Aman Kumar Sah

@mehulmpt Co star ui and ux is way better than 99.999% astrology apps. 😂

everytime i see astrology companies like this, a part of me dies inside

Ps: not applying for the forward deployed engineer role at @getdodgeai but ya do read it whole its imp for you all . But here we go , today i came acrross ur id and saw you guys are building modern ERP system or we can Agents for the ERP which is cool no doubt , many things are vibe coded as per the video which shows the token burning rate , i wish i could do same too . As a Developer (student) i did first step of knowing the system which you guys are building and my first principle is to know the system first then look for the some other things . What i discovered :- I discovered numerous internet-accessible subdomains, including: [Most have auth which is less secure too ] app.getdodge.ai api.getdodge.ai automation.getdodge.ai platform.getdodge.ai platform-staging.getdodge.ai return-order-dev.getdodge.ai return-order-prd.getdodge.ai sales-order-dev.getdodge.ai sales-order-prd.getdodge.ai stock-transport-order-dev.getdodge.ai stock-transport-order-prd.getdodge.ai tmc-dev.getdodge.ai themancompany.getdodge.ai Risk: Larger attack surface means more components to secure. Tech-Fingerprints say Vercel Google Cloud Load Balancer [34.100.abcd.abcd] 9This is raw gcp compute engine where sales order and dev.get doge . ai runs Nginx [ This is perfectly configured ] Node.js Express OpenUI5 Streamlit Next.js Deployments services are publicly reachable ,even if authentication is required ,public dev environements deserve review . return-order-dev =>[FB60 Uploader Service is running] this u get in plain browser sales-order-dev [Error 502] Nginx plays well here platform-staging [ This give the login page ] which should not be . =>Several services returned - 502 Bad Gateway its ok but on the dev-ops side its not good as it indicated the deployment or upstream issue . => Health endpoint is exposed automation.getdodge.ai its returns the json its not vulnerability by itself . =>Generic login errors The server always responds with Invalid email or password instead of revealing whether the email exists. Good security practice. => TLS configuration is good . =>Repeated invalid logins always returned 401. Apply the rate limit here . => Weak Content Security Policy is there . Overall the backend team need to work in with the the production environment exposes a larger-than-necessary attack surface, and there are several operational and hardening issues that should be addressed. Based on the evidence you've gathered so far, I do not see a confirmed critical vulnerability, but I do see areas where security posture can be improved => For production hygine 6.5/10 . Only good thing i loved was the he login endpoint validates JSON returns generic errors doesn't leak usernames but this is also so weak as time is growing fast and things are changining repeatedly implement the OIDC auth system . The biggest concernt is the too many public subdomain and all are publicly discoverable . If the CSP is missing or relies on unsafe-inline, it weakens defense-in-depth against XSS. Overall all the best guys for the product , Looking for the response . Instead of studying things today which was the part of my daily routine i did invested my knowledge and time upon your product . Lets connect if you guys find it informative . Hoping for good things .

@ImLunaHey Humm start with problem statement and then show the process how you solve them.

i really wanna make youtube videos about tech but have no clue where to start.

@cricketizlife Lost it's old news just got viral today 🙃

Airtel walo tumhari mkc, college me mere laptop ko hotspot tumhara baap dega?

@ImLunaHey Yes i am in Some of my photo edits to give you context i am an heavy user of photo editing apps

do i know anyone that'd be down to testing a photo/image editor ive been working on and giving feedback, reporting bugs, etc? it's web based so no need to download anything.

@googlegemma Hey @googlegemma Are you planning to provide the paid inference for gemma models ???

We’re rolling out some big improvements to Gemma 4, fueled by incredible community feedback and contributions! Here is a breakdown of what’s being fixed and updated in this release: 🧵👇

@thsottiaux I would say option for both

Tomorrow might be 8M active user celebration day. Just saying

User mode vs Kernel mode. A boundary most aren't thinking about often when building software, but matters a lot for performance! The more you know about your OS, the better.

@ImLunaHey @thsottiaux @t3dotcodes Noice

@Rapid_IND @thsottiaux im using @t3dotcodes

im really surprised with just how much ive gotten done with a $20/m sub to codex. in saying that... @thsottiaux can we pretty please have a reset soon?

@thsottiaux Thanks this is little crazy to track how much i am using .

Morning. The last 48 hours of Codex and ChatGPT Work have been intense! Three important updates: - Temporarily removing the 5 hour usage limit restriction for all Plus, Business and Pro plans - Rolling out changes that will make GPT 5.6 Sol more efficient across the board and that will be reflected in less usage being used so that it can take you further. Exact impact to be quantified and shared - We hit 6M active users, and are landing a usage reset in the next hour Go do things

@BenjDicken Best resources ❤️

It seems my YouTube channel could not have been better timed. Go read! Go learn! I don't care if AI gets 100x smarter than it is today.

@ImLunaHey ZED

what IDE is everyone using nowadays?

@thsottiaux Will be shipping bug fixes after that 😅😅😅

@ImLunaHey Better than living in hell humidity + heat trapped in home 💀

to everyone who told me london was cold and miserable, you lied!

Not an intern more will be posting new learnings soon.

MAS 3.11 - 8 Years of MAS Happy 8th Anniversary of the first release of MAS! 🎉 See full changelog here: massgrave.dev/changelog

Since most of @elonmusk's products use TanStack in some way, I think it's reasonable for me to want a 1:1 trade-in value on the Y I just bought a few months ago so I can upgrade to the YL. Let's keep Open Source *free! 😉

Even if a game vanishes from the GOG storefront, it never leaves your library. Exactly as digital ownership ought to be.