Keyword MERGEGATE
Run five checks before merging AI-written code
Check secrets, unused code, duplication and dependencies, then put repeatable checks in hooks.
43 resources
Security
Advisories, leaked secrets, risky permissions and supply chain incidents in AI coding tools, with the steps to check and fix your setup.
/
Keyword DEPGATE
Check packages before trusting an AI suggestion
Inspect package provenance, lockfile hosts and known vulnerabilities before accepting new dependencies.
Review claude-mem prompt upload consent before setup
Compare the reported historical upload behavior with the consent flow in the version you install.
Keyword ACTIONGATE
Check GitHub Actions before merging workflows
Check syntax, security and action pins before running a workflow with access to your repository.
Keyword HERMESMOVE
Import Claude Code settings into Hermes
Preview imported instructions and tools, then review permission rules and credentials that do not transfer.
Keyword BINLOOK
Inspect a binary with capa, Ghidra, YARA-X and ILSpy
Choose an inspection tool for the file type and keep unknown binaries away from your working machine.
Keyword TVCLEAN
Check your TV before running a cleanup agent
Identify the operating system and preserve a restore path before disabling TV packages.
Keyword KEYS
Scan for secrets and restrict agent access before pushing
Scan Git history and staged files, check agent skills, and restrict access to secret files before pushing.
Review what your AI assistant's browser can access
Review embedded-browser risks from the EMBRACE report without treating its publication-day patch status as current.
Keyword ENVLOCK
Lock Claude Code out of your .env
Four steps that stop Claude Code reading your secrets, and the check that proves it worked.
Keyword EXTENSION
Check the affected Claude Code extension in Cursor
Use Cursor's incident checks and remediation guidance; removing the extension alone may leave persistence.
Keyword WABOT
Set up a private Hermes WhatsApp bot
Choose the official integration or configure the unofficial bridge with explicit access controls.
Keyword INSPECT
Check MCP Inspector security fixes before connecting
Match your Inspector version to the published fixes before trusting a remote server.
Keyword AUTHFIX
Check Better Auth Magic Link and OAuth Proxy fixes
Check the affected login configurations and coordinate the upgrade across participating servers.
Keyword WEEKLY
Check five Claude Code compaction and sandbox fixes
Review the 2.1.309 and 2.1.311 fixes for long sessions, stale instructions, MCP tools and sandbox behavior.
Keyword OPENSAFE
Read startup files before opening an unfamiliar repository
Inspect hooks and editor startup configuration before a cloned repository can execute commands.
Keyword MCPFIX
Check the MCP reference server security release
Check package versions explicitly after the versioning change, and read the remaining Windows filesystem limitation.
Keyword FOLDER
Check instruction files before starting a coding agent
Review downloaded instructions and agent endpoints before they can steer a coding session.
Check Node.js and Ruby security updates
Compare the runtime serving your application with the Node.js and Ruby October security advisories.
Keyword RECAP
Follow the October security recap with vendor checks
Separate software patches, compromised packages and exposed credentials before choosing a response.
Keyword PIP
Update Python tooling after the eMudhra certificate incident
Update pip and certificate bundles in each environment; an operating-system update alone is insufficient.
Keyword CHECK
Check exposure to the compromised LiteLLM release
Use the maintainer incident records to identify affected artifacts and plan credential rotation.
Keyword PATCH
Check PHP deployments for the October security fixes
Check the web runtime and vendor patches; the command-line PHP version may belong to another installation.
Check where an agent skill gets installed
Keep project instructions local unless you deliberately want them in every repository.
Keep purchasing authority outside an agent prompt
Use account permissions and explicit approvals for actions that can spend money.
What Moltbook actually demonstrated
An exposed database and weak identity checks limit what viral agent posts can prove.
Check approval before uploading work documents
The CISA reporting shows why permission to use an AI tool and permission to upload a file differ.
Check the source behind a convincing image
AI labels and account context help, but neither makes an image automatically true.
What the Adams estate alleged about ChatGPT
The December 2025 complaint names OpenAI and Microsoft; its allegations must be distinguished from court findings.
What the Meta scam-ad investigation reported
Reuters reported internal estimates and Meta disputed their interpretation; senators subsequently called for a probe.
What Anthropic reported about AI-assisted espionage
Anthropic's November 2025 report describes a campaign using Claude Code and explains the limits of its findings.
Read the evidence about DeepSeek and military research
Reuters found procurement and research evidence while noting that deployment and performance were not fully verified.
Check how Teams shares your work location
Microsoft documents workplace check-in controls and says the feature provides no attendance reporting view.
How the September 2025 npm worm spread
CISA described stolen credentials, malicious package releases and checks for affected dependency trees.
Read the September 2025 TikTok deal framework carefully
The order described a proposed US joint venture; it did not transfer ownership of TikTok worldwide.
Understand the September 2025 debug package compromise
Check the affected debug version and why browser bundles needed rebuilding after the npm account takeover.
Separate the allegations in xAI's 2025 employee lawsuit
Read the August 2025 complaint as a party's allegations, rather than a finding that OpenAI used stolen material.
Keyword BACKUP
Keep coding agents away from production data
A database deletion at Replit shows why recovery and production access need separate checks.
What the UK's July 2025 online age checks required
Ofcom explains the affected content, acceptable approaches and consequences for non-compliance.
What the second Tea breach revealed about private messages
Firsthand reporting found that anonymous usernames did not prevent identification through exposed conversations.
What Grok’s July 2025 incident statement said
The official account attributed the X bot’s behavior to an upstream code change.
What SnitchBench measured about Grok 4
The repository records responses to constructed scenarios, not a policy that every conversation is reported.
Why stolen password hashes still matter
Slow password hashing and unique salts reduce guessing risk, but they do not make a stolen database harmless.