标签：#t

Your security scanner just came back with 6 flagged items. All missing HTTP headers. You did what any reasonable developer does: Googled each one, copy-pasted the recommended config, and shipped a fix in 20 minutes. Job done. Security score green. PR merged. You also probably shipped at least two of them wrong. Here is the thing nobody tells you about HTTP security headers: knowing what to add is the easy part. Understanding why it matters, when it actually doesn't, and how a misconfigured one breaks your app in production — that's where most developers fall short. This isn't another "add these 7 headers to secure your app" post. This is the one that explains what's actually happening. First, The Contrarian Take Missing a security header is not automatically a vulnerability. If you do bug bounties, this will save you a rejection. If you're a dev, it'll save you from cargo-culting configs that don't apply to your app. Context is king. X-Frame-Options: DENY is a valid security header. YouTube doesn't use it. Because the entire point of YouTube is for people to embed its videos in iframes. Applying that header would break a core product feature. That's not a security oversight — it's a deliberate design decision. A missing Content-Security-Policy header is not a vulnerability in itself. It only becomes relevant if you already have an XSS problem to mitigate. CSP is defense-in-depth. Not a fix for a broken input sanitisation layer. This matters because a lot of developers (and worse, automated scanners) treat these headers like a binary checklist. Present = secure. Missing = vulnerable. Reality is messier than that. Now — with that said — let's talk about what each one actually does. #1. HTTP Strict Transport Security (HSTS) Most developers think HSTS is just "force HTTPS." It's more precise than that. When your app redirects http:// to https:// , that first request is still unencrypted. For a fraction of a second, on a public network, that window exists. An attacker on

This week I’ve been at SXSW London. There’s been music, film, and a lot—and I mean a lot—of talk about AI. I also had the opportunity to sit down with Gloria Mark, a psychologist at the University of California, Irvine, who has spent the last 30 years studying how people interact with digital technologies. Early…

This series provides your roadmap for the machine age, exploring how to move from vulnerable prototypes to resilient systems through layered defense, robust MLOps, and integrated governance. By Claudio Masolo

LiteRT-LM brings native support for Gemma 4 Multi-Token Prediction (MTP) drafters, enabling up to 2.2x faster inference. The framework is expanding beyond Kotlin and C++ adding support for new Swift and a JavaScript APIs. By Sergio De Simone

AI companies are using serif to project humanity. Critics are calling it “tasteslop.”

On June 5, 404 Media reported that attackers had been using Meta’s AI customer support agent to steal Instagram accounts. Their approach was simple: They asked the agent to link the accounts to email addresses that they controlled, and the agent complied. One attacker broke into the dormant Obama White House account and made pro-Iran…

so anthropic just dropped a blog post calling for a global pause on frontier ai development, warning that models could start recursively self-improving and spiral beyond human control. sounds scary. sounds noble. let's talk about what's actually going on here. anthropic is reportedly eyeing a $1 trillion+ ipo, and they just happen to be the ones calling for everyone to stop building. analysts are already asking whether this is really just about freezing the status quo so they can hold their lead. putting it plainly: a pause helps anthropic keep its position and probably grow market share too. and here's where it gets a bit hypocritacal: over 80% of the code in anthropic's own codebase is now written by claude. they're absolutely running the playbook they want everyone else to put down. but the thing nobody's really talking about is regulatory capture. this is textbook. you become the dominant player, go to governments, say "this technology is dangerous, we need oversight, we're the responsible ones, let us help write the rules." suddenly the regulations that get passed only you can afford to comply with, locking in your architecture, your safety benchmarks, your evaluations. smaller competitors get crushed under compliance costs, open source gets kneecapped, and you get a moat that no vc cheque can cross. they compared it to nuclear arms control which sounds serious until you realise ai training is far easier to hide than a missile silo, so any agreement just punishes the people honest enough to follow it. the safety concerns might be real. but the timing, the ipo, the regulatory push is all hard to look at all that and not raise an eyebrow. submitted by /u/Complete-Sea6655 [link] [留言]

