AI tools, cybersecurity and development news aggregated from top sources — saved permanently with unique URLs.
Keep Local Git Transports Out of Recursive Submodule Fetches
Keep Local Git Transports Out of Recursive Submodule Fetches A repository's .gitmodules file can p…
How to Protect a Service Like Qonto from LLM System-Prompt Leakage and Sensitive Data Exposure
How to Protect a Service Like Qonto from LLM System-Prompt Leakage and Sensitive Data Exposure TL;…
The Sandbox Held. The Mail Slot Didn't: One ChatGPT Share Link to Account Takeover
On October 28, the security firm Parameter published a writeup with a title that does not undersell …
npm minimum release age: a cooldown for dependencies
Setting an npm minimum release age is, for me, the cheapest security measure you can add to a JavaSc…
The Claude Code VS Code Extension Backdoor: What Happened, Why It Matters, and How to Protect Your Stack
1. What was released / announced Earlier this week the open‑source community learned that the Clau…
pnpm 11 holds a new release for 24 hours, and the nine waivers in our workspace file were written by pnpm, not by me
Munchable is a gut-health app: you scan a packaged food and it tells you whether that product fits t…
Firefly III Remote Authentication Starts at the Proxy
Firefly III Remote Authentication Starts at the Proxy Self-hosted Firefly III can rely on database…
CVE-2026-116672: CVE-2026-116672: Authorization Bypass in Authlib RFC 7592 Client Configuration Endpoint
CVE-2026-116672: Authorization Bypass in Authlib RFC 7592 Client Configuration Endpoint Vulnerabi…
What a DocuSeal Count Says About the Signing Boundary
What a DocuSeal Count Says About the Signing Boundary Document-signing services mix several kinds …
Locking Down Kubernetes RBAC in a Multi-Tenant Cluster
A new product team is onboarding onto your shared cluster. Their developers need to deploy to their …
Soft delete adds a trash page and a restore button. Do they get the same permission checks as the rest of your API?
Most apps I've worked on move to soft delete at some point. A deleted_at column goes on the table, t…
APP 1.7 starts on 10 December 2026. Here is the engineering evidence an automated-decision disclosure needs
I work at Permit, and this is based on a post our CEO wrote for our blog, so read it with that in mi…