From 8-step deployment to zero-config: A student dev's security awakening
Trout_dev · reddit · 2026-08-28
A CS sophomore student reflected on the complex 8-step deployment process of their Telegram finance bot, Finley, and conducted a comprehensive security audit and refactoring.
Initial Issues: Users had to fork code, obtain multiple API keys, and manually configure Docker, MongoDB, Qdrant, and GCP OAuth, creating a massive barrier to entry.
Security Flaws Found:
- OAuth state used raw userid in URL, vulnerable to replay attacks.
- User tokens stored unencrypted in MongoDB.
- /docs endpoint exposed in production.
- Disconnect handler failed to revoke Google tokens.
Improvements:
- Fixed 21 issues and added 130 tests.
- Implemented Fernet encryption, HMAC-signed OAuth (10-min expiry), and sliding window rate limiting.
- Added GDPR-compliant hard deletion and prompt injection detection.
- Architecture Shift: Removed the need for users to supply API keys, moving to a server-side pool for a true zero-config experience.
More from coding & agent
- User Drops Spark Desktop CLI for Grok Bot Plugins Amid Convenience vs. Local-First Debate — bfrench · 2026-08-28
- Full Guide: Using Claude Design inside Claude Code — EXM7777 · 2026-08-28
- Daughter Directs, Dad Codes: Multi-Agent Workflow for Short Film — azed_ai · 2026-08-28
- AI Employee Generates Headlines, Structure, and Drafts in One Task — eyishazyer · 2026-08-28
- Tencent Hunyuan Hy4 Preview Shows Strong End-to-End Agent Performance — TencentHunyuan · 2026-08-28
- Developer automates GitHub issue triage and bug fixes with AI agent — nicolascraske · 2026-08-28