标签：#p

Introduction As data grows exponentially, accessing and querying databases efficiently...

In modern software development, Continuous Integration and Continuous Deployment (CI/CD) pipelines...

Okay so. Story time. Grab a coffee; this one's got a body count. A few months back I got assigned a...

Welcome to this comprehensive comparative guide on API testing! This article is designed to showcase...

submitted by /u/fagnerbrack [link] [留言]

Back when we introduced MCP support , we ended on a teaser: Phase 3 would tackle Sampling —letting servers request completions from the host instead of only exposing tools and resources to it. NodeLLM 1.17 delivers on that, and pairs it with a second, unrelated but overdue improvement: precise control over how tool calls execute, now available consistently in both core and the ORM persistence layer. 🔄 MCP Sampling: Closing the Loop Sampling inverts the usual MCP direction. Instead of the client asking the server for tools, the server asks the client to run an LLM completion on its behalf. This lets an MCP server offer LLM-powered capabilities—summarization, classification, drafting—without needing its own API key or provider integration. createLLMSamplingHandler answers those requests using a real NodeLLM instance, so a server's tool ends up powered by whatever model you configure client-side: import { createLLM } from " @node-llm/core " ; import { MCP , createLLMSamplingHandler } from " @node-llm/mcp " ; const llm = createLLM ({ provider : " openai " }); const mcp = await MCP . connect ( { command : " node " , args : [ " ./sampling-server.mjs " ] }, { sampling : createLLMSamplingHandler ( llm , " gpt-4o-mini " ) } ); const tools = await mcp . discoverTools (); // The server only advertises sampling-backed tools once it sees // the client declared sampling support during the handshake. If you need full control over how a sampling request is answered—routing by model hint, injecting your own guardrails—pass a plain handler function instead of { llm, model } . It receives the raw sampling/createMessage params and returns a CreateMessageResult , so you decide exactly how (or whether) to answer. ⚡ Concurrent Tool Execution When a model returns several independent tool calls in the same turn, NodeLLM has always executed them one at a time. That's safe by default, but wastes time when the calls don't depend on each other—three weather lookups for three different cities, s

If you're a solo founder or small team shipping on GitHub, at some point someone asked you: "what changed in the last release?" And if you're honest with yourself, your answer was probably a Notion page nobody reads, a GitHub releases tab your users don't know exists, or "I'll get to it." A changelog sounds like a low-priority vanity feature. But here's what I've learned building a SaaS: when you ship frequently and users don't know what changed, they churn quietly — not because the product got worse, but because they never noticed it got better. Why Headway stopped being the answer For years, Headway was the indie-hacker answer to this problem. Beautiful in-app widget, dead simple setup, priced reasonably. A lot of us put it in our sidebars and called it done. The problem: Headway hasn't shipped a meaningful update since roughly 2020. No GitHub sync. No AI generation. No email notifications to push updates out to users. The integration ecosystem it was built for has moved on, and the product hasn't. Search "Headway alternatives changelog" and you'll find threads on Indie Hackers and Reddit full of people actively looking for something else. That's not a dead category — it's one where the go-to tool has been abandoned and nobody decent has filled the gap at the indie-hacker price point. What's actually available in 2026 Here's an honest look at the main options: Tool Price AI generation GitHub sync Email digest In-app widget Headway $29/mo No No No Yes AnnounceKit $79-129/mo Partial No Yes Yes Beamer $49-499/mo No No Yes Yes Shiplog $19/mo Yes Yes Yes Yes A few things worth noting: AnnounceKit is well-built and widely used. If you're a funded team or have a larger user base that needs NPS surveys and user segmentation, it earns its price. For a bootstrapped founder, $79/mo for a changelog widget is hard to justify before you're at serious MRR. Beamer is similarly full-featured and similarly priced for growth-stage SaaS teams. Their entry tier has gotten more reasona