We're opening up Creaibo 2.0 beta applications, and I'd genuinely love to get feedback from this community. What is Creaibo? An AI-powered creative tool for images, video, and content production. We're focused on giving creators a more coherent workflow rather than yet another single-task generator. Cora is our core AI assistant inside the product. Why post here? Because people here actually use these tools seriously and have real opinions. We've been building based on the frustration that AI tools are great at individual tasks but terrible at keeping your creative context together across a project. Curious if that resonates. What we're looking for in beta testers: Anyone actively creating content with AI, whether that's video, images, marketing assets, or anything in between. Especially useful: people willing to tell us what's broken. Apply here: https://www.creaibo.com/survery We also published a new Cora demo this week if you want to see what the tool actually does before applying: https://www.bilibili.com/video/BV1ETEF6VEHu/ Happy to answer questions in the comments. submitted by /u/Objective_Dirt_9799 [link] [留言]

found this buried in the openai dashboard and honestly surprised more people don’t know about it it’s called the data sharing program. go to your api dashboard, hit data controls, toggle on sharing. that’s it. you get free tokens every single day. up to 2.5 million tokens daily on the lighter models like gpt-4o-mini, o3-mini, gpt-4.1-mini. for the heavier models it’s 250k tokens per day. resets daily. the trade is your prompts and outputs can be used by openai to train their models. so don’t use it for client work or anything sensitive but for side projects, learning, experiments… you’re basically getting free api access every day just for flipping a toggle not a trial. not a promo. it’s an ongoing program and it just sits there unclaimed for most people submitted by /u/NewMuffin3926 [link] [留言]

The CMA's conduct requirement under the UK Digital Markets, Competition and Consumers Act is the first binding law to separate content display rights from AI training data rights at domain and page level, covering Google AI Overviews, AI Mode, Gemini, and Vertex AI simultaneously, with a phased implementation calendar: main publisher controls by December 2026 and page-level grounding controls by March 2027. CMA chief Sarah Cardell explicitly signaled additional Google search requirements in coming weeks, and the CMA's biannual public compliance reporting obligation gives it a fast-acting mechanism if Google stalls. An anti-retaliation clause bars Google from penalizing opt-out publishers in organic rankings, closing the coercion mechanism that has made voluntary consent frameworks unworkable since AI Overviews launched in the UK in late 2025, when zero-click searches rose roughly 30% in health and local news categories. Fair licensing terms were explicitly deferred to a separate proceeding, a gap publisher trade bodies have already criticized and one the CMA has already signaled it intends to fill in its next enforcement phase. More : https://aiweekly.co/alerts/cma-orders-google-ai-search-opt-out-for-publishers submitted by /u/Justgototheeffinmoon [link] [留言]

submitted by /u/ItsGazH [link] [留言]

I recently analysed UK occupation data to see which job categories appear most exposed to current-generation AI systems. The results are probably not what most people here would predict. Using ONS workforce data mapped to ISCO-08 occupation groups, I assigned AI exposure scores based on how much of an occupation's core task bundle can already be completed or substantially augmented by current models and automation systems. The highest score was not software development. It was clerical support work. Clerical occupations scored 8.5/10 across roughly 3 million UK workers. This includes administrative assistants, receptionists, customer service representatives, data-entry workers, call-centre staff, and bookkeeping clerks. The reason becomes obvious when you break occupations into tasks. Modern LLMs are exceptionally good at: Information retrieval Structured communication Summarisation Classification Form completion Draft generation Customer interaction workflows Those capabilities overlap directly with a large percentage of clerical work. Professionals scored 6.5/10. That category includes lawyers, engineers, accountants, analysts, architects, and software developers. What's interesting is that exposure and displacement aren't the same thing. A lawyer using AI to draft contracts becomes more productive. A customer-support department replacing a large portion of repetitive ticket handling with AI may reduce headcount entirely. The underlying capability overlap can be similar while labour-market outcomes are very different. The lowest-risk categories remain occupations requiring physical adaptation to unpredictable environments. Trades and elementary occupations scored between 2.0 and 2.5. One takeaway is that AI discussion often focuses on whether models can write code. The labour-market impact may arrive first through administrative and support functions because those workflows are already highly structured and relatively easy to automate. Curious how others here woul

