The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Back to feedPost
Still trusting req.body in your API?
Most devs pass it straight to the database, so a client can slip in "role": "admin" or a $ operator.
Do this instead:
1. Validate every body with a schema (Zod)
2. Pick only the fields you allow
3. Reject keys that start with $
4. Rate-limit login and signup
Save this for your next API.
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Related posts
Delivered a web-based, AI-powered project management platform designed to simplify daily tasks, team collaboration, and project tracking.
The platform allows businesses to add team members, assign tasks, monitor progress through an intuitive dashboard, and gain valuable insights with clear analytics.
In today's fast-paced business environment, every organization needs an efficient project management solution to streamline workflows, manage tasks, and track overall performance.
What do you think of the design and user interface? I'd love to hear your feedback!
Where should an agent’s permission check live?
I built DeadBolt at NextEleven to put that check at the point where a tool action actually runs, outside the model’s instructions. Stable 2.0.0 is now available, free and open source under Apache-2.0.
For example: an agent requests a file write. Your executor asks DeadBolt first. A denial leaves the protected function uncalled. You can set tool policies, require one-use approvals, pause a run, or kill its future admissions. Store or transport failure denies protected dispatch.
You can embed it in Rust, use a local sidecar from Python or another language, or wrap a trusted stdio MCP server.
The boundary matters: DeadBolt protects routes you connect. It is not a sandbox for arbitrary code, and kill does not automatically cancel work already running.
Install, examples and captioned walkthroughs:
https://nexteleven.dev/deadbolt
If you’re building agents, what would make a permission gate easier to integrate into your stack? I’m happy to answer setup questions and consider useful feedback.
nexteleven.dev
DeadBolt — Give agents tools. Keep control.
A local execution gate for software agents, built by NextEleven.
For me, a small MCP example would help: approve a file write, then show what happens if the agent changes the path or content before execution. Is the one-use approval tied to those exact arguments?
SupportFlow AI is a customer support management system built with Python, PySide6, FastAPI and PostgreSQL.
It helps teams manage customer requests, assign priorities and responsibilities, track conversations, and generate AI-assisted response suggestions while keeping a human in control of the final reply.
I built the application structure, interface, backend integration, database workflows, API layer and automated testing.
The conversation-revision idea sounds useful. I would also check that revision on the server when accepting the send, so a message arriving between review and click cannot slip through. Mark the draft stale while keeping the human edits visible. Two useful regression cases: a...