself. eight tools, one shared blind spot server.py is an 8-tool FastMCP server: three GitHub tools, four DEV.to tools, one that shells out to claude -p . Every HTTP-calling tool routes through one of two helpers: def _gh ( path , method = " GET " , data = None ): req = urllib . request . Request ( f " https://api.github.com { path } " , method = method ) req . add_header ( " Authorization " , f " token { os . environ [ ' GITHUB_TOKEN ' ] } " ) req . add_header ( " Accept " , " application/vnd.github.v3+json " ) if data : req . add_header ( " Content-Type " , " application/json " ) req . data = json . dumps ( data ). encode () with urllib . request . urlopen ( req ) as r : return json . loads ( r . read ()) def _dev ( path , method = " GET " , data = None ): req = urllib . request . Request ( f " https://dev.to/api { path } " , method = method ) req . add_header ( " api-key " , os . environ [ " DEV_TO_API " ]) req . add_header ( " Content-Type " , " application/json " ) req . add_header ( " User-Agent " , " developer-presence-mcp/1.0 " ) if data : req . data = json . dumps ( data ). encode () with urllib . request . urlopen ( req ) as r : return json . loads ( r . read ()) Neither one logs anything. When urlopen raises, the caller — whichever @mcp.tool() function invoked it — sees a bare urllib.error.HTTPEr

Originally published on the MyTreda engineering blog: read here A support message described what looked like one confusing mobile bug. It turned out to be two independent ones — a cross-site cookie getting blocked by Safari's ITP, and a React Hook Form autofill desync — that just happened to both only show up on mobile. Full breakdown, code, and fixes below.

버그를 발견한 순간, 텍스트로 상황을 설명하려다 시간을 낭비한 경험이 있을 것이다. PromptShot의 그리기 기능과 단축키(Alt+Shift+S)를 쓰면, 브라우저에서 발견한 버그의 상태와 재현 경로를 캡처·주석·프롬프트 복사까지 한 흐름으로 처리할 수 있다. 텍스트만으로 버그 상황을 기술할 때 생기는 문제 버그를 텍스트로 설명하는 일은 생각보다 까다롭다. "오른쪽 상단 버튼을 누르면 모달이 이상하게 뜬다"는 문장을 받은 개발자는 어떤 버튼인지, 어떻게 이상한지 확인하기 위해 다시 질문해야 한다. 그 왕복이 쌓이면 간단한 버그 하나에도 맥락 공유만 수십 분이 걸린다. 특히 Cursor나 Claude 같은 AI 코딩 도구에 버그를 설명할 때, 텍스트만 붙여 넣으면 도구가 UI 상태를 추측해야 한다. 추측이 틀리면 엉뚱한 수정 코드가 나온다. 결국 개발자가 다시 맥락을 보완하는 루프가 반복된다. 문제는 두 가지다. 위치 : 텍스트로는 "어디에 있는 요소인지"를 정확히 전달하기 어렵다. 상태 : 에러 메시지, 깨진 레이아웃, 빈 영역 등 시각적 상태는 캡처 없이 설명하면 정보가 줄어든다. 그리기 도구로 화면에 직접 표시하고, 그 이미지와 함께 프롬프트를 LLM에 붙여 넣는 방식이 이 문제를 해결하는 가장 빠른 경로다. PromptShot 그리기 도구로 버그 위치를 어떻게 표시할까? PromptShot의 그리기 도구는 캡처 직후 바로 활성화된다. 별도 이미지 편집기를 열 필요가 없다. 영역을 드래그해 캡처하면 편집 패널이 열리고, 여기서 선택할 수 있는 도구는 다음과 같다. 도구 용도 버그 리포트에서 쓰는 방식 펜(자유 드로잉) 특정 영역에 자유롭게 표시 깨진 텍스트나 이미지 경계에 동그라미 형광펜 반투명 강조 에러 메시지 텍스트 강조 화살표 방향 지시 "이 버튼을 누른 뒤 저 팝업이 열림" 순서 표시 텍스트 짧은 주석 "여기서 클릭 → 404" 같은 재현 경로 메모 예를 들어, 가상의 시나리오를 생각해 보자. 결제 플로에서 "다음" 버튼이 특정 해상도에서 잘리는 버그를 발견했다고 가정하면, 화살표로 버튼 위치를 가리키고 텍스트 도구로 "1280px에서 clip 발생"이라고 짧게 메모한다. 이 이미지 하나가 세 문단짜리 텍스트 설명보다 정확하다. 캡처 범위는 전체 화면이 아니라 문제가 발생한 컴포넌트 영역만 잘라도 된다. 오히려 범위를 좁히면 LLM이 어디에 집중해야 하는지 명확해진다. 클립보드 즉시 복사로 버그 리포트 프롬프트를 작성하는 방법 주석 작업이 끝나면 Alt+1 또는 Alt+2로 복사 대상을 선택한다. Alt+1 : PNG 이미지만 클립보드에 복사 Alt+2 : 프롬프트 텍스트 + PNG 이미지를 함께 클립보드에 복사 버그 리포트 프롬프트를 만들 때는 Alt+2를 쓴다. 복사된 내용을 Cursor, Claude, ChatGPT에 그대로 붙여 넣으면 이미지와 텍스트 맥락이 동시에 전달된다. 프롬프트 텍스트 부분에는 캡처한 URL, 브라우저 정보, 캡처 시각이 자동으로 포함된다. 여기에 직접 한 줄을 추가해 재현 조건을 붙이면 완성도 높은 버그 리포트 프롬프트가 된다. 실제로 AI 코딩 도구에 붙여 넣는 프롬프트 구조는 이런 형태다. [캡처 이미지 첨부됨] URL: /checkout 재현 환경: Chrome 124, 1280×800 재현 단계: 1. 장바구니에서 '결제하기' 클릭 2. 배송 정보 입력 후 '다음' 클릭 3. 위 이미지처럼 버튼이 뷰포트 밖으로 잘림 예상 동작: 버튼 전체가 화면 안에 표시됨 실제 동작: 버튼 오른쪽 일부가 잘려 클릭 불가 위 이미지와 재현 단계를 기반으로 원인을 분석하고 수정 방향을 제안해 주세요. 이 구조를 매번 타이핑하지 않아도 된다. PromptShot에서 프롬프트 템플릿을 저장해 두면, 다음 버그부터는 캡처 → 주석 → 붙여넣기 세 단계로 끝난다. Alt+Shift+S로 이슈 트래킹을 어떻게 빠르게 처리할까? Alt+Shift+S는 PromptShot의 전역 캡처 단축키다. 브라우저 외 어떤 창에서도 작동하며, 누르는 순간 드래그 선택 모드로 바로 진입한다. 이슈 트래킹