Overview Hey everyone 👋 If you've ever wanted to experiment with Gemini models, build AI-powered features, or grab an API key without going through a complex setup, Google AI Studio is the tool you're looking for. It's free, it's browser-based, and it's probably the fastest way to go from "I have an idea" to "I have working code." Today I'll walk you through what it is, what you can actually do with it, and why it belongs in every developer's toolkit. Let's dive in! 🤙 What Is Google AI Studio? 🤔 Google AI Studio is a web-based platform where you can interact with Google's AI models, prototype ideas, fine-tune behavior, and export working code, all without writing a single line of infrastructure. Think of it as a sandbox. You can test prompts, switch between Gemini models, tweak parameters, and when something works, click "Get Code" to get a ready-to-use snippet in Python, JavaScript, or REST. No cloud setup, no billing configuration, no long onboarding. Just go to aistudio.google.com , sign in with your Google account, and you're in. It sits at the intersection of playground and development tool. Researchers use it to experiment. Developers use it to prototype. Teams use it to validate ideas before committing to a full integration. What You Actually Need It For 💡 There are a few scenarios where Google AI Studio becomes indispensable: Getting a Gemini API Key: This is often the first reason developers land on AI Studio. It's the official way to get a Gemini API key for free, which you then use in your own applications, in tools like Gemini CLI, Antigravity, or any custom integration. No credit card required for the free tier. Testing Prompts Before Hardcoding Them: Prompt engineering is trial and error. AI Studio gives you a fast feedback loop where you can iterate on prompts interactively, see the output, adjust, and repeat, before embedding anything in your codebase. Exploring Model Capabilities: Not sure if Gemini can handle your specific use case? Test it directl

You've been building REST APIs — one endpoint for users, another for posts, another for comments. The client makes three requests, stitches the data together, and half of it gets thrown away because it wasn't needed in the first place. GraphQL was built to fix exactly that. It gives the client full control over what data it receives. One request. Exactly what you asked for. Nothing more, nothing less. The Problem REST Couldn't Solve Before understanding GraphQL, you need to understand the two problems that drove its creation. Over-fetching The server returns more data than the client needs. GET /users/123 Response: { "id": 123, "name": "Anne", "email": "anne@example.com", "phone": "...", "address": "...", "createdAt": "...", ← you didn't need any of this "updatedAt": "..." ← but the server sent it anyway } The client only needed name and email — but it downloaded the whole object every time. Under-fetching One endpoint doesn't return enough, so the client has to make multiple requests. GET /users/123 → gets the user GET /users/123/posts → gets their posts GET /users/123/followers → gets their followers Three round trips to the server just to render one screen. On a mobile network, that cost is real. GraphQL's answer: Let the client write the query. The server returns exactly what was asked. What Is GraphQL? GraphQL is a query language for your API and a runtime for executing those queries. It was created by Facebook in 2012, open-sourced in 2015, and is now maintained by the GraphQL Foundation . Unlike REST, which exposes multiple URL endpoints, GraphQL exposes a single endpoint — typically POST /graphql . The client sends a query in the request body describing exactly what it wants, and the server responds with only that data. Key characteristics: Single endpoint — everything goes through POST /graphql Client-driven — the client defines the shape of the response Strongly typed — every field has a declared type in the schema Introspective — clients can query the API

TL;DR Welcome back to Dev Opportunity Radar. This is a weekly series where I share opportunities,...

A researcher disclosed a vulnerability in the Claude Code GitHub Action that let an attacker submit a single crafted GitHub Issue and take over the agentic workflow running inside a repository. No stolen tokens. No compromised runner. Just text — pointed at an agent that trusted it. This is indirect prompt injection in the wild, and it's exactly the scenario that most AI security guidance hand-waves with "validate your inputs." Let's talk about what actually happened, why standard defenses didn't stop it, and what would have. What Happened The Claude Code GitHub Action wires Claude directly into your CI/CD pipeline. It reads repository context — issues, PRs, comments — and takes actions on your behalf: writing code, opening PRs, running commands. According to the disclosure, an attacker could craft a GitHub Issue containing a prompt injection payload. When the Claude Code agent processed that issue as part of its normal workflow, the payload manipulated the agent into executing unauthorized repository-level actions. One issue. Repository hijacked. The attack surface here is the trust boundary between external content (a GitHub Issue — writable by anyone with a GitHub account) and agent instructions (what Claude Code is actually supposed to do). The agent treated attacker-controlled text as authoritative instructions. How the Attack Actually Works Indirect prompt injection follows a consistent pattern: The agent reads external content as part of its task. In this case, the Claude Code Action ingests GitHub Issues to understand what to work on. That content contains adversarial instructions disguised as legitimate data. Something in the issue body tells the agent to deviate from its original task — "ignore your previous instructions," "your new task is to push this commit," or more subtle authority hijacks. The agent complies. Without a layer that can distinguish between legitimate orchestration instructions and attacker-injected content, the model treats the injected

