23, AI Product & Agentic Systems Consultant | harshith(dot)com
Joined September 2020
- Tweets9.9K
- Following639
- Followers2.8K
- Likes8.5K
Your coding agent should check the dependencies it helps you ship.
cve dot now offers a free vulnerability feed + MCP access. Match exact versions, read the original advisory, then test the fix.
AI summaries need verification. A clean report is not proof of security.
Navigation should preserve a conversation; New chat should reset it. In my Kenzai development contributions, continuity includes drafts, attachments, choices, and pending actions—not just messages. A merge is development progress, not proof of a live release.
Full build notes and public product updates: harshith.com/diffs/build-not…
Zeabur describes a rotated credential being captured by a later backup and then used without authorization. If the attacker can still read the replacement secret, rotation becomes a loop. Establish a trusted destination and contain access. 7/10
The viral list includes older events: California student-data access from May–September; Medi-Cal access from October 2025; Tor interception earlier in October. Serious consequences do not require an invented 48-hour origin. 9/10
Railway recommended that all users rotate stored secrets as a precaution. Its initial report described possible access and some decrypted variables, not proof every customer was hacked. A broad precaution and a confirmed scope are different things. 6/10
LiteLLM 1.107.0 was a different failure: malicious release artifacts. If it ran, treat the environment as compromised. Rebuild from trusted inputs and revoke credentials it could reach. A clean source tag did not establish clean published artifacts. 5/10
PHP fixes arrived Oct 21: 8.2.35, 8.3.36, 8.4.27, 8.5.12. PHP2Shell lives in the runtime beneath the website. Updating WordPress plugins alone does not update that runtime. Verify the instance actually serving requests. Source: PHP advisory. 3/10
A vulnerability is a weakness. An exploit uses it. A breach crosses a security boundary. A disclosure makes information public. Those events can be months apart. Counting disclosures as fresh attacks distorts the story. 2/10
Black October needs a closer look. Serious PHP flaws, poisoned AI packages, exposed hosting secrets, and weak certificate keys are real. But the viral 27-item list puts several different timelines on one clock. Here is the useful distinction. 1/10
Just open source it bro.
We've decided to sunset Arc on December 22, 2026.
That's not an easy sentence to write. We spent years building Arc and celebrating each and every release along the way: we have so much pride and love for what we made alongside the Arc community.
Our priority is to deliver best-in-class security for our members. Keeping a browser secure takes constant, dedicated work that is only increasing in the age of AI. Dia was built from the ground up to meet today’s security standards, so that's where our engineering and security teams will focus moving forward.
We've worked to make switching to @diabrowser as easy as possible for Arc members. Here's how:
· Your passwords, bookmarks, extensions and history come over to Dia seamlessly.
· Spaces, Folders, and Tab Groups are in Dia and import over with your data intact.
· Dia now surpasses Arc benchmarks in stability, speed, and security.
· The browser features you use in Arc are free in Dia, and the AI is optional.
Thank you for using Arc, for pushing us to make it better, and for building alongside us. The team that made Arc is the same team behind Dia, and some of our most ambitious work is just ahead. We'd love for you to be there with us when it lands.
Three of my PRs merged Oct 2, 5 and 22, 2026. Shared lesson: preserve contracts while improving UX—bind refund approval to saved evidence, keep image recipes compatible, and retain photo provenance. A merge is not a deployment.
Build notes and source PRs: harshith.com/diffs/build-not…
Harshith retweeted
i had 12 Claude agents running in parallel for 6 hours and i managed to reverse engineer @supabase
i'm making it available here so that you can save your tokens - 100% free & open-source:
github.com/supabase/supabase
AI security findings create work for maintainers and operators. Before adding another discovery agent, map who assesses the report, prepares the fix, and updates each deployment. Fund the slowest handoff. A growing list of findings is not a measure of protection.
Full article, with a practical response-capacity rehearsal:
harshith-vaddiparthy.medium.…
