Dev.to Security

How to Scan QR Code from PDF Documents Online Without Uploading Files

When dealing with digital documents like invoices, boarding passes, e-tickets, and transaction recei…

The patch opens the attack window.

"I don't prompt Claude anymore. I have loops running that prompt Claude and figuring out what to do.…

I'm in tooling and permissions and access hell right now...

…

Every claim, labelled: why our security page lists what we don't promise

I build Vardum, a private messenger, mostly on my own. Early on I made one rule for the website: eve…

Warp's Breach Reached Agent Decision Logs. What One Agent Trace Actually Contains

Book: Observability for LLM Applications Also by me: Thinking in Go (2-book series) — Complete Gui…

Weekly Threat Recap: Social Engineering to Supply Chain Poisoning

Originally published on satyamrastogi.com Analysis of critical attack vectors this week spanning d…

Marketplace Report Access: Rate-Limit SMS-Based OTP Requests Before Attachment Delivery

Short answer: in Node.js, rate-limit SMS-based 2FA OTP requests by account, normalized phone number,…

Node.js OTP Input: A Guide to Verifying 2FA Login Challenges

Choose who owns verifying OTP input in your Node.js application before wiring up message delivery. F…

Agents Don't Fail Like Normal Software: Why AI Agents Need Their Own Testing

A new kind of failure If you have shipped an AI agent, you have probably noticed that it fails dif…

PHP2Shell: How We Secured 200+ EC2 Instances in 4 Hours Using AWS Inspector, Systems Manager, and Terraform

November 2026 | ~18 min read Sprint Planning Interrupted We were twenty minutes into spr…

Google Says Videostrong Built a 1.3 Million-Device Android Botnet Into Its Own TV Boxes

TL;DR what: Google, with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient…

Goravel gates and policies for role permissions

Part 12 of the Goravel series. The original on DevChalk has the colour-matched code, the figures and…