AI coding assistants are great at writing code and terrible at knowing when to write it. Ask one to build a feature and it will happily jump straight to implementation, skipping the questions a good engineer asks first: what exactly are we building, why, what are the risks, and how should it be broken down? The result is fast output that often solves the wrong problem. AWS's AI-DLC (AI-Driven Development Life Cycle) is an attempt to fix that gap. It's an open-source set of workflow rules — released by awslabs — that steer AI coding agents through a disciplined software development process instead of letting them freewheel. Importantly, it isn't a tool you install or a service you pay for. It's a methodology delivered as a bundle of markdown rules that your existing coding agent reads and follows. The core idea: methodology over tooling One of AI-DLC's stated tenets is "methodology first." The whole thing ships as plain markdown rule files that you drop into whatever your agent already uses for project instructions — CLAUDE.md for Claude Code, .cursor/rules/ for Cursor, .github/copilot-instructions.md for GitHub Copilot, .amazonq/rules/ for Amazon Q, steering files for Kiro, and so on. There's nothing to run. The agent loads the rules and its behavior changes. This makes AI-DLC deliberately agnostic . It doesn't tie you to a specific IDE, model, or vendor — any coding agent that supports project-level rules can use it. The philosophy is that a good development methodology should outlive any particular tool. A three-phase adaptive workflow At its heart, AI-DLC organizes work into three phases that mirror how thoughtful software actually gets built. The Inception phase answers what to build and why . This is where the agent does requirements analysis, creates user stories when they're warranted, sketches the application design, breaks work into units that can be built in parallel, and assesses risk and complexity before a line of code is written. The Construction phase

The 2026 World Cup has $3.89 billion bet on it across Polymarket. That's not retail money — that's whales. I built WhaleTrack to track exactly what those big wallets are doing. Here's the stack: Backend: Node.js server fetching live data via Bullpen CLI Frontend: Vanilla JS, real-time updates Data: Polymarket CLOB API via Bullpen Analytics: Google Analytics for traffic tracking The hardest part wasn't the code — it was getting users. Pure SEO and content distribution (Reddit, Twitter, IH). The site is live at whaletrack.app — would love feedback from devs on the UX and performance. Happy to open source parts of it if there's interest.

Privacy isn't a checkbox. It's not a statement in your terms of service. It's not a toggle in your settings app. Privacy is architecture. And most apps get this backwards. The Architecture Test Here's a simple test for any app that claims to be "privacy-first": If your server goes down, can anyone still access user data? If the answer is yes, your privacy is a policy question — not a technical guarantee. You've built a system where trust in the company replaces trust in the code. Every photo cleaner that uploads your images to a server has already failed this test. The moment data leaves your device, privacy becomes something you promise rather than something you enforce . What On-Device Processing Actually Means When we built Swipe Cleaner, we made one architectural decision that defined everything else: zero data leaves the phone . This means: No cloud processing of photos No API calls that transmit image data No server-side storage of any kind Every scan, every classification, every cleanup happens locally The app is 4.7 MB. That's it. There's nothing to hide because there's nowhere to hide anything. Why Architecture Beats Policy Companies spend millions on legal teams writing privacy policies that their architecture contradicts. They collect data "to improve the service" while the service could have been designed to not need that data in the first place. Policy-based privacy Architecture-based privacy "We promise not to misuse your data" "We can't misuse data we never have" Requires ongoing trust Verifiable by anyone Can change with an update to ToS Requires rewriting the entire app Compliance-driven Principle-driven The Trust Problem Here's what I've learned building privacy-focused tools: users can't verify your privacy policy. They can't audit your servers. They can't check if you're actually deleting their data after processing. But they can verify that an app never sends their photos anywhere. They can check network traffic. They can inspect the binary. Tha

