标签：#ev

Using AI to find authorization bugs — and to prove the ones that aren't real Draft flagship post. Safe to publish now (no undisclosed vulnerabilities). The production case study referenced at the end is withheld pending coordinated disclosure. In 2026, bug bounty programs started closing their doors. Nextcloud suspended paid rewards, citing a flood of AI-generated, low-quality reports. Mattermost ended its program. The Internet Bug Bounty cut payouts by roughly 80%. The common thread isn't that AI can't find bugs — it's that most AI-assisted "findings" are plausible but wrong , and triage teams are drowning in them. That reframes the problem. The scarce skill in 2026 isn't generating candidate vulnerabilities — a language model will hand you fifty before lunch. It's refuting the forty-nine that don't hold . The differentiator is a method whose primary output is correct negatives . Here's the method I use for source-available targets, and a worked example where the honest result was "there's no bug here." The method: fan out to find, converge to refute Two stages, two different cost tiers: Fan-out (cheap models). Split the target's authorization surface into subsystems and read each in parallel. Each reader's only job is to surface candidate broken invariants — places where an object is loaded by ID without an owner check, where a protected action might skip a re-auth gate, where two code paths authorize the same thing differently. Optimize for recall. Expect mostly false positives. Adversarial verification (an expensive, high-reasoning model). Take each candidate and try to kill it. Default to REFUTED. A candidate survives only if you can cite the specific source lines proving the guard is absent and the dangerous path is reachable and nothing upstream already blocks it. Frame every survivor as a broken invariant — a one-sentence statement of the rule the system must never violate — and classify it as core versus config-dependent. The output that matters most is the

Introduction to Hydration and Rendering Strategies In the relentless pursuit of faster, more responsive web applications, developers have engineered a spectrum of hydration and rendering strategies . Each approach emerges as a response to specific performance bottlenecks, yet none is universally optimal. This section dissects the core mechanics of these strategies, their historical evolution, and the critical problem they aim to solve—balancing speed with practicality. The Problem: A Trade-Off Landscape At its core, the challenge is mechanical : how to deliver content to the user’s browser with minimal latency while maintaining interactivity. Traditional rendering methods (e.g., server-side rendering) prioritize initial load speed but often defer interactivity until JavaScript execution. Client-side rendering, conversely, delays the first paint but ensures seamless interactions post-hydration. The tension between these extremes has birthed hybrid strategies like incremental hydration and islands architecture , each addressing specific failure points in the rendering pipeline. Key Mechanisms Driving Strategy Evolution Advancements in Web Technologies : New APIs (e.g., Web Components, Streaming SSR) enable finer-grained control over rendering. For instance, streaming SSR reduces Time-to-First-Byte (TTFB) by sending HTML in chunks, but risks breaking the causal chain of DOM hydration if not synchronized with client-side scripts. User Expectations : Sub-second load times are no longer aspirational but expected. This pressure deforms traditional workflows, pushing developers toward pre-rendering or static site generation (SSG), which trade dynamic flexibility for speed by offloading rendering to build time. Competitive Pressure : Performance is a zero-sum game. Companies adopt strategies like partial hydration (hydrating only interactive components) to minimize JavaScript payload, but this risks breaking interactivity if the hydration boundary is misaligned with user int

A large-scale audit of AI-as-judge evaluation — covering over half a million individual judgments — finds that AI judges are consistently reliable but not valid, meaning they give the same answer repeatedly without that answer being correct. Published work and popular benchmarks like Chatbot Arena have treated consistency as proof of trustworthiness, and the audit shows that assumption is unfounded. Key facts What: Using one AI to grade another is now common — but the biggest audit yet shows these graders are consistent without being correct. A judge that always picks "answer A" scores perfectly on consistency. When: 2026-06-19 Primary source: read the source (arXiv 2606.19544) The distinction matters: a judge is reliable if it's consistent (same question, same answer), and valid if those answers are actually correct. The audit's central finding is that AI judges are reliable without being valid, and the field has been treating the first as evidence of the second. Because consistency is easy to measure and looks reassuring, it has stood in for actual trustworthiness across a lot of published work. A new audit makes the problem stark: a judge that ignores both answers and always picks the one labeled "A" would be perfectly consistent — flawless reliability, identical verdict every time — and completely worthless, because it never read anything. Consistency is trivially easy to fake and says almost nothing about whether the judging is sound. Yet "the judge agrees with itself" has done significant reassurance work in papers and benchmarks, and the always-pick-A example shows exactly how empty that reassurance is. When the researchers corrected for the agreement you'd get by chance — as any fair test should — confident-looking scores deflated noticeably. Gaps between models that seemed meaningful shrank or blurred. Accepted folk wisdom also took a hit: the long-standing worry that AI judges are suckers for longer, wordier answers turned out to be far weaker than assumed

