It feels like there are actually three distinct levels of "run AI 24/7 to look for security issues"
1. Loop to check for published security patches in languages, libraries, platforms you need to upgrade
2. Loop to check your source code for app-specific security issues (pen-test, OWASP type stuff)
3. Loop to red-team your running app (combines 1 and 2) to cover chained issues or production config
1. Loop to check for published security patches in languages, libraries, platforms you need to upgrade
2. Loop to check your source code for app-specific security issues (pen-test, OWASP type stuff)
3. Loop to red-team your running app (combines 1 and 2) to cover chained issues or production config
2
0
9
1,396
We recently rewrote all the READMEs for our repos to:
- remove stuff about setting up environments (moved to .agent/setup and targeting a machine reader not human)
-add info about production: where it runs, what MCPs can do, project ids in external system, Slack channels to use
- remove stuff about setting up environments (moved to .agent/setup and targeting a machine reader not human)
-add info about production: where it runs, what MCPs can do, project ids in external system, Slack channels to use
6
0
56
5,003
This week I added a little feature to delete old export files that we never cleaned up (as they had reached 100GB total)
Built the feature then told Amp to report in on the backlog progress in Slack: "post to #talk-code with a summary of what was purged in a table"
Built the feature then told Amp to report in on the backlog progress in Slack: "post to #talk-code with a summary of what was purged in a table"
0
0
3
892
"just have an LLM scan your logs constantly to look for security issues" -- how exactly are you doing this? Every 5 minutes check the past 6 minutes of logs? If you have 10k logs in that window, you are sending that raw to LLM? Are you having LLM manage platform alerts?
39
2
97
22,369
So far my approach is:
- have an LLM sample a few windows of time and help me write anomaly/threshold/SLO alerts in Cloudflare
- ideally in the future, agent can tune/modify those directly
- make sure devs have MCP access to logs to help debug/investigate ad-hoc
- have an LLM sample a few windows of time and help me write anomaly/threshold/SLO alerts in Cloudflare
- ideally in the future, agent can tune/modify those directly
- make sure devs have MCP access to logs to help debug/investigate ad-hoc
3
0
10
2,732
If you've used Heroku CLI in the past, you might have credentials just sitting in your ~/.netrc for any agent to read and you should upgrade the CLI and wipe those
heroku.com/blog/securing-…
heroku.com/blog/securing-…
0
1
7
1,234
Prompt: "we keep getting an email from postmark that our webhook is disabled, check?"
5 minutes later
5 minutes later
0
0
2
832
Yes but...I just say "post lgtm or needs attention" on dependabot PRs
Agents know to look at changelogs and check how it's used and run tests etc
Agents know to look at changelogs and check how it's used and run tests etc
Pretty much any dependency upgrade at this point is a single agentic AI prompt.
But it’s not just “upgrade from vX to vY. Make no mistakes.”
Anecdatally, best results for me have come from something like “Upgrade this codebase carefully from vX to vY, one major version at a time, using upgrade documentation and blog posts about migrations like this one. Ensure all other dependencies keep working with the new versions, and make sure that all tests run green. Do a visual inspection on each upgrade round to ensure functional equivalence. Ask me for clarification if you encounter incompatibility issues.”
A bit more wordy, but works. And in the end, still a one-shot event.
1
0
2
818
tbh I still like PRs as a self-imposed speed bump
I can tell agentsto just merge their own for small stuff
I can tell agentsto just merge their own for small stuff
1
0
3
929
I get the sense that most harnesses don't really use the "Resources" part of MCP servers and only "Tools"...is that true? any reading material?
Just wondering if there is any reason to put more static stuff in Resources (better aligned to spec)
Just wondering if there is any reason to put more static stuff in Resources (better aligned to spec)
1
1
4
1,430
Back on the mic with @fractaledmind covering why code is cheap but still matters, why software foremans beat factories, and deep breathing exercises for your agents
yagni.fm/episodes/i-nee…
yagni.fm/episodes/i-nee…
1
2
19
1,217
Field report: switched to @useblacksmith for CI (still using GH actions just swapped runners). Cheaper, faster and took like 10 minutes to switch
4
0
15
1,672
Web dev Twitter is healing! We're all back to arguing about performance benchmarks for apps with zero users 🥹🥹
14
28
596
8,995
The content must flow! @thorstenball hates the term software factory and we give our pre-Rails World predictions
yagni.fm/episodes/irref…
yagni.fm/episodes/irref…
3
1
10
13,756
And in case you need EVEN MORE to listen to while your agents churn along, I got @searls to give hot takes on "pencils down" and retiring from programming (to play World of Warcraft)
yagni.fm/episodes/retir…
yagni.fm/episodes/retir…
0
0
2
813
I just tried out a trick from @thorstenball - if agents are doing something you dont want, you can simply ask them to fix their instructions and then spawn subagents to verify
The root problem was some copy-pasted Inertia skills that conflicted with other instructions (use Then spawned subagents that used Composer, Sonnet, and Sol for a sample run to make sure they followed the new instructions
The root problem was some copy-pasted Inertia skills that conflicted with other instructions (use Then spawned subagents that used Composer, Sonnet, and Sol for a sample run to make sure they followed the new instructions
4
0
21
1,892