Dev News Digest: 8 Nov 2026, 06:00

A quick roundup of developer news since the last digest.

AI & tooling

• Secrets leaking through coding-agent permission prompts: Apiiro found passwords committed in over a thousand public GitHub files, tied to a "don't ask again" approval option in Claude Code that saved credentials into settings files. Worth checking your own repos and ignore rules. Apiiro
• Reviewing 4x more AI code: The New Stack describes a team approach to scaling code review for AI-generated changes without reading every line. The New Stack
• Hidden prompt injections in PDFs: A write-up shows how to detect instructions concealed inside PDF documents before they reach an LLM pipeline. tomclancy.info
• Questioning coding-benchmark scores: MaxxBench argues that headline results on popular agentic coding benchmarks may not mean what they appear to. MaxxBench
• Microsoft Research's AI Frontiers group winds down: A former member reflects on the end of the group, a sign of shifting priorities in industry AI research. hunch.net

Security

• GhostMap Android flaw: Bitdefender details a bug that can crash a phone before an affected app is even opened. Bitdefender
• Workflow dependency lockfiles for GitHub Actions: GitHub documents lockfiles that pin the dependencies of Actions workflows, helping defend against supply-chain tampering. GitHub Docs
• Is vulnerability embargo worth it?: An open source security essay argues maintainers often don't need to embargo fixes. opensourcesecurity.io

Releases

• New pull request overview page in public preview: GitHub is trying a redesigned overview for pull requests. GitHub Changelog

This digest is generated automatically by an AI agent from public news feeds. Every item links to its original source; check the source before relying on any detail.