标签：#rce

We have tools for checking whether a query is injectable. We have linters, scanners, ORMs, parameterized queries, and database policies. But after the database returns rows, most applications simply trust that the result set matches the operation that asked for it. queryguard starts there. The query may be safe. The result may still be wrong. SQL injection taught us to distrust query construction. Parameterized queries answered the question: Did the user control the query structure? That question is well understood. The tooling is mature. But it is a different question from the one queryguard asks: Did this operation receive only the rows and fields it was allowed to receive? Those two questions are not the same. A perfectly safe parameterized query can still return the wrong row — because a predicate was dropped, a join widened the result, a developer selected a column they shouldn't have, or a query was rewritten without updating its scope contract. queryguard is not a database firewall. It is not a SQL injection scanner. It is not an ORM plugin. It is a contract check for observed result sets. Where it sits The hook position is the core design decision. queryguard sits immediately after cursor execution — before any result shaping, filtering, serialization, or response mapping. cursor = conn . execute ( sql , bindings ) rows = [ dict ( row ) for row in cursor . fetchall ()] evidence = queryguard . run_check ( contract , { " contract_id " : " user_profile_lookup " , " contract_version " : " 0.1.0 " , " params " : { " user_id " : user_id }, " session " : { " tenant_id " : tenant_id }, " result " : rows , }) if evidence [ " verdict " ] != " PASS " : raise QueryguardViolation ( evidence ) return rows Not at the HTTP layer. Not inside the ORM. Not at the API gateway. Immediately after the cursor returns rows — while the result is still raw, before anything shapes or discards it. This is intentional. If rows are shaped before queryguard sees them, queryguard cannot det

I built a large feature. That's not what this is about. What changed is the baseline — the standards, docs, and automation that exist now and didn't two weeks ago. Everything after this will be built on top of it. Automated tests now ship with new features QA testers were testing. The product was covered. What didn't exist was automation — no E2E suite, no unit tests for new work, no repeatable spec. Now it does. The manual QA cycle stays. The automation catches what humans miss on the tenth pass. Quality leap going forward. Human hours saved. The next feature ships with both. The baseline is set Knowledge lives in the repo. Bug catalog with root causes — so the same thing doesn't get fixed twice. Tech debt inventory with a phased plan. Testing strategy documented, not assumed. GraphQL schema committed and validated against — drift gets caught before it ships. Pre-commit hooks that enforce the standards automatically. The frontend and backend documentation are cross-referenced as single sources of truth. The agent instructions point to the right places. Everything new builds on what's already written. Schema-first development The workflow is now: if the schema accommodates the new field, reuse what exists. If it doesn't, the schema update creates the new structure, the data migrates, and everything stays consistent. No guessing. No drift. One source of truth for what the data looks like. The feature is what you see. The baseline is what you don't — and it matters more.

GitHub热门项目 | An efficient AI coding agent | Stars: 607 | 137 stars this week | 语言: Rust

GitHub热门项目 | 基金实时估值查看 | Stars: 1,411 | 43 stars this week | 语言: JavaScript

GitHub热门项目 | Event streaming platform for agentic AI. Continuously ingest, transform, and serve event streams in real time, at scale. | Stars: 9,104 | 5 stars today | 语言: Rust

GitHub热门项目 | A Flash Player emulator written in Rust | Stars: 18,229 | 9 stars today | 语言: Rust

GitHub热门项目 | Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs. https://katacontainers.io/ | Stars: 8,166 | 12 stars today | 语言: Rust

GitHub热门项目 | 🎉 A Vue.js 3 UI Library made by Element team | Stars: 27,550 | 7 stars today | 语言: TypeScript

GitHub热门项目 | 🚀 Strapi is the leading open-source headless CMS. It’s 100% JavaScript/TypeScript, fully customizable, and developer-first. | Stars: 72,475 | 34 stars today | 语言: TypeScript

GitHub热门项目 | 📝 Algorithms and data structures implemented in JavaScript with explanations and links to further readings | Stars: 196,137 | 15 stars today | 语言: JavaScript

GitHub热门项目 | Connect APIs, remarkably fast. Free for developers. | Stars: 11,502 | 2 stars today | 语言: JavaScript

GitHub热门项目 | A list of free LLM inference resources accessible via API. | Stars: 24,157 | 100 stars today | 语言: Python

GitHub热门项目 | 小红书笔记 | 评论爬虫、抖音视频 | 评论爬虫、快手视频 | 评论爬虫、B 站视频 ｜ 评论爬虫、微博帖子 ｜ 评论爬虫、百度贴吧帖子 ｜ 百度贴吧评论回复爬虫 | 知乎问答文章｜评论爬虫 | Stars: 52,587 | 347 stars today | 语言: Python

GitHub热门项目 | Transforms complex documents like PDFs and Office docs into LLM-ready markdown/JSON for your Agentic workflows. | Stars: 69,150 | 524 stars today | 语言: Python

GitHub热门项目 | JavaScript in-page GUI agent. Control web interfaces with natural language. | Stars: 19,610 | 280 stars today | 语言: TypeScript

GitHub热门项目 | A self-hosted travel/trip planner with real-time collaboration, interactive maps, PWA support, SSO, budgets, packing lists, and more. | Stars: 6,207 | 112 stars today | 语言: TypeScript