Your codebase almost certainly relies on RSA and elliptic-curve cryptography — TLS, JWTs, SSH keys, signed tokens. All of it is breakable by a large enough quantum computer (Shor's algorithm), and "harvest now, decrypt later" means data you encrypt today can be captured today and decrypted later. Regulators noticed: CNSA 2.0 (US federal + suppliers), DORA (EU financial entities, applies from Jan 2025), and NIS2 now mandate strict cryptographic risk management — which in practice means knowing where your quantum-vulnerable crypto lives, a cryptographic bill of materials (CBOM). Most teams can't answer "where is our RSA/ECC?" off the top of their head. Here's how to make CI answer it for you, on every push, for free. What we're building A GitHub Action that scans your repo, grades its post-quantum readiness A–F , writes a CycloneDX 1.6 CBOM , and — if you want — fails the build when classically-broken crypto (MD5, RC4, 3DES, deprecated TLS) shows up. Step 1 — try it in your browser first (30 seconds, nothing uploaded) Before touching CI, paste a package.json / requirements.txt / cipher list into the in-browser scanner and see your grade. It runs entirely client-side — no upload: https://throndar.ai/cbom Step 2 — add it to CI (the 5 lines) # .github/workflows/pqc-readiness.yml name : PQC readiness on : [ push , pull_request ] jobs : scan : runs-on : ubuntu-latest steps : - uses : actions/checkout@v4 - uses : brandonjsellam-Releone/pq-readiness-scorecard@v1 with : path : . That's it. The Action is self-contained and dependency-free — no npm install , no setup step. On the next push it prints a scorecard to the job summary: Post-Quantum Readiness Scorecard: D (52/100) — Quantum-vulnerable — migrate 3 files · broken-classical 0 · quantum-broken 4 · weakened 1 · resistant 0 Step 3 — see findings in the Security tab (SARIF) The Action emits SARIF 2.1.0. Upload it and every finding shows up as a code-scanning alert: - id : pqc uses : brandonjsellam-Releone/pq-readiness-score

I ran the same 39 AI agent security samples through three scanners: AgentGuard, Semgrep, and CodeQL. The Results Scanner Detection Rate False Positives AgentGuard v0.6.4 100% (39/39) 0 Semgrep 0% (0/39) 0 CodeQL 0% (0/39) 0 Zero. Semgrep and CodeQL detected nothing. They have zero rules for AI agent security. AgentGuard has 17 detection rules covering all 10 OWASP ASI categories plus 4 novel attack vectors: Memory Poisoning, Tool Output Trust, Action Chain Amplification, and Multi-Agent Collusion. Real World AgentGuard found 332 critical vulnerabilities across Microsoft AutoGen and LlamaIndex. Issues reported directly: autogen#7917, autogen#7918, llama_index#22245. Reproduce git clone https://github.com/dockfixlabs/agentguard-benchmark cd agentguard-benchmark pip install dfx-agentguard python benchmark.py GitHub: https://github.com/dockfixlabs/agentguard PyPI: pip install dfx-agentguard

Every big social network locks audience data behind auth walls and anti-bot systems. Bluesky went the other way. The AT Protocol is open by design, so public profile data (bios, follower counts, full follower and following lists) is queryable through a documented API without logging in. The whole surface is basically two endpoints: GET https://api.bsky.app/xrpc/app.bsky.actor.getProfile?actor=HANDLE GET https://api.bsky.app/xrpc/app.bsky.graph.getFollowers?actor=HANDLE&limit=100 There's also getProfiles for batching 25 handles per call. Follower lists paginate with a normal cursor , which still works on the graph endpoints. Search is a different story, cursor pagination 403s there now, but that's a topic for another post. For one-off lookups, curl is honestly all you need. Where it gets tedious Bulk. Thousands of profiles, follower exports that run into six figures, weekly snapshots for tracking. Pagination, rate-limit backoff, and stitching the pages together is boring code that has to run reliably. I packaged that part as an Apify actor: Bluesky Profile Scraper . Paste handles or profile URLs, optionally turn on follower/following export, and you get JSON or CSV back with a sourceProfile field linking each follower record to the profile it belongs to. $2 per 1,000 records, runs on a schedule if you want snapshots over time. What people use this for Vetting an influencer's real audience before paying them. Exporting who follows a competitor and what their bios say. Charting follower growth from weekly runs. And enrichment: find who's talking about you with a mentions monitor , then profile those authors to see their actual reach. Bluesky is the only major network right now where any of this is straightforward and stable. Worth using while it lasts.

