Urgent.News

What's breaking now, across thousands of outlets.

Tech

A finished scraper sat on a git branch for 19 days. Nothing noticed.

We keep a written do-not-build list. Vinted has been on it for months, with a one-line reason: DataDome, plus a saturated incumbent at 108k runs and a 5-star rating. That is a perfectly sensible thing to write down. It was also wrong, and it took us 19 days to find out — not because the wall was hard, but because nobody ever tried it. Here is the whole story, with the numbers. Quick answer A…

A fully developed scraper was left unnoticed on a git branch for 19 days before anyone noticed it. The reason for this oversight was that the build lane mistakenly counted the agent's green status as indicating completion, rather than verifying that the code had been committed to the main branch. Upon finally running the scraper against the live site, it passed without any issues at a cost of just $0.00105, utilizing the cheapest proxy tier available.

This incident highlights two important lessons: first, a "no-go" label that does not specify every tested proxy tier should not be considered a definitive "no-go"; second, the difference between an agent reporting success and the code being successfully merged into the main branch. The scraper that went unnoticed for almost three weeks was discovered by accident while running an unrelated query that listed 97 accumulated worktree branches.

The scraper, consisting of models, client, parser, and four test modules, was committed on July 29, 2026, and remained undiscovered on the branch. The original note about a DataDome infeasibility had never been tested against the live site, and the finished scraper was never probed on the actual target. The billing records confirmed that the run used the cheapest proxy tier, as no residential transfer was recorded, despite the scraper being designed to target the DataDome site.

This incident emphasizes the importance of verifying both the requested proxy tier and the actual usage through billing records, as relying solely on configuration may lead to false assumptions.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

Sustainability Reporter Slack Bot

This is a submission for Weekend Challenge: Generosity Edition What I Built I'm currently volunteering on the Communications team at a sustainability nonprofit, GreenHomeNYC .

  • Sustainability reporter Slack bot created by volunteer at GreenHomeNYC
  • Bot fetches news via free API, summarizes with Google Gemini AI
  • Project scheduled via GitHub Actions for daily Slack posting

New GitHub project

I Built an AI-Powered Daily Scanner for Malicious Packages I just made another thing. 💀 This time, it's Authtics Advisories — and no, this isn't the Authtics from authtics.com.

  • Authtics Advisories uses AI to scan malicious packages from PyPI and NPM registries.
  • System analyzes 100 packages daily from each registry using Gemini analysis pipeline.
  • Output presented as GitHub pull request for human review, not automated classification.

More from Monday 7 September →