标签：#EV

GitHub is not just a source code platform anymore. For most engineering organizations, GitHub is part identity system, part software supply chain, part CI/CD platform, part secret store, part deployment orchestrator, and part production change-control system. That means we should secure GitHub like a production control plane. This guide is written from the perspective of a CISO tightening GitHub across an organization. It is not a high-level best-practice list. It is a practical hardening baseline we can apply, audit, and improve over time. The goal is simple: Nobody should be able to compromise our source code, workflows, secrets, build systems, release process, or production environments because GitHub was loosely governed. How to Use This Guide Use it in three layers: Layer Audience Purpose Executive baseline CISO, Head of Engineering, Platform leadership Define why GitHub is a Tier-0 engineering control plane Security standard Security, Platform Engineering, AppSec, DevSecOps Define mandatory controls, evidence, exceptions, and ownership Operational runbook SOC, repository owners, release engineers Support onboarding, monitoring, detection, incident response, and quarterly review Control language in this guide should be interpreted as follows: Term Meaning Must / Required Mandatory baseline control unless a documented exception is approved Should / Recommended Strongly expected control; deviations require documented rationale May / Optional Context-dependent control based on repository classification and risk Exception Time-bound, risk-accepted deviation with owner, compensating controls, and review date Every mandatory control should eventually map to: Control ID → Requirement → Owner → Enforcement → Evidence → Monitoring → Exception path Section 29 provides the operational enforcement map that tells administrators where to find each GitHub setting, what to configure, and what evidence to retain. This prevents the standard from becoming a long checklist that no

Last week I shipped something that would have sounded reckless two years ago: an MCP server that lets an AI agent write to a merchant's live Shopify store. Create discount codes. Build customer segments. Draft WhatsApp campaigns against real order data. Read-only agent integrations are everywhere now, and they're fine — but a read-only agent is just a chatbot wearing a dashboard. The useful version is the one that does the thing . The dangerous version is also the one that does the thing. A hallucinated SELECT is a wrong answer; a hallucinated discount code is free product going out the door. So before turning writes on, I sat down and listed every way an agent could hurt a store. Then I built one guardrail per failure mode. Here's the list — it's short, and I think it generalizes to any agent surface that touches business data. 1. Read-only by default. Writes are a per-token opt-in. The lazy design is one API key that can do everything the app can do. Instead, every agent token starts read-only — list customers, inspect segments, read campaign stats. Write capability is a separate flag the merchant flips per token: { "token" : "fav_mcp_…" , "scopes" : [ "read" ], // default "writeEnabled" : false // explicit opt-in , per token } This sounds obvious. It is obvious. It's also the single most-skipped step I see in agent integrations, because it's friction during development. Build the friction in anyway — "the agent could read everything but couldn't have sent that" is a sentence you really want available to you later. 2. Caps live in the tool schema, not the prompt. Early on I had a system prompt that said something like "never create discounts above 30%." You can guess how durable that is. Prompts are suggestions; schemas are physics. So the caps moved into the tool's input validation itself — the shape of it: // create_discount — validated server-side, not prompt-side { percentage : z . number (). min ( 1 ). max ( 100 ), // hard ceiling, enforced in the service exp

Every low-code vendor says "we support customization." But supports is a weasel word — recoloring a button is customization, and rewriting a scheduling engine is also customization. What actually decides whether a platform locks you in is how far up its extensibility goes. Here's a ruler. The three levels of customization Level What you can do Most no-code A real dev framework L1 — Config Fields, forms, workflows, permissions, themes ✅ ✅ L2 — Extension Custom components, custom actions, external API calls, business rules ⚠️ limited ✅ L3 — Framework Modify/extend the core, custom engines, deep rewrites, source under control ❌ wall ✅ (when open/controllable) Where it stops is where your ceiling is. Plenty of no-code platforms are delightful at L1, then hit "can't do that" at L2/L3 — and you retreat to writing your own thing next to it. Now low-code is the burden. Why you get locked in Black-box SaaS — no source, so any extension point the vendor didn't expose is simply out of reach. Two sources of truth — your extension code and the platform's config live in different systems, so a platform upgrade breaks/voids your work. Crippled self-hosting — the on-prem edition quietly drops extension capabilities. Closed ecosystem — only their component marketplace; your stack can't get in. How model-driven + open source raises the ceiling One unified extension system — your extensions (custom fields/components/actions) and the platform itself are built on the same metadata. Extension isn't a bolt-on, it's a first-class citizen — upgrades don't wipe your customizations. Source under your control — open + self-hostable is what makes L3 framework-level extension actually possible: an extension point you can't reach, you can add. AI at the metadata layer — AI-generated extensions land in the same model, so they stay maintainable and evolvable. That's the road Oinone takes: 100% metadata-driven, front + back end open source, self-hostable — customization reaches L3. How to stress-tes

In times when people believe that "AI can code a website in 2 days" (see: how to leverage AI as a...

