Urgent.News

What's breaking now, across thousands of outlets.

Tuesday, 22 September 2026 Reading Room

Tech

OAuth scopes are not your app's authorization model

OAuth scopes answer: "what APIs may this token call?" They do not answer: "may this user read this document?" A token with documents:read can still be used against every document ID the holder can guess, unless your API binds subject + action + resource on every request. Treat scopes as a coarse gate on the credential. Keep resource-level authorization inside your app — RBAC/ReBAC/ABAC checks…

dev.to ·

We haven't written up this one. Dev.to has the full story — the link below goes straight to it.

Read the original at dev.to →

More in Tech

Before You Watch Traffic, Define the Events Behind User Behavior

After an AI-built website goes live, the analytics dashboard is often the first page the team opens. Visits, traffic sources, bounce rate, and time on page are useful—but they describe what happened…

  • Define key event categories for user behavior analysis
  • Limit event tracking to five core families for clarity
  • Use simple, descriptive naming conventions for events

·dev.to

Why your Docker images are too big (and how to fix it)

I've seen production Docker images over 2GB. For a Node.js app. That's 10x larger than it needs to be. Here's how to shrink them. The Usual Suspect FROM node:20 WORKDIR /app COPY . .

  • Docker images often exceed 2GB in size
  • Use lightweight base images like Alpine to reduce size
  • Multi-stage builds can shrink final image size by up to 50%

·dev.to

Stabilizing a Real Node.js Platform: Privacy Fixes, Contract Tests, and Removing False Failures

Stabilizing a Real Node.js Platform: Privacy Fixes, Contract Tests, and Removing False Failures When a project grows, test failures stop meaning just one thing. Some failures are real production bugs.

  • MyZubster platform undergoing stabilization to address test failures
  • Categorized failures into real production bugs, stale tests, and architectural mismatches
  • Privacy issue discovered by updating test to reflect actual privacy contract

·dev.to

More from Tuesday 22 September →