#Most developers already know this rule: > **Don't run code from a repository you don't trust.** But AI coding agents are creating a slightly different security problem. Sometimes, you don't need to manually run the malicious code. **Your coding agent may interact with the repository for you.** ...
Read articleyou probably didn't think about this when you signed up. you entered your card details, verified your phone number, maybe uploaded a government ID and took a selfie. friction. annoying. you moved on. somewhere in cambodia or kenya, someone did the same thing. except they weren't signing up for cla...
Read articleThe three-layer model works. Part 1 of this series is the invoice incident that proved it. Part 2 is the proxy.ts matcher gaps that fail silently. Part 3 is the mutation-layer auth check that gets skipped even when everything else looks solid. My kit implements this in Route Handlers rather than Ser...
Read articleI keep seeing it on code reviews. Proxy solid. Auth on every Server Component. Header direction correct. Then I look at the Server Actions. No auth check. Not one. The page that renders the button is protected. The action behind the button accepts whatever the caller sends -- any valid session, a...
Read articleHave you ever tried to build an automation that works so well it bypasses the very rules you set for it? Recently, I was working on a small repository designed to automate the painful process of updating my resume. The idea was simple: build a system that runs weekly, checks my social media activity...
Read article