HTTP cookies are everywhere in authentication, sessions, and tracking — but reading Set-Cookie headers manually is tedious. I built a free, browser-only HTTP Cookie Inspector that parses cookie strings and gives you a security analysis. Live Tool 👉 https://devnestio.pages.dev/cookie-inspector/ What it does Parse Set-Cookie strings — extract all attributes at a glance Attribute cards — name, value, expires/max-age, domain, path, Secure, HttpOnly, SameSite Security score (0–100) — +25 for Secure, +25 for HttpOnly, +25 for SameSite≠None, +25 for expiry XSS/CSRF risk flags — warns when HttpOnly or SameSite is missing Syntax highlighted raw header — color-coded by attribute type Presets — session, persistent, secure+httponly, SameSite=Strict, minimal 100% client-side — no data leaves your browser Cookie security flags explained Flag Missing risk Present benefit Secure Cookie sent over HTTP Only sent over HTTPS HttpOnly JS can steal it (XSS) Inaccessible via document.cookie SameSite=Strict CSRF attacks possible Never sent on cross-site requests SameSite=Lax Partial CSRF risk Sent on top-level nav only SameSite=None Always cross-site Requires Secure flag SameSite values Set-Cookie: session=abc123; SameSite=Strict; HttpOnly; Secure # Best practice for auth cookies Set-Cookie: prefs=dark; SameSite=Lax # OK for non-sensitive preferences Set-Cookie: embed=true; SameSite=None; Secure # Cross-site embeds (e.g. payment widgets) Testing 84 tests, all passing ✅ Tests cover: Parsing all standard attributes Boolean flags (Secure, HttpOnly) detection SameSite value classification Max-Age duration calculation Security score computation XSS/CSRF warning logic All preset templates HTML escaping in output UI elements and copy functionality All tools at devnestio.pages.dev — free browser-only developer utilities.

Working With Massive JSON Responses Without Losing Performance Every developer eventually encounters it. You make an API request expecting a few hundred objects, and instead receive a response that's tens—or even hundreds—of megabytes. Suddenly your browser freezes, your editor becomes sluggish, and your application consumes gigabytes of memory. Large JSON responses aren't unusual anymore. Analytics platforms, cloud providers, search engines, AI services, ecommerce catalogs, IoT systems, and data export endpoints routinely generate enormous payloads. The good news is that handling massive JSON efficiently is mostly about choosing the right techniques. This guide covers the best practices that help you inspect, process, and optimize large JSON datasets without overwhelming your tools or your users. Understand Why Large JSON Is Expensive Before optimizing, it's helpful to know where the cost comes from. When an application receives JSON, it usually goes through several stages: Download the response. Store it as a string. Parse it into objects. Allocate memory for every property. Traverse the resulting object graph. For a 100 MB JSON file, peak memory usage can easily exceed 300 MB because both the raw string and the parsed objects coexist temporarily. This explains why applications often run out of memory long before reaching the actual file size. Don't Pretty-Print Gigantic Responses Immediately Pretty-printing is useful—but formatting a huge document all at once can consume significant CPU time and memory. Instead: inspect only the sections you need collapse large objects expand nodes on demand search before formatting If you need to examine a large payload in the browser, using a dedicated formatter designed for large documents can make navigation much easier. Tools like JSON Formatter allow you to validate, format, collapse, and inspect JSON without manually editing thousands of lines. Stream Instead of Loading Everything One of the biggest mistakes is reading an

