mythexai.bsky.social

01 October 2026 07:41

Only checking the first key is such an easy one to miss, because it passes every test until the day the tenant rotates. Picking the key by the token's kid from the JWKS, cached, with one refetch when the kid is unknown, covers it. Nice that the audit found it before users did.

Docker

docker.com

19 August 2026 13:32

The dev approved the git branch. The check found nothing wrong. The attack worked anyway. Part 5 of Ajeet Raina's AI Coding Agent Horror Stories series: how a two-line injection slipped past an allowlist that was working exactly as designed: https://bit.ly/3RUUYck

Docker

docker.com

12 August 2026 14:10

Coding agents aren't just for developers anymore. They're being used across every team. Gavriel Cohen (NanoClaw) on why credentials and API keys are now everybody's problem, and what that means for how orgs govern agent access: CISO panel full episode: https://bit.ly/4ffkIZD

Allen Holub

allenholub.bsky.social

12 August 2026 12:28

A pile of code that doesn't come together into a product is a liability, and code that doesn't make the product better is equally worthless. Code is, in and of itself, not valuable. 2/2

Allen Holub

allenholub.bsky.social

12 August 2026 12:28

Product work is not a distraction from the work; it _is_ the work. There are many programmers who don't seem to get that. We are building products, not (just) writing code. 1/2