Joescript

Full-stack MERN Developer | ML.
Building functional systems for real-world constraints. Focused on compounding effort, clean architecture, and engineering logi

[Joescript @joescript237]

@DiianaD_ is poverty a joke to you?

[Joescript @joescript237]

I identified a real problem affecting farmers in Cameroon: No timely access to crop disease alerts or market prices.
My solution: FarmAlert, a full-stack app that pushes SMS alerts to smallholder farmers before it's too late.
Proud to be on the Intermediate React track @KodeCamp

[Joescript @joescript237]

After fixing my laptop, I caught up on the AI for Africa DataCamp assignment analyzing Los Angeles crime data. I learned how to clean, group, and subset data to extract key insights.

[AlgoMaster.io @algomaster_io]

15 Must-Know Software Design Patterns:

1. Singleton
2. Factory Method
3. Builder
4. Adapter
5. Decorator
6. Facade
7. Proxy
8. Composite
9. Observer
10. Strategy
11. Command
12. Iterator
13. State
14. Template Method
15. Chain of Responsibility

♻️ Repost to help others in your network

[Joescript @joescript237]

@sandyXBT Hello

[Joescript @joescript237]

@DINESHVERM578 Thanks for this.

[Dinesh Verma @DINESHVERM578]

https://t.co/Txcjqa1Wyp

[Joescript @joescript237]

@ChainChaserVN Hello

[FaVy_design @ajuzie_favour]

Tech bro/sis
with small account or just joined X , let’s connect

UIUX Designer
Graphics designer
Frontend Dev
Backend Dev
Full stack Developers
Wordpress Developers
Ai Engineers
Web3
Data Analysis
and other tech industries.👋

[Harshil Tomar @Hartdrawss]

15 auth mistakes every VIBE CODER ships to production :

Here's the FULL BREAKDOWN

1/ storing JWTs in localStorage
> XSS attack = every token on the page stolen
> localStorage is readable by any script on your site
> use httpOnly cookies instead

2/ JWT signed with a weak or default secret
> "secret" and "your_jwt_secret_here" are tested first by attackers
> if its from a tutorial, assume its already compromised
> generate a proper 256-bit random secret

3/ no refresh token rotation
> stolen refresh token works forever without rotation
> rotate on every use, invalidate the old one immediately
> one-line config in most auth libraries

4/ no account lockout after failed logins
> brute force has zero friction without it
> 10 failed attempts should lock the account
> add lockout + exponential backoff

5/ auth middleware applied inconsistently
> AI generates middleware for some routes and skips others
> the skipped ones are completley open
> audit every endpoint manually, assume nothing is protected

6/ different error messages for wrong email vs wrong password
> "user not found" vs "wrong password" tells attackers which emails exist
> return the same generic message for both cases
> never confirm or deny account existence

7/ forgot-password tokens that never expire
> a reset link from 3 months ago should be invalid
> yours probably isnt
> set a short expiry, 15 to 60 minutes max

8/ OAuth redirect_uri not validated
> exploited to redirect auth codes to attacker-> controlled URLs
> whitelist every valid redirect URI explicitly
> never allow open redirects in your OAuth flow

9/ no email verification on signup
> fake accounts and spam at zero friction
> verify before granting full access
> a verification link, not just a welcome email

10/ sessions not invalidated server-side on logout
> cookie is cleared client-side but server-side session still works
> invalidate the session record in your DB on logout
> client-side clearing alone is not enough

11/ passwords stored without bcrypt or argon2
> MD5, SHA256 without salt, plain text
> all of these show up in breach headlines
> bcrypt or argon2 only, no exceptions

12/ auth endpoints not enforcing HTTPS
> credentials over HTTP are visible on any network
> enforce HTTPS at the infrastructure level
> no HTTP fallback for any auth route

13/ client-side role checks instead of server-side
> you can't trust what the frontend says about who the user is
> validate roles and permissions on every server request
> the frontend is UI, not security

14/ no 2FA on admin or sensitive routes
> one breached password = full access to everything
> add TOTP or magic link 2FA on admin routes minimum
> non-negotiable for anything handling user data

15/ test credentials left in production
> admin:admin or [email protected]:password123 are real entry points, not conveniences
> audit and remove every test account before you ship

paste it into cursor before your next auth build.

[Joescript @joescript237]

@QQ45k Hi

[Joescript @joescript237]

Do you remember when you joined X? I do! #MyXAnniversary

[Akintola Steve @Akintola_steve]

A Nigerian fintech startup lost ₦47 million in one night.
Not to hackers. Not to fraud.
To one missing line of code.
Every backend dev in Nigeria needs to see this

[Joescript @joescript237]

@Suryanshti777 COURSE

[Joescript @joescript237]

Excited to share that I’ve finally started a 6-month internship in machine learning at TogetTech! Looking forward to training real models that tackle problems around me, with excellent guidance from my supervisors on every task. Ready to learn and make an impact #MachineLearning

[Joescript @joescript237]

@Aditijain1100 @Eche_codes Just started. Maybe we can work on something.

[Joescript @joescript237]

@4llowtrain @X Let's connect devs

[Joescript @joescript237]

OMG! We did it! 🎉 Just hit 100 followers on X! Huge thanks to each & every you for joining this journey. Your support means he world! 🙏 Le'ts keeep growing & sharing! #100Followers #XCommunity #ThankYou

[Joescript @joescript237]

@CFC_Duma @CFC_Janty Cole Palmer on 🔥 🔥

[Joescript @joescript237]

@SheviaXO Hello