360SOFTY

Insights

Engineering Insights

Practical writing on software architecture, SaaS products, AI automation, legacy modernisation, and the business of building reliable systems.

RSS

Curated links from external sources — not 360Softy original articles.

ExternalSoftware Engineering
DEV Community

Is your agent's grep tool a shell command?

When you give an LLM a tool, you hand it a real function and let it choose the arguments. Those tools are everything your agent can do to a real system: read a file, write to your database, send an email, run a shell command, delete data. They are your risk surface, and most teams have never looked at it in one place. So we did. We ran scan across a batch of popular open-source TypeScript AI agents. A few of the things it found, none of them exotic: A coding agent whose grep and glob tools, whic

aiagentssecurity
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Testing Keycloak SPIs with Testcontainers — the part every tutorial skips

Most "here's how to write a custom Keycloak authenticator" posts end at mvn package. You get a class that implements Authenticator, a factory, a META-INF/services file, and a "drop the jar in providers/ and restart" instruction — and that's where the tutorial stops. Nobody shows you how to actually test the thing, which is a problem, because SPI development has a genuinely nasty feedback loop: package, copy the jar, restart Keycloak, click through a login flow by hand, repeat. I've spent enough

keycloaktestingtestcontainers
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Your Keycloak roles aren't working in Spring Security. Here's the actual reason.

If you've wired up a Spring Boot resource server behind Keycloak and your @PreAuthorize("hasRole('ADMIN')") is silently returning 403 for a user you can see has the ADMIN role in the admin console, you're not going crazy. This happens on basically every first Keycloak + Spring Security integration, and the reason is boring once you see it: Spring Security's default JWT converter has no idea Keycloak exists. I've hit this on every Keycloak-secured backend I've built over the past couple of years

keycloakspringjava
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Build a Pear Protocol DeFi trading agent with MCP

If you want an AI agent that can actually trade, not just chat about charts, the Model Context Protocol (MCP) is the cleanest way to wire a model to a real exchange. This post builds a Pear Protocol DeFi trading agent: one that can browse pair markets, read your positions and portfolio, and (when you turn it on) open and close leveraged pair trades on Hyperliquid. We'll use mcp-pear, an open-source MCP server that wraps Pear Protocol's API. Pear Protocol is a Hyperliquid-backed platform for pair

mcpaidefi
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

I Built What I Benchmark. Here's How I Try Not to Cheat.

On 2026-07-05, re-verifying the numbers before publishing the 17-plugin benchmark, eslint-plugin-unicorn came back 0 of 40 — a suspiciously clean zero that would have read as proof a well-regarded plugin was worthless. It wasn't: a stale Node version in my shell had silently swallowed the run, and the real number was 22 of 40, F1 51.8% (the full forensic walkthrough lives in Bias in Measurement; this article is about the process that made me go looking for it). That's the kind of mistake a vendo

securityeslintdevsecops
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

I Maintain 23 Benchmark Suites Across My Own Packages. Only 1 of the Serverless Ones Has Real Numbers Yet.

Five days earlier, an audit of my own ESLint plugins found 140 files still calling context.getFilename(), getSourceCode(), and getCwd() — three APIs ESLint 10 removes outright, not merely deprecates. Every one of my packages claims "supports ESLint 8, 9, and 10." Nobody hits this on ESLint 9, where the calls still work under compatibility shims — but on ESLint 10, my own rules would break the exact claim printed in my own README. eslint-plugin-security fails earlier and differently: it crashes o

securitydevsecopseslint
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Who Owns the Row

One of my systems runs a nightly job with two sets of manners. On 154 rows it overwrites whatever it finds and asks nobody. On 15 rows it cannot change a single field; the best it can do is file a request and wait. Same job, same feed, same table. The only difference is whether a human being ever touched the row. The system is a command center for a workforce development operation. The State of Illinois publishes a directory of workforce centers, and every night my sync pulls that feed and compa

dataauthoritygovtechworkforcedevelopment
DEV CommunityRead original

Work with 360Softy

Building a SaaS product, AI system, or business platform?

Book a free consultation and we will tell you honestly whether we can help.

Book a consultationView our services →