I got some time to kill and honestly I'm just itching to solve a problem nobody gives a shit about cause there is no real money in it. IE social impact rather than financial , maybe something that helps charity and non profits, or a hobby that wishes it had a tool to make life easier but wouldn't actually pay for, etc etc submitted by /u/AssistanceAshamed609 [link] [留言]

I’m building GoWDK , a Svelte-inspired web framework for Go. Honestly, I’m starting to wonder if I’m wasting my time. I like Go, but web development in Go still feels too verbose when you want modern component-based apps. Most options either feel too backend-only, too manual, or they push you back into JavaScript-heavy stacks. So I started building GoWDK to test a different path: Go components server-side rendering simple syntax minimal JS Go-native tooling compiler-driven DX The frustrating part is that building a framework is a lot of work, and I’m not sure if Go developers actually want this kind of thing So I’m asking honestly: Would a Svelte-like framework for Go be useful to you, or am I solving a problem most Go devs don’t care about? Repo: https://github.com/cssbruno/GoWDK submitted by /u/OkSeesaw7030 [link] [留言]

I am Brazilian and I have been working in tech for 12 years, but right now I feel like the dumbest person on earth. A guy named Damian Gutierrez from a company called Ritual ( https://www.linkedin.com/company/ritualnet/ ) reached out to me on LinkedIn about a Senior Backend Engineer position paying $180k USD. During the interview, I was so focused on performing well that I almost got scammed. They asked me to clone their repository onto my machine and run it with npm start . Yeah, I know. I already feel stupid enough, no need to remind me. At the time, something felt off, but the salary clouded my judgment. After I launched the application, they asked me to connect my crypto wallet (MetaMask) to it. That's when things started feeling really suspicious. Luckily, I didn't have MetaMask installed on the machine I was using for the interview. I worked with crypto back in 2022, and connecting a wallet is pretty common in DeFi applications, so I wasn't immediately alarmed. They told me, "No problem, let's continue on Monday when you're on a machine that has MetaMask installed." Afterward, I ran the repository through Claude, and it flagged the project as malware. Even after hunting through cron jobs, startup tasks, and everything else I could think of, I decided to wipe and reinstall my entire system. That thing was executing remote code on my machine. Honestly, I feel like an idiot. But more importantly, I want to warn others that this kind of scam exists in our industry. These people looked completely legitimate. Well-dressed Americans, interviewing from a fancy office, professional setup, polished communication. The whole thing looked real. It wasn't. I'll post in the comments what Claude found in the repository. The company is called Ritual, and as far as I can tell, all of their job openings are fake: https://docs.google.com/document/d/1Q3GyiZmgbBOQoGSP_N0SoDsl7e6fgFTdoxzxnreigvQ/edit?tab=t.0 The recruiter who contacted me: https://www.linkedin.com/in/damian-gutierre

This is a submission for the June Solstice Game Jam What I Built For this game jam, I...

Something changed in software engineering, and I do not think we have fully named it yet. For years, the job was mostly about writing code directly. Then autocomplete got better. Then chat-based coding assistants arrived. Now the workflow is shifting again: we describe goals, hand off chunks of work to agents, inspect their output, tighten the tests, and decide what gets merged. That is not the same job with a faster keyboard. It is a different shape of work. I would call it agentic engineering. The engineer is becoming a director Agentic engineering does not mean the engineer disappears. If anything, it makes the engineer's judgment more visible. A coding agent can read files, make changes, run commands, open pull requests, and iterate through errors. GitHub describes Copilot agent mode as a workflow where the agent can plan, edit, run terminal commands, and keep working until a task is complete. Google describes Jules as an asynchronous coding agent that can take a task, work in a virtual machine, and produce a pull request. Anthropic's Claude Code guidance talks openly about using multiple Claude sessions in parallel, giving agents clear context, and treating them like workers that need direction. That is the shift. The engineer is no longer only the person typing every line. The engineer is also the person deciding what should be built, what constraints matter, how to verify the result, and when the agent is wrong. Prompting is too small a word for this People often describe this work as prompting, but that undersells it. A prompt can be a single instruction. Agentic engineering is more like delegation. You define the task, provide the relevant context, set the boundaries, create checks, review the work, and decide the next move. If the agent goes in the wrong direction, the failure is not always the model's fault. Sometimes the task was too vague. Sometimes the repository had no tests. Sometimes the acceptance criteria lived only in someone's head. This is why

Would you treat a serious illness without seeing a doctor, relying only on whatever your favorite AI...

