{
  "id": 6209040,
  "title": "After the Sprint: A 72-Hour Build Retrospective - Spoiler: It Wasn't Secure",
  "url": "https://urgent.news/2026/09/08/after-the-sprint-a-72-hour-build-retrospective-spoiler-it-wasnt-secure",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-08T01:28:58.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/earlgreyhot1701d/after-the-sprint-a-72-hour-build-retrospective-surprise-it-wasnt-secure-4bd"
  },
  "original_language": "en",
  "account": "The 72-hour DEV Weekend Challenge resulted in a product called Charitas Clew, which successfully transformed bureaucratic notices into simpler language and provided next steps. The challenge version worked as intended, but the real test came after submission when the focus shifted to security hardening.\n\nTwo AI systems, Antigravity and Dr. Kahlo, were employed to assess and enhance the product. Antigravity made changes to the codebase, ran tests, inspected deployment behavior, and exercised the live application, while Dr. Kahlo provided adversarial reviews, challenged proposed fixes, and questioned the relevance of findings.\n\nThe first issue identified was the lack of an automated test suite in the sprint version. Antigravity addressed this by adding a minimal Node/Supertest regression harness, which uncovered an unrelated malformed-input hang. Despite adding 143 tests by the final audit, production still presented unexpected behavior.\n\nOne significant finding was that the prompt-injection defense implemented during the sprint was mostly ineffective. The filter only looked for specific phrases commonly associated with model manipulation, but this approach proved insufficient when dealing with legitimate notices containing similar keywords. The hardening process therefore moved away from relying on keyword blacklists and instead focused on creating a stronger structural boundary. Application-controlled instructions were separated from uploaded document content, and runtime validation was added to ensure the model output met the application's rules before reaching the browser.\n\nThe second major finding was that despite extensive testing, the production version still had vulnerabilities. During the audit, Antigravity discovered that the Express application's rate limiter was misconfigured, leading to incorrect identification of the client's IP address. This issue, while not directly related to security, could still have potential consequences in a production environment.",
  "summary": "I built Charitas Clew for a 72-hour DEV Weekend Challenge. It worked. I submitted it. And then I did something slightly inconvenient: I kept poking at it. Apparently one day is enough historical distance from an event to call what follows a \"retrospective,\" so here we are. lol Charitas Clew takes the sort of bureaucratic notice that can ruin an otherwise perfectly good afternoon---a benefits…",
  "key_points": [
    "Charitas Clew product transformed bureaucratic notices into simpler language",
    "Antigravity and Dr. Kahlo assessed and enhanced product security",
    "Lack of automated test suite and ineffective prompt-injection defense identified"
  ],
  "editors_take": "The post-sprint security audit reveals that rushing development can lead to shortcuts that compromise security, highlighting the need for rigorous testing and robust defenses against model manipulation.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}