Debugging JWT authentication usually means copying tokens between tabs and tools. I built a free, browser-only JWT Creator & Signer — create, sign, and verify JWTs entirely in your browser using the Web Crypto API. Live Tool 👉 https://devnestio.pages.dev/jwt-creator/ What it does Create JWTs — edit header (alg, typ) and payload (any JSON) Sign with HMAC — HS256, HS384, or HS512 Quick claim buttons — insert sub , name , exp (+1h), iss with one click Generate random secrets — 256-bit hex secret via crypto.getRandomValues() Verify existing JWTs — paste any token and verify signature + expiry Color-coded output — header in red, payload in green, signature in blue 100% client-side — Web Crypto API, no server, your secrets stay local How signing works (Web Crypto API) const key = await crypto . subtle . importKey ( " raw " , new TextEncoder (). encode ( secret ), { name : " HMAC " , hash : " SHA-256 " }, false , [ " sign " ] ); const sig = await crypto . subtle . sign ( " HMAC " , key , new TextEncoder (). encode ( header + " . " + payload ) ); The output is base64url-encoded (replacing + → - , / → _ , stripping = padding) to form the final JWT. Why browser-only matters for a JWT tool JWT secrets are sensitive. Any tool that sends your signing secret to a server is a liability. This tool never sends anything — the Web Crypto API runs entirely inside your browser tab. Testing 77 tests, all passing ✅ Tests cover: Base64url encoding edge cases JWT structure (3-part dot-separated) HMAC algorithm mapping (HS256 → SHA-256 etc.) Expiry check (expired vs. valid tokens) Error states: invalid JSON payload, malformed JWT UI: claim insertion, secret toggle, copy, clear Web Crypto API usage verification All tools at devnestio.pages.dev — free browser-only developer utilities. Feedback welcome!

Opening hook It happened during a quiet afternoon at the mosque. The imam was mid-sentence when a rhythmic, high-pitched ringtone cut through the silence like a knife. Every head turned. It was my phone. My heart sank as I scrambled to silence it, only to realize I had forgotten to flip the physical toggle before walking in. That moment of collective, disappointed glares burned. It wasn't just an annoyance; it was a total breakdown of my focus and a social failure I had accidentally caused because my phone couldn't manage itself. The problem We live in an era where our devices are supposedly 'smart,' yet they are remarkably bad at knowing when to keep quiet. We carry computers in our pockets that can calculate the exact position of the moon or stream 4K video, but they cannot inherently tell that we are in a meeting, a lecture, or a place of worship. You could argue that setting a manual schedule works, but life isn't static. Meetings run over, prayer times shift by a minute each day based on astronomical calculations, and spontaneous plans happen. I found myself constantly juggling the physical volume buttons. If I remembered to mute it, I inevitably forgot to unmute it afterward, missing urgent calls from family. If I didn't mute it, I was the person disrupting the room. I wanted a solution that respected the context of my location and the specific time of day without requiring me to touch my screen. The core friction is that Android is designed to restrict background processes to save battery, which is exactly what a silent-automation app needs to thrive. Getting the app to reliably trigger a volume change while the phone is sitting in a pocket, deep in Doze mode, became my primary development hurdle. The technical decision / implementation When I started building Muffle, I initially tried a standard Service with a Handler loop to check conditions. It worked fine while the screen was on, but as soon as the phone entered Doze mode, the OS aggressively throttled my

As a final-year Software Engineering student, I wanted my Final Year Project to be more than just another CRUD application. That's how Invesmal came to life a Laravel-based platform that connects startups, investors, and mentors using AI-driven matching. The Problem Finding the right investor or mentor is hard. Startups struggle to identify investors whose interests align with their industry, while investors sift through hundreds of pitches manually. I wanted to solve this with smart, automated matching instead of a simple directory listing. What Invesmal Does Invesmal supports four user roles Student, Investor, Mentor, and Admin and includes 12 AI-driven features built on top of a Laravel backend, including: A core matching engine connecting startups with relevant investors Skills and personality analysis for founders Goal-based matching between mentors and mentees Compatibility scoring between startups and investors A funding readiness score to evaluate startup preparedness A startup health score for ongoing progress tracking A recommendation engine surfacing relevant connections Each feature is built as an independent service class connected through dedicated controllers and routes, keeping the codebase modular and easy to extend. Technical Approach The platform is built entirely on Laravel , using: Service-oriented architecture for AI features (separating business logic from controllers) Blade components for dynamic role-based dashboards Livewire for real-time, reactive UI elements without heavy JavaScript A structured chat/messaging system for communication between users One of the more interesting engineering challenges was migrating a working chat and messaging system from an older version of the project into a redesigned Laravel structure while preserving functionality and fixing layout issues (like a tricky sidebar CSS opacity bug) along the way. What I Learned Building Invesmal taught me how to: Structure a large, multi-role Laravel application without the

AI is great at writing tests fast, and good at writing tests that look real but verify the wrong...