Target: pnpm/pnpm Issue: pnpm/pnpm#12240 PR: pnpm/pnpm#12301 Public branch: https://github.com/scarab-systems/pnpm/tree/fix/deps-status-no-manifest Latest pushed commit: cb68ac1af0dcffbe4fb607a10b0df2046d2490ba This field test targeted a pnpm command-routing failure where pnpm self-upgrade could fail outside a project directory with: ERR_PNPM_NO_PKG_MANIFEST The issue looked simple at the surface: a global/self command should not require a project manifest just because the current working directory is not inside a package. But the repair boundary was more specific than “ignore missing manifest.” The problem was in the dependency-status verification path. When dependency status was unavailable because there was no project manifest, the command could fall through into the auto-install path. That made a self-upgrade/global-style command behave as if it needed a local project manifest. Failure shape The failing behavior was: pnpm self-upgrade run outside a project directory dependency status cannot be established from a project manifest the command path falls into install/manifest expectations result: ERR_PNPM_NO_PKG_MANIFEST That is the wrong ownership boundary. A self-upgrade command should not inherit project-manifest preconditions when there is no local project context. Boundary The boundary here is: global/self command execution versus project dependency-status verification Dependency-status verification can be useful when a command is operating inside a project. But when there is no project manifest and the command is not recursive/all-projects, “dependency status unavailable” should not automatically mean “try to auto-install project dependencies.” There are two different cases: Dependency status is unavailable because there is no project manifest. Dependency status is unexpectedly unavailable even though a root project manifest exists. Those cases should not behave the same. The repair preserves that distinction. What changed The patch updates: exec/commands/src

Have you ever stared at two different medicine boxes, squinting at the tiny font of the active ingredients, wondering: "Can I actually take these together?" Modern healthcare is complex, and drug-drug interactions (DDI) are a leading cause of avoidable ER visits. In this tutorial, we’re going to leverage GPT-4o Vision , React Native , and the FDA OpenData API to build a "Drug Conflict Scanner." We will utilize multimodal AI to transform messy pill-box photos into structured data and cross-reference them against official medical databases for safety. By the end of this guide, you'll master GPT-4o OCR structuring and automated knowledge graph verification for real-world health tech applications. 🚀 The Architecture 🏗️ The logic flow involves capturing images of multiple medicine labels, using GPT-4o's multimodal capabilities to extract chemical compounds, and then querying the FDA's database for potential interactions. graph TD A[React Native App] -->|Capture Multi-Photo| B[Node.js Backend] B -->|Image Buffer| C[GPT-4o Vision API] C -->|Structured JSON: Ingredients| B B -->|Search Interactions| D[FDA OpenData API] D -->|Drug Labels & Warnings| B B -->|Safety Report| A A -->|UI Alert| E{Safe or Warning?} Prerequisites 🛠️ To follow along, you'll need: GPT-4o API Key (via OpenAI) Node.js (for our backend relay) React Native (Expo is recommended for camera access) An account at open.fda.gov (though the public API works for limited requests) Step 1: Extracting Ingredients with GPT-4o Vision Traditional OCR struggles with curved medicine bottles and shiny packaging. GPT-4o excels here because it understands context. We don't just want text; we want the Generic Name of the drug. The Backend Logic (Node.js) // backend/scanner.js import OpenAI from " openai " ; const openai = new OpenAI ({ apiKey : process . env . OPENAI_API_KEY }); async function analyzeMedicineLabels ( imageUrls ) { const response = await openai . chat . completions . create ({ model : " gpt-4o " , messages :

I think it's fair to say that someone who has never done non-AI web development will always be vibe-coding. For, say, an experienced (20+ years) developer, would it still be vibe coding if they craft technically sound prompts (i.e. explicitly mention things to avoid/include, and define methodologies and algorithms as well as goals), and fully test (and have AI fix) the output, but never review the actual code? What if the prompts are loose, but they are fastidious about reviewing all code generated? submitted by /u/lindymad [link] [留言]

I've been with Omnis for years (they were awesome) and they were bought out by JetHost. The transfer took down a bunch of clients. Now I'm arguing with them and they don't offer an online guarantee or a refund. I have to deal with clients whose websites were down. I'm really upset just because I have never had to worry about this. Anybody have cheap reliable registrars? My fave never showed in google, so I figured I'd axe the community if anyone has a good secret one in your pocket submitted by /u/dash-dash-hyphen [link] [留言]

Parents want one thing, and one thing only, out of AI: to add a list of soccer games or "spirit week" theme days from an email or a poorly formatted flyer onto their calendar in one shot. And I have good news for parents with iPhones - the new Siri can finally do this. After […]

Hi! I'm in the process of teaching myself HTML and CSS for the very first time. I have a general idea of what I want this website to be and how to structure it. For actual secure access, I am making it on Neocities. For general browsing on the other hand, I want to essentially make a snapshot of whatever the current build of it is and put it on an http as well with the intent of being able to see and browse said website on old hardware like a Dreamcast or Win98 machine. Any help is appreciated! submitted by /u/souls_wandering [link] [留言]

A few months ago I was doing a final pre-release review on a client project before handing it...