Osloq — ใช้ AI หาสาเหตุ bug แทน เวลา AI coding tools เสนอจะ "fix bug ให้" — เราได้แต่กด Accept หรือไม่ก็ Reject สองปุ่ม สองทางเลือก แต่เราไม่เคยรู้ว่า: AI รู้ได้ยังไงว่า bug เกิดจากตรงนี้? มัน reproduce แล้วหรือแค่อ่านโค้ดแล้วเดา? ถ้าเรา accept — มันจะพังของอย่างอื่นไหม? Osloq เลือกทางที่สาม: ไม่ใช่ "fix ให้" — แต่ " หาให้เจอแล้วบอกว่าเกิดอะไรขึ้น " Osloq คืออะไร Osloq เป็น AI agent ที่ทำหน้าที่ "นักสืบ bug" มีคนเปิด GitHub Issue → Osloq อ่าน → trace โค้ด → reproduce ใน sandbox → ส่งรายงานพร้อมหลักฐาน ┌─────────────────────────────────────────────────────┐ │ GitHub Issue: "ปุ่ม submit กดไม่ติดบน Safari" │ └─────────────────────┬───────────────────────────────┘ ▼ ┌─────────────────────────────────────────────────────┐ │ Osloq: │ │ 1. อ่าน issue → เข้าใจว่า "ปุ่มไม่ทำงาน" │ │ 2. trace โค้ด: จาก handler → service → DOM event │ │ 3. reproduce: รัน Safari ใน sandbox → ปุ่มไม่ติดจริง │ │ 4. จับหลักฐาน: logs, screenshots, call stack │ │ 5. สรุป: "event listener ใช้ 'click' แต่ Safari │ │ บน iOS 18 ไม่ bubble event — ต้องใช้ 'pointerdown' │ └─────────────────────┬───────────────────────────────┘ ▼ ┌─────────────────────────────────────────────────────┐ │ Report บน GitHub Issue: │ │ 📸 screenshot ของ Safari ที่ปุ่มไม่ทำงาน │ │ 📋 console error: "Unhandled Promise Rejection" │ │ 🔗 code path: handler.ts:42 → form.ts:17 │ │ 💡 suggestion: เปลี่ยน event type │ └─────────────────────────────────────────────────────┘ คุณอ่าน report → เข้าใจปัญหา → ตัดสินใจเอง ว่าจะแก้ยังไง ต่างจาก "AI Fix Everything" ยังไง Devin / Sweep AI Osloq แนวคิด "Fix the bug" "Find the cause" ทำงานยังไง เขียนโค้ดใหม่ → เปิด PR Reproduce → รายงาน evidence เราเห็นอะไร PR diff ภาพ, log, call stack, บทสรุป ใครตัดสินใจ AI (เราแค่ merge) เรา (AI บอกว่าอะไรผิด) ถ้าผิดพลาด โค้ดผิดเข้า main Report ผิด — ไม่กระทบโค้ด ความเสี่ยง สูง — AI แก้โค้ดโดยตรง ต่ำ — AI แค่แนะนำ ทำไมถึง "สบายใจกว่า" 1. คุณเห็นหลักฐาน — ไม่ใช่แค่ diff ❌ "Fixed button click handler — please review" → review 300 บรรทัด — ไม่รู้ว่าแก้ถูกไหม ✅ "Button

Ask ChatGPT or Perplexity "what's the best note-taking app" and you get a shortlist of three to five names. Either you're on it or you don't exist in that channel. And buying research keeps moving there. People call measuring this GEO or AEO tracking now. The way most teams do it is pasting questions into chatbots by hand and eyeballing the answers. That stops scaling at about ten questions, and you can't trend it week over week. Doing it programmatically Don't scrape the chat UIs. It's fragile, against ToS, and breaks weekly. The engines all have official APIs with web search: Perplexity's sonar models return answers with citations built in OpenAI has gpt-4o-search-preview for live web search Gemini's gemini-2.5-flash supports Google Search grounding One OpenRouter key covers all three through a single endpoint, which keeps the code boring. For each buyer question you care about, record four things per engine: was the brand mentioned, how early in the answer, was your domain cited as a source, and how often competitors appeared. That last one gives you share of voice. The packaged version I built this as an Apify actor: AI Brand Visibility Tracker . You give it a brand name, domain, competitors, and topics. It generates realistic buyer questions and returns one JSON row per check: brandMentioned , positionScore , brandCited , shareOfVoice , citedDomains , plus a per-engine summary. Schedule it weekly and you have an AI visibility trendline for client reports. $0.05 per check. The field that actually matters citedDomains is the actionable one. It tells you which sites the AI engines treat as sources for your category. Getting mentioned on those specific domains is how you move your visibility. It's link building, except the target list comes from the AI's own citations instead of a guess.

