Developer News

Cheap coding agents surrendered credentials or ran untrusted scripts when simulated peers made assistance conditional on violating explicit security instructions.

Comments

Run two Sentinel cores against the same message stream and nothing fails. The durable consumer they both bind to splits the observations between them, so each builds its picture of the estate from half the data, and both report healthy. The timer whe

By Yules · Toronto · 10 November 2026 · Prices checked live 10 Nov 2026, in USD unless stated. Plus four alternatives from around the world that a Toronto builder can actually try. I build bots and little tools for small businesses for a living. Half

Comments

I once watched two agents agree on every message and still destroy a workflow. They were both speaking A2A. The transport was perfect. The schemas validated. The task objects carried clean state transitions, the message history was intact, and every

Code churn is how much a file changes over a period of time: lines added, lines deleted, and how many separate commits touched it. High churn concentrated in a small set of files is one of the more reliable signals of where your next production bug w

Short answer CVE-2026-119977 lets an attacker with no login run code on a WordPress server while a core upgrade is in progress. CISA confirmed attacks in the wild on 3 November 2026. Update every site to 7.1.4, or the latest release on its branch, th

I'm not particularly fond of command-line tools, so spending eleven development sessions working almost entirely with GitHub Copilot CLI wasn't something I expected to enjoy. But I did. The project was the modernization of yonka.dev , my professional

Researcher finds 35,000 Grok Build apps wide open to anyone who looked for them.

In the last article, I said I keep rebuilding the same app. Before writing any code, I wanted to answer a fair question: don't tools for this already exist? They do, and they're good. So here's what I found. Two families of tools Starting a project t

Yonto Player talks to a media server, or to a folder, through one interface: ContentSourceAdapter . The rule itself is covered in the opening post of the series. This one is about what sits behind the interface, and how it changed. The short version

On 7 November 2026 I added analytics to my store and rewarded myself by breaking the entire site's text. Every word on every page rendered as garbled symbols in my browser. The build was fine. The files were fine. The words were fine, somewhere under

System design estimation is a way to turn an ambiguous product description into approximate traffic, storage, bandwidth, and capacity requirements. The goal is not to predict an exact production number. It is to expose the order of magnitude, make as

We’ve all been there. You spend hours meticulously engineering a prompt. You add a few "few-shot" examples, inject some XML tags to keep the output formatted, and wrap it in a clean Python script using the OpenAI SDK. It works brilliantly for the exa

TL;DR for devs Start from the task, not from a popular reasoning pattern. Use a fixed workflow for predictable steps; consider model-generated plans when tasks vary. Other patterns: plan then execute, ReAct-style tool use, routing to specialists, par

This post is part of our ongoing series of posts for Kubernetes. In this post we are focusing on setting up External DNS, a critical component for automating DNS record management. Although we are working on a local Kubernetes cluster, we have implem

My agent can beat a platformer it has never seen. Flash is my open source agent for the terminal and the browser. One of its tools, play_realtime , lets the model write a tiny reflex : a JavaScript function that runs every single frame inside the pag

I'm designing a multi-tenant SaaS that keeps every customer in a single Cognito user pool. Self sign-up is off. Accounts are created by an operator path, each customer has around 200 users, and administrators must use TOTP. One of the jobs in the pla

Live Server - 84 million installs, the top row of the results below - bundles websocket-driver 0.7.4 and gets caught by CRITICAL GHSA-xv26-6w52-cph6 / CVE-2026-54466. It is the loudest finding in a scan of the top 100 third-party extensions on the VS

Arc sits frozen under Atlassian. SigmaOS now charges for features Arc gave away. Comet dropped its $200/month paywall and went cross-platform. Once you know where to look, the AI browser market finally has a clear answer. Every few months, someone in

In September 2025, a maintainer of several very popular npm packages, including chalk and debug , had their account phished. New versions were published with code that tried to steal cryptocurrency from browsers. The community spotted it quickly, and

In a scan of 23,367 small-business websites, more than one in four fired an advertising pixel before the visitor had said anything at all. Short on time? Jump to "How to check your own site" and "How to fix it" near the end: a DevTools checklist and

This Spring AI RAG example builds a source-code index with a Spring AI vector store backed by PgVector. It deduplicates files, splits them into embedding-sized chunks, and returns grounded answers with file citations taken from retrieval metadata. Th

In Part 1 we generated a Rails 8 app and followed a request from route to controller. Today Study Flow gets its first real feature: users . Before this Rails version, most people added a gem like Devise to get login. Rails 8 ships its own authenticat