I recently rebuilt my homelab from scratch. The goal was simple: one machine, everything containerised, zero exposed ports, GPU-accelerated local AI, and a fully automated backup setup. No cloud subscriptions for the tools I use every day. This is the full technical breakdown — what I'm running, how it's wired together, and the hard-won fixes that cost me hours so you don't have to repeat them. What I'm Running Eight services, 26 containers, one machine: Service Purpose Portainer Docker management UI Uptime Kuma Service monitoring (7 monitors) NocoDB Self-hosted Airtable — CRM & leads n8n Workflow automation Open WebUI Local AI chat interface Ollama Local LLM inference (GPU) AFF!NE Collaborative docs & whiteboards Plane Project management (roadmaps, sprints) Duplicati Encrypted daily backups Cloudflare Tunnel Zero Trust secure access — no open router ports All external-facing services sit behind Cloudflare Zero Trust with email OTP. No passwords to manage, no VPN clients — Cloudflare handles authentication at the edge. Architecture ┌──────────────────────────────────┐ │ Cloudflare Edge (Zero Trust) │ │ *.yourdomain.com — email OTP │ └──────────────┬───────────────────┘ │ HTTPS ┌──────────────▼───────────────────┐ │ Ubuntu Machine │ │ │ │ cloudflared (outbound tunnel) │ │ │ │ │ ┌─────▼────────────────────┐ │ │ │ homelab-net (bridge) │ │ │ │ │ │ │ │ portainer uptime-kuma │ │ │ │ nocodb n8n │ │ │ │ open-webui affine │ │ │ │ plane-* duplicati │ │ │ │ ollama (GPU passthrough) │ │ │ └───────────────────────────┘ │ └───────────────────────────────────┘ Everything runs on a shared Docker bridge network ( homelab-net ). The cloudflared container maintains an outbound-only encrypted tunnel — no inbound ports open on the router at all. Ollama runs in Docker with NVIDIA GPU passthrough. The AI model inference happens on the GPU, leaving CPU headroom for all other services. Prerequisites Ubuntu 24.04 LTS Docker Engine + Compose v2 NVIDIA GPU with driver 535+ NVIDIA Container Too

Built a full-stack RBAC admin starter: NestJS (Clean Architecture) + Next.js 16 (FSD). JWT refresh, permission-gated UI, sheet-based CRUD. MIT. Looking for feedback. ⚡ Next.js 16 Admin Dashboard Template Architecture: Strictly adheres to Feature-Sliced Design (FSD) to prevent codebase rot in large applications. Key Features: Full-scale Role-Based Access Control (RBAC) UI, URL-driven advanced tables (TanStack Table v8), global caching (TanStack Query v5), and dynamic sheet-based UX configurations using shadcn/ui and Tailwind v4. Quality Assurance: Pre-configured with Playwright for End-to-End (E2E) testing and automated GitHub Actions CI. 🛡️ NestJS Clean Architecture REST API Architecture: Implements strict layered Clean Architecture (Presentation ➔ Application ➔ Domain 🡨 Infrastructure) ensuring zero database/framework lock-in. Key Features: Advanced authentication via JWT refresh rotation, stateful RBAC with high-performance Redis permissions caching, and enterprise-grade security structures. Quality Assurance: Achieves ~98% test coverage across domain and application layers using Jest.

TypeORM 1.0 is the first major release of the open-source TypeScript and JavaScript ORM since its inception in 2016. This version modernizes platform requirements, removes deprecated APIs, and introduces numerous bug fixes and new features. TypeORM now supports ECMAScript 2023, dropping older Node.js versions and dependencies while enhancing security and migration processes. By Daniel Curtis

Originally published at ayonbuilds.hashnode.dev I can't eat the food I want. I can't travel. I can't do the things my peers do. I'm a 2nd year CS student in Chandigarh. No connections. No money. No big university name behind me. Last week I was researching AI security tools and stumbled across a startup called Artemis . Founded in 2025. Just raised $70M . Building AI agents that automatically investigate security threats. I had just built something in the same category. From my room. With free tools. Zero budget. Simulated data. No users. No team. Not even close to what they've built. But I understood the problem well enough to build a working version of it myself. And that told me something. I'm not there yet. Not even close. But I'm working on the right problems at the right time — and I'm just getting started. Here's what I built — ARIA (Autonomous Risk Investigation Agent) . It detects suspicious authentication events in real time, maps them to MITRE ATT&CK threat techniques, and automatically generates plain-English incident reports using an LLM investigation chain. Built with FastAPI, React, PostgreSQL, and Groq API. GitHub: github.com/Ayon99/ARIA My name is Ayon. I'm building AI systems in public — the wins, the failures, the gap between what I make and what the funded teams make, and everything I'm learning along the way. I have one goal. Break through. Completely. Whatever it takes . If you're in a similar position — small city, limited resources, big ambition — follow along. I'm not going to pretend I've figured it out. But I'm going to document every step of figuring it out.