I just opened 3 security issues on two of the most popular AI agent frameworks on GitHub (combined 110K+ stars). The Issues microsoft/autogen#7917 : Docker code executor mounts host filesystem into sandboxed containers without trust boundary validation — container escape vector. microsoft/autogen#7918 : Agent self-modification patterns in Canvas memory module — agents can alter their own operating constraints during execution. run-llama/llama_index#22245 : 441 instances of unbounded recursive agent execution across 2,951 files — systemic resource exhaustion risk. All found with AgentGuard v0.6.2 (pip install dfx-agentguard), an open-source AI agent security scanner. Why Issues, Not Articles I have published 12 articles on Dev.to. Average views: 11. GitHub Issues on 50K+ star repos are read by thousands of developers and stay visible for years. This is the correct distribution channel for security findings — direct, unfiltered, and actionable. The Pattern The same vulnerability classes appear across all frameworks: Trust boundary violations (ASI10): agents crossing filesystem and network boundaries Agent recursion (ASI09): unbounded loops without circuit breakers Self-modification (ASI10): agents modifying their own state during execution These are not framework-specific bugs. They are systemic architectural gaps in how we build autonomous agents. Every framework needs guardrails for resource limits, trust boundaries, and behavioral constraints. AgentGuard detects all of them. 16 rules, 83 tests, 36 benchmark samples, 100 percent detection rate. pip install dfx-agentguard

I wanted to know when people mention a brand on Bluesky. Simple ask. Turns out Brandwatch, Mention, Hootsuite, basically every social listening tool, still doesn't cover it. They're all busy with X and Instagram while Bluesky sits at 27M+ monthly users. So I looked at doing it myself and found out something most people miss: you don't need to scrape anything. Bluesky runs on the AT Protocol, which is open by design. Public posts are searchable through a documented endpoint. No login, no API key. GET https://api.bsky.app/xrpc/app.bsky.feed.searchPosts?q=YOUR_BRAND&sort=latest&limit=100 That returns full post objects. Text, author handle, timestamps, like/repost/reply counts, embedded links, hashtags. Everything you need. Two things that broke my first version Worth writing down because most tutorials get this wrong now: The public.api.bsky.app host that older guides point to returns 403 for search. Use api.bsky.app instead. As of July 2026, unauthenticated search rejects cursor pagination. Page one works fine, page two gets you a 403 with "request forbidden by administrative rules". The nasty part is it looks like rate limiting, but it isn't. The workaround: paginate by time. Use sort=latest , then pass until= with the createdAt of the oldest post from the previous page. Dedupe on uri because the boundary post shows up twice. If you don't want to maintain any of that I packaged the whole job as an Apify actor: Bluesky Mentions Scraper . Keywords in, clean JSON out. It handles the pagination and retry stuff above, filters replies if you want, scores basic sentiment, and can pull follower counts for each author so you can sort mentions by reach. Runs on a schedule, exports CSV, plugs into Slack or n8n through Apify's integrations. It also works as an MCP tool inside Claude or Cursor. Pricing is per result, $4 per 1,000 mentions. No subscription. What I actually monitor Brand and product names plus the common misspellings. Competitor names, because share of voice on Blu

I just shipped 5 new tools to DevNestio — a hub of 172 free, browser-only developer utilities. All tools are zero-signup, zero-upload, and work offline. 1. GraphQL Query Formatter & Minifier https://devnestio.pages.dev/graphql-formatter/ Paste any GraphQL operation and get: Pretty-print — consistent indentation Minify — strips comments and whitespace for smaller request payloads Validation — brace/parenthesis balance check Operation detection — lists all named query , mutation , subscription , fragment Useful for quick query cleanup before pasting into code reviews or API docs. 2. Protobuf (.proto) Formatter & Validator https://devnestio.pages.dev/protobuf-formatter/ Online formatter and validator for Protocol Buffer .proto files: Duplicate field number detection Message and enum structure validation Syntax-highlighted output One-click copy Great for a sanity check before pushing .proto changes in a gRPC service. 3. Docker Compose Validator https://devnestio.pages.dev/docker-compose-validator/ Paste your docker-compose.yml to catch: Missing services section Services without image or build Invalid port mappings ( 80:80 , 127.0.0.1:8080:80 , 53:53/udp , ranges…) depends_on referencing non-existent services Circular dependency detection (A→B→A) Unknown restart policies # This will flag errors: services : web : ports : - " abc:xyz" # invalid port depends_on : - missing_service # unknown service 4. Dockerfile Analyzer & Linter https://devnestio.pages.dev/dockerfile-analyzer/ Analyzes your Dockerfile for best practice violations across three categories: Security sudo usage inside RUN Container running as root (no USER instruction) Secrets baked into ENV / ARG (password, secret, token, key) Image size :latest base image tag apt-get update in a separate RUN (stale cache risk) apt-get install without --no-install-recommends apt cache not cleaned ( rm -rf /var/lib/apt/lists/* ) ADD used for local files instead of COPY Layer optimization Consecutive RUN instructions (suggest c

