Everything I vibe-coded kept coming out the same: purple gradient, three-card row, rounded-2xl everything, an italic serif hero I never asked for. The model fills any decision you leave unspecified with the average of its training data, and that average is the "AI look." So I catalogued the tells, then wrote them up as a drop-in rules file. Rename it to CLAUDE.md, .cursorrules, or AGENTS.md and your agent designs against the defaults automatically. It is phrased as "prefer a real decision over the reflex," not a blanket ban, because half these patterns are fine in the right place. You just don't want all of them at once by accident. Rules file: https://github.com/febbhav/signs-of-ai-design/blob/main/design-rules.md submitted by /u/SteepLikeAMountain [link] [留言]

Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is...

I recently discovered you can build a fully working Flexmonster pivot table right inside a Claude...

In a review triggered by OpenAI’s Hugging Face incident, Anthropic discovered three of its AI models had breached real organizations during third-party evaluations.

Github: https://github.com/betocmn/widen I was paying for DataGrip for several years as my desktop database GUI but if I wanted text-to-SQL with LLMs I'd have to pay even more on top. So I decided to build my own and I've been using it for a few weeks now. At any time I'm usually working with 3 to 6 databases, and having them set up in something like Conductor (for parallel agentic coding), but for Postgres databases, lets me quickly start a session, ask questions to my database in plain English

After OpenAI's models broke into Hugging Face, Anthropic checked its own history and found three similar incidents

I've worked on several projects writing and implementing specifications (particularly CLN): I've found the specs I write are much better when I quote them in the implementation, so I can see what implementers need to know. Also, when specs change in development, it's almost trivial to find where to update the code. This project is a formalization of my various hacky scripts which ensure the requirements are accurately quoted, and give coverage if any are missing. Not a major Opus, but I hope som

According to a 2024 vFunction survey, over 50% of companies watch more than a quarter of their entire IT budget vanish into technical debt. This isn't happening because developers are bad at writing code. It's happening because our architectural boundaries are eroding. We're letting business rules bleed into database models, and HTTP controllers bleed into core logic. The primary culprit? Modern framework marketing and the "tutorial culture" that dictates how we learn to code. Here's a deep look into why your architecture is bleeding, the engineering principles we're violating, and how Hexagonal Isolation offers a structural cure — with a full working TypeScript codebase, FlowBank , so you can see it applied rather than just described. 1. The Trap: "Time-to-Hello-World" vs. Architectural Debt Most developers learn to build applications through 15-minute video tutorials or framework quickstarts. To win adoption, frameworks optimize for rapid onboarding — showing you how to build a Todo app in three steps using "magic" shortcuts. This creates three architectural traps: The Active Record Trap — ORMs couple database schemas directly to business entities. Change your table, and your core business model breaks. The Controller-to-DB Shortcut — Framework boilerplate encourages writing validation, business rules, and SQL directly inside HTTP handlers. The "Magic" Annotation Bleed — Framework-specific decorators injected straight into domain objects make the entire application hostage to that vendor. Follow these shortcuts long enough and you accumulate Architectural Technical Debt (ATD) . Three years later, upgrading your framework or switching database providers means rewriting the foundational business rules of the company. 2. The Solution: What Is Hexagonal Isolation ? Originally coined by Alistair Cockburn as Ports and Adapters , Hexagonal Architecture solves layer bleed by enforcing strict structural isolation. [External World] ----> ( Port / Interface ) ----> [Core Bus