AI is great at writing tests fast, and good at writing tests that look real but verify the wrong...

SpaceX reportedly showed investors a "handset-like" AI device before going public. It could be another signal SpaceX wants to expand into wireless.

Vendor onboarding usually starts with one clean request and then turns into a messy thread. Procurement asks for a W-9, security asks for a SOC 2 report, finance asks for remittance details, legal asks for an executed agreement, and the vendor replies with four attachments across three messages because different people own different parts of the process. That is exactly the kind of workflow where a generic "AI email assistant" gets risky. You do not want a model improvising legal language, requesting bank details in the wrong channel, or forwarding a confidential report to the wrong internal alias. You want the agent to own the repetitive coordination while your application keeps the state machine, policy, audit log, and approvals. The pattern I reach for is a dedicated Nylas Agent Account: vendors@yourcompany.com . It is a real mailbox the onboarding agent owns. It receives the vendor's replies, detects what is attached, updates your vendor record, sends safe reminders, and escalates missing or sensitive items to a human. The agent is not borrowing an employee's inbox, and it is not scraping a shared procurement mailbox. It has a grant, an email address, webhooks, threads, folders, and the same Messages API you would use for any other mailbox. I work on the Nylas CLI, so the terminal examples below use the commands I would use while building and debugging this flow. I also include the raw API calls because the production version belongs in your service, not in a shell script. What the agent should own Start by drawing the boundary tightly. A vendor onboarding agent should own message handling and coordination, not business approval. Good responsibilities: Receive vendor replies at a stable address. Read message bodies and attachment metadata. Match a reply to an existing vendor record. Detect which onboarding items are complete, missing, expired, or unreadable. Draft reminders and status updates. Schedule handoff calls when the vendor asks for help. Escalate sensit

Building an AI agent is fun. Fixing its production latency when it's juggling live data, RAG, and text-to-speech? Not so fun. In the latest episode of the AI Agent Clinic, we sat down with developer Sami Maghnaoui to debug PlaybackIQ, a football / soccer agent he built to provide pre and post match analysis with text to voice, and minute-by-minute match insights with interactive UI. The app was awesome, but under heavy "match day" data loads, the wait times were killing the UX. Here’s how we fixed it: The Bottleneck: We implemented OpenTelemetry on the Agent Platform to trace exactly where the LLM calls and data retrieval were hanging up. The Scale: We shifted the deployment to Cloud Run to properly handle concurrent traffic. The Result: We managed to slash the agent's latency by 80%. If you're dealing with sluggish LLM response times in your own apps and want to see what a production-grade fix looks like, we recorded the whole teardown and rebuild. 🎥 Watch the teardown here: [ https://youtu.be/G7olcqETSn8 ] (Let me know in the comments what your go-to stack is for tracing LLM latency!)

The problem no one was solving Every Algerian developer building with AI hits the same wall: an international payment card. OpenAI, Anthropic, Google — every major AI provider assumes you have one. Most Algerian developers don't, or don't want to deal with the friction of currency conversion, card rejections, and unpredictable billing in a foreign currency. That's not a minor inconvenience. It's a barrier that quietly excludes an entire generation of developers from building with the best AI models available — not because they lack the skill, but because of infrastructure that was never designed with them in mind. The vision: AI sovereignty, not just AI access Access alone isn't the goal. The goal is sovereignty — Algeria having its own AI infrastructure layer, controlled locally, billed locally, and built to local compliance standards, instead of depending entirely on foreign gateways with no local accountability. That's what DEVUP AI is: Algeria's first AI inference gateway, built from the ground up to remove every friction point between an Algerian developer and the AI models they need. What DEVUP AI actually does 170+ AI models — including DeepSeek V4, Llama 3.1 405B, Qwen 3, Gemma 2, Mistral, GPT, Claude, and Gemini — through a single API OpenAI-compatible and Anthropic-compatible — point your existing SDK at our endpoint, no code rewrite needed Local DZD billing via Edahabia/CIB — no international card required SATIM-certified payment infrastructure — full compliance with Algeria's national payment standards Scoped JWT authentication for production-grade security A dedicated SDK ( npm install devupai ) and full documentation, so integration takes minutes, not days The technical bar was non-negotiable: this had to be production-grade from day one, not a side project. SATIM certification alone meant building proper transaction validation, receipt generation, chargeback tracking, and rejection-rate monitoring — the same rigor a bank would expect from a payment pr