GA in a sentence GitHub moved its enterprise managed-settings.json to general availability on July 1, giving GitHub Enterprise Cloud admins a single JSON file that overrides Copilot behaviour in VS Code and Copilot CLI for anyone holding a Copilot Business or Copilot Enterprise seat issued from the enterprise or one of its organizations. The changelog frames it as a place to define AI standards for the tenant. In practice it is a supported home for Copilot policy that shipped one setting at a time in beta up to this point. The five keys the file accepts Five keys are documented at GA: extraKnownMarketplaces , enabledPlugins , strictKnownMarketplaces , disableBypassPermissionsMode , and model . Together they configure trust for extra plugin marketplaces, the enabled-plugins list, strict enforcement of the known-good marketplace list, whether Copilot CLI and the VS Code extension can run in bypass-permission mode, and which model a user is allowed to pick. Value shapes are not enumerated in the changelog itself; the docs page is the reference for the schema. How the file reaches a client The file lives at copilot/managed-settings.json inside the .github-private repository of the organization the enterprise nominates for the role. There is a backward-compatible path at .github/copilot/settings.json for tenants already using the older layout. Copilot clients fetch the file from the server on every authentication, hold it in memory, and refresh it hourly, per the changelog. That server-side file takes precedence over the file-based config a user may have on their own machine. Setup runs through the AI Controls tab in enterprise settings, or the equivalent API endpoint, where an admin picks the hosting organization. Anyone who followed the June rollouts of disableBypassPermissionsMode and strictKnownMarketplaces will recognise the same file and the same repo. GA is what turns the plumbing into a supported product surface. Where it will trip you Two operational details are

TL;DR Two Laravel backends started serving Flutter apps on the same day — an events platform (auth, orders, offline check-in) and a helpdesk product (ops mode for agents). gatherhub-web moved to plans-only pricing with a comparison matrix driven by one data file. A hardening pass: payment-safe queues, gateway reconciliation, one heavyweight dependency dropped. Two mobile APIs in one day Coincidence, but a useful one: two products I'm building both needed their Laravel backends to serve mobile apps this week. The events platform got the full foundation — token auth (login/refresh/logout/me), participant orders, mobile payment with status polling, push-device registration, and an offline-first staff check-in flow. That last one is the interesting bit; I wrote it up as its own post. The helpdesk product went the other way: its API was client-only, and today it became role-aware. The same endpoints now serve ops agents working tickets from their phones, with abilities deciding what each role sees. One API surface, two personas, no duplicated /admin routes. The lesson that repeated in both: API Resources are the contract. The moment a mobile dev consumes your endpoint, every field you accidentally leak becomes a field you can't remove. Plans-only pricing (public) gatherhub-web , the Next.js marketing site, dropped à-la-carte feature pricing for three plans and gained a plan comparison matrix. Everything renders from a single plans.ts — the matrix, the pricing cards, the enterprise page — so the marketing site can't drift from what's actually sold. A pricing page is a contract too; it deserves a single source of truth as much as your API does. Hardening pass Change Why Bulk email blasts isolated to their own queue one big send must never delay a payment webhook Reconciliation command for stuck pending orders webhooks fail silently; polling the gateway is the safety net maatwebsite/excel → spatie/simple-excel for exports streams rows instead of building sheets in memory, s