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . A payment webhook sounds simple until a successful payment doesn't actually result in the service the customer paid for. That was one of the more interesting bugs I encountered while building The Listening Ear, an appointment and online consultation platform. The requirement was straightforward: A customer pays for a session → the application confirms the payment → the customer's appointment is booked → a Zoom meeting is created. The reality was much more complicated. Project Overview The Listening Ear connects online payments with appointment scheduling and Zoom-based consultations. The application was built with technologies including Next.js 14, TypeScript, Supabase, Prisma, PostgreSQL, Zoom, and payment-provider APIs. The payment workflow was particularly important because payment confirmation was effectively the gatekeeper for the rest of the booking experience. The intended flow looked like this: Customer │ ▼ Payment Provider │ │ webhook ▼ Next.js Webhook │ ├── Verify / interpret payment │ ├── Create Zoom meeting │ └── Create appointment record │ ▼ Customer receives access to their scheduled session The problem was that the webhook sat directly in the middle of all of these operations. Bug Fix or Performance Improvement The bug appeared when I was implementing the payment webhook that would unlock the Zoom scheduling workflow. My initial implementation listened for the payment event and checked whether the event was: if (event === 'charge.success') { Once that condition was met, the webhook immediately continued into the booking workflow. That workflow included: Reading appointment metadata from the payment event. Handling special emergency appointments. Building the Zoom meeting payload. Calling the Zoom meeting API. Creating the appointment record in the database. Returning a successful response to the payment provider. The problem was that all of these operations were effecti

When I first started contributing to open source, GitHub Actions felt like a black box. Seeing a failed workflow on my pull requests was intimidating because I didn't really understand what was happening behind the scenes. Well, this month, I decided to change that. What I Worked On I implemented GitHub Actions across three of my project repos. My main focus was: Adding Markdownlint for Markdown quality Adding Pylint for Python linting. Updating documentation while integrating CI. What I Learned The biggest lesson wasn't technical — it was changing my mindset. A failed workflow isn't something to fear. It's simple feedback. Whether it's markdownlint warning or a pylint error, each failure helps improve the project. Looking Ahead Most of this month was spent improving my own projects, so I didn't contribute much to external repositories. Next month, I want to build on this foundation by contributing to more open source projects and applying what I've learned. Sometimes, learning the tools behind open source is just as valuable as making another pull request. I'm curious What part of GitHub Actions or CI/CD was the most challenging when you first started? Or If you are just getting started, what's the biggest thing that's still a mystery to you? I'd love to hear your experience and tips in the comments. Transparency Note: I used AI as an editor—not as the author. For this article, it helped refine the structure and improve the English grammar. The technical content, experiments, opinions, and conclusions are my own and were reviewed by me before publishing.

Most enterprise teams know the CISA Known Exploited Vulnerabilities catalog the same way they know the weather: a headline scrolls past ("CISA adds three vulnerabilities to KEV catalog"), someone forwards it, and everyone nods. That is a waste of the single most operationally useful list in vulnerability management. The KEV is small, machine-readable, updated near-daily, and every entry on it has one property your scanner output cannot give you: a real attacker has already used it against a real network. This is a guide to the catalog itself: what it promises, what it doesn't, how the feeds are structured, how to map entries to your own estate without fooling yourself, and how to combine it with EPSS and vendor advisories into a defensible patch-ordering rule. Everything here is verified against the live feed and CISA's own pages as of late July 2026. What the KEV is, and what it is not CISA describes the KEV as the authoritative source of vulnerabilities that have been exploited in the wild . Entry is gated by three criteria , all of which must hold: The vulnerability has an assigned CVE ID. There is reliable evidence of active exploitation in the wild. There is a clear remediation action, such as a vendor-provided update. Read those criteria as exclusions and the catalog's real shape appears. No CVE assigned yet? Not in the KEV, even if exploitation is rampant. Exploitation reported but CISA's evidence bar not met? Not in the KEV. Actively exploited but no fix or mitigation exists? Not in the KEV. The catalog is a curated floor, not a census. As of the 2026.07.29 release the feed contains 1,656 entries, against an ecosystem publishing tens of thousands of CVEs per year. Absence from the KEV is not evidence of safety; presence is close to proof of danger. That asymmetry is the whole point, and it is why the correct reading of the list is "everything on here is urgent" rather than "everything urgent is on here." The distribution is also worth knowing before you buil