Skip to content
360SOFTY
HomeInsights

Insights

Ideas for building
better software.

Engineering perspectives on architecture, product development, AI, and the everyday decisions behind useful software.

From the engineering desk

Browse practical articles or follow the latest technology updates.

Subscribe via RSS →

Curated links from external sources — not 360Softy original articles.

ExternalSoftware Engineering
DEV Community

I Found an Undocumented MCP Server on OpenSea — and It Leaked Usernames for Any Wallet

TL;DR: OpenSea runs an undocumented MCP server at mcp.opensea.io/mcp. One of its tools hands out API keys to anyone who asks, and another lets you resolve any Ethereum address with an OpenSea profile to its owner's username. Reported to Bugcrowd, now sharing the story and a free recon kit. I was poking around OpenSea's tooling one afternoon — just trying to understand how some of their internal features worked. Nothing fancy, no scanners, no brute force. Just curiosity and a browser. That's when

webdev
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

I described 1,245 tables with an LLM and retrieval got worse

The cataloguing step is supposed to be the easy win. You have a schema whose ecm_template_link and v_pmpm, your users ask questions I did that to a real 1,245-object schema. Recall went down. Not by a little. The table literally called contacts sat at rank 3 for the This post is what was actually happening, why the obvious fix doesn't work, Every description you generate is written in the same vocabulary as every BM25 scores a term by inverse document frequency: idf(t) = log(1 + (N - n_t + 0.5)

aillmrag
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Every text-to-SQL benchmark score you've seen was measured without access control

Spider, BIRD, LiveSQLBench. If you have evaluated a text-to-SQL system in the None of them ask who is asking. Every score you have seen was produced by a system with unrestricted read Benchmarking Text-to-SQL under Role-Based Access Control, by Yang Fei, The scale of the augmentation: 53 databases, 399 tables, 3,353 columns 21,502 role-annotated query instances policies at column-operation granularity — not "can this role read this table" but "can this role SELECT this column" roles synthesised

aidatabasesecurity
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Milestone Reached: YINI Syntax Highlighting Is Now on the VS Code Marketplace

Milestone Reached: YINI Syntax Highlighting Is Now on the VS Code Marketplace A small but important YINI milestone has been reached: the official YINI Syntax Highlighting extension for Visual Studio Code has reached version 1.0.0 and is now available on the Visual Studio Marketplace. The extension targets YINI Specification 1.0.0 RC 6 and adds syntax highlighting for .yini configuration files directly in VS Code. It highlights YINI sections, keys, values, strings, numbers, comments, lists, ob

webdevtoolingvscode
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Padrão de Projeto Decorator: Adicionando Funcionalidades sem Quebrar sua Arquitetura

Se você já trabalhou com orientação a objetos por algum tempo, provavelmente já se deparou com este dilema: como adicionar novas funcionalidades a um objeto sem criar uma explosão de subclasses? Imagine um sistema de componentes gráficos onde você precisa combinar bordas, sombras, cores e efeitos de diferentes formas. Criar uma subclasse para cada combinação possível rapidamente se torna insustentável. É exatamente para resolver esse tipo de problema que existe o Decorator, um dos padrões de pro

architecturejavasoftwaredevelopment
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

XML Configuration Mode: Decoupling Your API Catalog from Business Code

Annotation mode keeps requests close to Java, but large integrations raise a fair question: do I want a wall of curl strings inside my service interfaces? JQuickCurl's XML mode answers with a firm no — you store every API definition in a separate XML file, and the business layer only sees plain Java interfaces with no annotations at all. This is the classic "declarative client" split: contract in configuration, behavior in code. In this post you'll learn to: Author an XML API catalog with the of

apirestapijava
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Missing RLS: The Most Underrated Breach Cause of 2026

You know why there are so many breaches in databases? Perfect, me neither. Let's find out in a few minutes. Everyone worries about encryption. Almost nobody worries enough about the one thing that's actually been breaking production databases all year: a table with Row Level Security simply left off. I ran into this while researching how to safely migrate Firestore Security Rules into Postgres RLS policies for a side project. What started as "how do I translate this correctly" turned into "oh, t

securitypostgresdiscuss
DEV CommunityRead original

Let’s start with a conversation

Tell us what you’re working on.

An idea, a challenge, or a system that needs to work better. We’ll help you understand the next step.

Discuss your project

Prefer email? [email protected]