Developer news without the noise — My Dev News in Telegram.
Tag
All blog posts with this tag.
How to ship registration and sign-in with passkeys: the WebAuthn ceremony, relying-party id, challenges, synced vs device-bound keys, account recovery, and the server checks that demos skip.
Assistants optimize for a plausible runnable sample, not production. A Dev.to write-up names seven recurring holes and ships ai-vuln-scan to catch them.
Reverse engineering Voodoo.js: from the browser HTML parser’s DOM to a lexer, Pratt AST, tree-walking interpreter, Proxy effects, and direct node writes—without eval.
Production RAG cannot leave authorization to the model. How to isolate tenants, apply access lists before retrieval, close hidden leak channels, and measure recall under tight filters.
Start with the product decision and guardrails, then the model—offline eval as integration tests plus error analysis.
Agent PRs outpace review capacity: review debt, what AI can catch vs what humans must own, a post-diff checklist, human gates, and a team playbook for light vs deep review in 2026.
A practical model for agentic development: context, task decomposition, verification loops, multi-agent orchestration, security, DORA metrics, and the engineer's role in the 2026 SDLC.
A practical operating model for putting AI agents and RAG systems into production: policy-as-code, narrowly scoped tools, human approvals, adversarial testing, and audit evidence that engineers can actually use.
A production security model for prompt injection: treat retrieved documents, web pages, tool results, and MCP resources as hostile input; isolate context, constrain egress and tools, sandbox execution, and test layered defenses.
A practical guide to Model Context Protocol after the 2026-07-28 release: no sessions, MRTR, header-based routing, auth hardening, shadow MCP, and servers that survive real load.
A practical architecture that connects business problems, knowledge, RAG, agents, security, and observability into one enterprise AI platform.
CVE-2026-7482 in Ollama shows how a local LLM server can expose process memory when it accepts untrusted model files and network access.
The architectural mistakes that weaken enterprise AI platforms—and how to prevent them before production rollout.
How to extend an enterprise AI platform across a group while preserving shared standards, local data boundaries, and an operable architecture.
A practical lifecycle for changing enterprise AI safely: requirements, testing, security review, controlled release, rollback, and monitoring.
How to operate enterprise AI with observability across infrastructure, RAG, answer quality, security, and business metrics.
A practical framework for measuring enterprise AI across retrieval, answers, security, and business outcomes.
How to design scalable RAG for many data sources, millions of documents, and access-controlled enterprise knowledge.
How to clean, describe, chunk, and safely index enterprise documents for reliable AI answers.
How to select servers, accelerators, networking, and storage for enterprise AI without buying capacity you do not need.
How to select a language model for enterprise AI using scenarios, security, cost, and infrastructure requirements.
How to design a scalable enterprise AI platform where knowledge, security, and integrations matter more than any individual model.
How to select a bounded, secure enterprise AI pilot, define success criteria, and prepare for responsible scaling.
How to discover, classify, and safely connect enterprise knowledge for RAG and enterprise search.
How interviews, process analysis, and knowledge discovery prepare an enterprise AI project for sound design.
Why an enterprise AI project starts with business needs, knowledge, and security—not with a model or server choice.
How to build an enterprise AI platform that can outlive changing models, vendors, and data formats.
Why corporate AI adoption succeeds through pilots, training, and feedback—not a big-bang rollout across the organization.
How to assign accountability, control change, and sustain quality and security across a corporate AI platform.
How to connect corporate AI to ERP while preserving data authority, access roles, and operational controls.
How agent systems connect language models to enterprise services and automate processes while keeping people in control.
How to separate enterprise knowledge from model behavior and decide when fine-tuning is worth the operational cost.
Why data protection, access controls, answer traceability, and audit must shape enterprise AI architecture from day one.
How to design reliable, scalable enterprise AI infrastructure from business scenarios, security constraints, and service-level requirements.
How vector databases make enterprise knowledge searchable at scale while preserving source systems and access controls.
How vector representations retrieve enterprise knowledge by meaning while preserving exact search and security requirements.
How RAG separates enterprise knowledge from the model, keeps documents current, and preserves verifiable, permission-aware access.
How the limits of search and rule-based systems led to LLMs—and why a model is an interface to knowledge, not enterprise memory.
How to build an enterprise AI platform around a knowledge layer, integrations, and security without depending on one model.
Why enterprise AI should begin with measurable business outcomes, knowledge, and security—not model selection.
Why knowledge is a strategic asset and corporate AI starts with business problems and security—not with picking an LLM.
Staged publishing lets you upload to the registry, verify, then promote — reducing supply-chain blast radius. Plus pnpm 11.3 trustLockfile and npm 12 prerelease.
Concatenation, template literals, and innocent-looking sql variables — why reviews miss them and how eslint-plugin-pg catches them statically.
40% of teams cite security as the top barrier to scaling agentic AI. Docker Sandboxes, Engine hardening, and governance for autonomous code.
arXiv preprint: attackers split harmful tasks across benign-looking sessions — clustering weak signals catches misuse ~30% earlier with negligible latency for most traffic.
ignore-scripts, npm ci, provenance, and lockfile review—layered defenses when node_modules holds thousands of transitive packages.
