Skip to content
360SOFTY
HomeInsights

Insights

Ideas for building
better software.

Engineering perspectives on architecture, product development, AI, and the everyday decisions behind useful software.

From the engineering desk

Browse practical articles or follow the latest technology updates.

Subscribe via RSS →

Curated links from external sources — not 360Softy original articles.

ExternalSoftware Engineering
DEV Community

I Found an Undocumented MCP Server on OpenSea — and It Leaked Usernames for Any Wallet

TL;DR: OpenSea runs an undocumented MCP server at mcp.opensea.io/mcp. One of its tools hands out API keys to anyone who asks, and another lets you resolve any Ethereum address with an OpenSea profile to its owner's username. Reported to Bugcrowd, now sharing the story and a free recon kit. I was poking around OpenSea's tooling one afternoon — just trying to understand how some of their internal features worked. Nothing fancy, no scanners, no brute force. Just curiosity and a browser. That's when

webdev
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

I described 1,245 tables with an LLM and retrieval got worse

The cataloguing step is supposed to be the easy win. You have a schema whose ecm_template_link and v_pmpm, your users ask questions I did that to a real 1,245-object schema. Recall went down. Not by a little. The table literally called contacts sat at rank 3 for the This post is what was actually happening, why the obvious fix doesn't work, Every description you generate is written in the same vocabulary as every BM25 scores a term by inverse document frequency: idf(t) = log(1 + (N - n_t + 0.5)

aillmrag
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Every text-to-SQL benchmark score you've seen was measured without access control

Spider, BIRD, LiveSQLBench. If you have evaluated a text-to-SQL system in the None of them ask who is asking. Every score you have seen was produced by a system with unrestricted read Benchmarking Text-to-SQL under Role-Based Access Control, by Yang Fei, The scale of the augmentation: 53 databases, 399 tables, 3,353 columns 21,502 role-annotated query instances policies at column-operation granularity — not "can this role read this table" but "can this role SELECT this column" roles synthesised

aidatabasesecurity
DEV CommunityRead original

Let’s start with a conversation

Tell us what you’re working on.

An idea, a challenge, or a system that needs to work better. We’ll help you understand the next step.

Discuss your project

Prefer email? [email protected]