I built a portfolio site that ended up turning into a collection of interactive experiments rather than a traditional resume. > Main Page > Drawing > Text based game > Capture the flag (CTF) It includes: - a live collaborative pixel canvas where visitors draw together - a hidden terminal with a virtual filesystem - small hidden challenges scattered throughout the site - an AI assistant you can talk to It started as a portfolio, but became more of an interactive playground. submitted by /u/Another_bot_beepboop [link] [留言]

This is a submission for the June Solstice Game Jam When you have a hammer- everything is a nail! This installment brings a Flutter build to Midsommer Madness via Antigravity. A complete Android APK is built with Flutter and some Joystick bugs are fixed! What I Built When it comes to Summar Solstace - the place to be is Sweden. It is one of the highlights of the calendar. This project aimed to recreate some of the mystique around the event- just in time for some fresh surestromming! Now you can get it on the GO! Midsommer Madness now in as an Android APK! Code GitHub repo is here: https://github.com/xbill9/midsommer-flutter xbill9 / midsommer-flutter Midsommer Madness game in Flutter / Web view Midsommer Madness 🇸🇪 Midsommer Madness is a Swedish-themed action retro arcade game inspired by Redneck Rampage and the Swedish Midsummer holiday. Help Sven race against the solar timer to reach the Maypole ( midsommarstång ) before sundown! If you fail, the solstice is lost, you trigger a meltdown, and you are sacrificed to the Wicker Man. 📸 Screen Gallery Title Screen Game Over Screen Victory Screen 🎮 Level Sequence The game features ten distinct thematic levels: IKEA Warehouse: Battle crowded, flatpack-carrying shoppers who throw box projectiles at you. Systembolaget: The state-owned liquor shop crowded with drunk Swedes stumbling and lobbing green beer bottles. Lördagsgodis: Sugar rush Saturday! Dodge hyperactive, strung-out Swedish kids throwing sweet candy projectiles. The Swedish Pub: Sing along with Frank Zappa fans singing "Bobby Brown" (shouting and firing glowing letters B , O , B , B , Y ). Volvo Highway: A survival lane-crossing level where… View on GitHub My Lingonberries are ripening- get to work! Appreciating Procedural Creation Midsommer Madness is a Swedish-themed retro action-arcade game built as a hybrid mobile/web application. The codebase combines a Flutter wrapper (serving as the native shell) with a Vanilla Web App (implementing the core game loop, vis

TL;DR — AI assistants are producing C# that looks correct and passes review, but reintroduces production regressions we spent years training out of teams. I'm trying to find out whether other .NET teams see the same patterns — and what's actually catching them before merge. More AI-generated C# is landing in pull requests. Most of it is fine. But a specific category keeps slipping through — and it's the dangerous one, because it compiles, tests pass, and a human skim says "looks good." The pattern The code compiles. Tests pass. Review approves. Production finds out. These aren't syntax errors. They're architectural intent violations — the kind of thing a senior dev would have caught in review before PR volume tripled. Five regressions I keep seeing 1. EF Core read paths without AsNoTracking() Fine in dev. Expensive on a hot read path in prod. // ❌ Looks reasonable. Tracks entities you never mutate. var orders = await _db . Orders . Where ( o => o . CustomerId == id ) . ToListAsync ( cancellationToken ); Fix direction: AsNoTracking() on read-only queries, or a team convention documented in CLAUDE.md / Copilot instructions. 2. Captive dependency (scoped service in a singleton) Compiles. Runs. Wrong state across requests. // ❌ Singleton lives forever; scoped dependency does not. services . AddScoped < IOrderRepository , OrderRepository >(); services . AddSingleton < ReportCache >(); // ctor takes IOrderRepository Fix direction: align lifetimes, or inject IServiceScopeFactory instead of capturing scoped services. 3. Dropped CancellationToken The method accepts cancellation. The downstream call ignores it. // ❌ Signature honours cancellation; body doesn't. public async Task RunAsync ( CancellationToken cancellationToken ) { await Task . Delay ( 500 ); // overload with token exists } Fix direction: forward cancellationToken to every downstream async call that accepts one. 4. Swallowed exception Failure disappears. Monitoring stays green. // ❌ "Handle errors gracefully" —