Every data grid demo looks incredible with twenty rows. The columns line up. The hover state is tasteful. The checkbox has confidence. Someone scrolls three inches and everyone quietly agrees that software has advanced. Then the real product arrives. Fifty thousand rows. Twenty columns. Editable money. A custom status cell. Filters. Sorting. Horizontal scrolling. A user who pastes something suspicious from Excel. A product manager asking whether the total row can stay pinned while the server is slow. That is when a table stops being a table and starts becoming infrastructure. So we built a benchmark. Not a perfect benchmark. Those do not exist. A useful one. What we measured The fixture is intentionally boring: 50,000 deterministic rows 20 fixed-width columns 1,200 by 600 pixel viewport two editable columns sorting filtering virtual scrolling production bundles fresh browser contexts raw samples committed to GitHub No network requests. No paid-only feature tricks. No images. No grouping. No heroic demo code designed to make one library look blessed by destiny. The report measures: JS gzip : reachable JavaScript after gzip Ready median : navigation until the grid adapter mounts and two animation frames pass Scroll settle : one scripted vertical and horizontal jump plus animation frames Mounted cells : body cells in the DOM after the scroll Interaction health : heap, long tasks, estimated FPS, dropped frames Live benchmark: https://vitashev.github.io/react-data-grid-benchmark/ Source and raw samples: https://github.com/Vitashev/react-data-grid-benchmark The part most benchmarks get wrong Not every grid exposes the same surface. For example, MUI X Data Grid Community uses 100-row pagination for this workload. That is a valid product boundary, but it is not the same as continuously virtualizing 50,000 rows. So the ranked tables include only compatible continuous-scroll libraries. MUI remains in the fixture and raw data, but not in the leaderboard. That makes the benchma

A note before we start: this is about the machine, not the money. I'm not going to show you returns, positions, or a single "this strategy made X%." Partly because that's a regulatory minefield, and partly because the returns aren't the interesting part — the engineering is. If you came for a get-rich screenshot, this isn't that. If you came to see how one person ships production infrastructure with an AI, pull up a chair. The thing I built Over the last few months I built, with an AI coding agent as my pair-programmer, a fleet of ~35 automated trading bots. They run across five equity markets plus crypto. Each one is a long-running service. They share a single database, post to a live dashboard, fire alerts to my phone, and — the part that took the longest — they're built to survive restarts, reconcile against reality, and refuse to do anything stupid. I'm one person. I am not a team. The "team" is me plus an AI in a terminal, working the way you'd work with a very fast, very literal junior engineer who never gets tired and occasionally needs to be talked out of a bad idea. Here's how it's put together, and the handful of lessons that cost me the most to learn. The architecture, in one breath One Postgres database is the brain — every trade, signal, and piece of state lives there. Around it sit ~35 containerized bots, each isolated (its own tables, its own config, its own identity), orchestrated with Docker Compose. A Streamlit dashboard reads the database and renders the whole fleet — open positions, P&L curves, health. A notification layer pushes Telegram alerts on every meaningful event. Schema changes go through migrations so a new bot is never born with a stale database shape. Each bot is the same skeleton wearing a different hat: a signal module (the strategy logic), a trader that turns signals into orders, a storage layer that persists everything, a runner loop on a schedule. Strategies are swappable. The infra underneath them is identical. That sameness is

Far-UVC could help rid future cars of odors.

Tariffs and anti-China policies killed this little Volvo in the United States.

We started using Jira to manage our internal development workflow. At first it worked fine, but once we outgrew the free tier, the cost became hard to justify. At $15 per user per month, we were suddenly looking at a bill that did not match how we actually used the product. What we Built We created WannaTrack, a lightweight project management tool designed for small dev teams that do not need enterprise complexity. The goal was not to recreate Jira. It was to remove everything we did not use. Key ideas : minimal agile board with no clutter or heavy configuration simple issue tracking flow fast interface for daily development work minimal setup and no onboarding overhead Migration from Jira One of the biggest concerns was switching tools without breaking our workflow. So we built a Jira import tool that lets you migrate existing tickets into WannaTrack without manual effort. This allowed us to switch internally without downtime. Where it is now We now use WannaTrack daily for our own development workflow and are opening it up to other teams who feel the same pain with traditional tools. If you are a small dev team, indie hacker, or startup looking for a simpler issue tracker without overhead, you can check it out here: https://wannatrack.com

Is PlayStation about to make the same mistake Microsoft made with Xbox One?