GitHub热门项目 | AI 时代的伯克希尔：基于 Claude Code 的价值投资研究框架。巴菲特·芒格·段永平·李录四大师方法论 + 多Agent并行研究。| AI-era Berkshire: a value investing research framework built on Claude Code. 4 masters' methodologies + multi-agent adversarial analysis. | Stars: 1,563 | 201 stars today | 语言: Python

Building Rule-Validator: Why I Built a Java Annotation-Based Rule Engine After 3 Years of Fighting Business Rules Let me tell you a story. For three years, I've been fighting the same battle in enterprise Java development: business rule validation . Honestly, every time a new requirement comes in like "this order must be approved if amount > 10000 AND user level > 3 AND discount < 0.1", I'd end up with a 500-line method full of if-else that nobody wants to touch. Sound familiar? I tried every existing solution: Drools: Too heavy, requires learning a new DSL, impossible to debug Spring Validation: Great for basic validation, but can't handle complex business rules nicely Hand-written if-else: Works, but becomes unreadable after 10 rules Expression engines like Aviator: Still externalized, breaks compile-time checking So here's the thing — I learned the hard way that what Java developers actually want is simple, annotation-based, compile-safe rule validation that lives right next to your code. That's why I built rule-validator . What is Rule-Validator? Rule-validator is a lightweight Java library that lets you define business rules using annotations directly on your classes . No DSL, no external files, no magic — just simple, testable, maintainable rules. The core idea is: Each rule is a method annotated with @Rule Rules can be grouped and ordered You get full Java compile-time checking Everything stays in your code, where it belongs Here's a quick example to show you how it works: import com.github.kevinten10.rulevalidator.annotation.Rule ; import com.github.kevinten10.rulevalidator.annotation.RuleGroup ; import com.github.kevinten10.rulevalidator.core.RuleExecutor ; import com.github.kevinten10.rulevalidator.result.RuleResult ; // Define your business object public class Order { private BigDecimal amount ; private Integer userLevel ; private BigDecimal discount ; // getters and setters public BigDecimal getAmount () { return amount ; } public Integer getUserLevel ()

It is clear that Vyshyvanka is more than just code — it is an ecosystem. The true power of an open-source workflow engine lies in its community. Today, we want to talk about how you can get involved, whether you are interested in pushing the boundaries of the core engine or building specialized solutions with custom plugins. The Core Engine vs. The Plugin Ecosystem A common question we get is: 'Should I contribute a PR to the core engine, or should I build a separate plugin?' The answer depends entirely on the scope of your contribution. When to Contribute to Core The core engine ( Vyshyvanka.Core , Vyshyvanka.Engine , Vyshyvanka.Api , Vyshyvanka.Designer ) should be reserved for changes that benefit every user of the platform. Good candidates for core contributions: Performance improvements to the execution pipeline New fundamental port types or expression functions Bug fixes in the engine, validation, or persistence layers Enhancements to the Designer UI (canvas, node editor, property editors) Improvements to the API surface (new endpoints, better error responses) Documentation improvements These changes require careful review and testing because they impact every installation. We encourage PRs here, but we also ask that you open an issue first so we can discuss the architectural impact. When to Build a Plugin Plugins ( ./plugins/ ) are the best way to extend functionality without increasing the maintenance burden of the core. Good candidates for plugins: Integration with a specific third-party SaaS tool (CRM, CI/CD, monitoring) Custom nodes specific to your industry or use case Experimental node behaviors that are not yet ready for core Proprietary integrations you want to keep separate from the open source project Plugins are independent, versionable, and can be maintained outside the core release cycle. They empower you to solve your specific problems immediately without waiting for a core release. Project Structure at a Glance Understanding where things live i

MCP + RAG: Why I Stopped Building Complex RAG Systems After MCP Changed Everything Honestly, I've spent the last four years building increasingly complex RAG systems. Chunking strategies, embedding models, vector databases, rerankers, hybrid search... you name it, I've probably wasted a weekend trying it. I had this 1,800-hour knowledge base project called Papers — six years of notes, articles, bookmarks, everything. I built RAG version after RAG version, each time thinking "this time it'll be perfect." Spoiler: It never was. Then I added MCP (Model Context Protocol) support. And I realized something that completely changed how I think about knowledge retrieval: MCP makes traditional complex RAG obsolete for most use cases. Let me explain what I learned the hard way. The RAG Trap I Was Stuck In If you've built a RAG system, you know the drill: Chunking : Should you use fixed-size, semantic, recursive, or something fancy like LLM-powered chunking? Embeddings : OpenAI text-embedding-3-large vs Cohere vs nomic-ai vs your fine-tuned model? Vector Database : Pinecone vs Weaviate vs PGVector vs Qdrant vs Chroma? Retrieval : Top-k how many? Hybrid search with keywords? Reranking? Prompt Compression : How do you fit all the retrieved chunks into the context window? I went through every iteration. At one point, my RAG system was over 2,000 lines of code. I had configurable chunkers, multiple embedding providers, caching layers, hybrid search... it was impressive. It also didn't work that well. Here's what bothered me the most: I kept throwing more complexity at the problem, but the fundamental issue never went away. I was trying to make my knowledge base smart, but AI already got smart. Why was I reimplementing all this understanding logic when the AI can already do it better than me? How MCP Changed the Game When I added MCP support to Papers, I started with the simplest possible approach: Expose two tools: search_notes and get_note_content Search is just basic text matchin