Safegres is live — open-source verifier for Postgres grants + RLS.
Catch open tables before agents ship them. MIT. Runs in CI.
Catch open tables before agents ship them. MIT. Runs in CI.
1/6
Hacktober made it clear: security is impossible to ignore.
A wave of disclosures and hacks — not one incident, a pile of them. Agents can write schema all day; the hard part is still who can reach the data.
1
0
1
195
24,664 apps sending database rows to anyone who loads the page. Row-level security fixes this. A policy on every table decides which rows each user can see, and Postgres checks it on every query, from every client, including agents. Start from default-deny: a table with no policy returns nothing. Security should be the starting state, not a checklist item.
A security firm scanned 159,041 Lovable-built apps:
– 24,664 sent DB records on page load, no login
– 7,403 exposed tables with emails
– Worst: 1,000+ passport records, 200,000+ chats
AI ships the app in an hour. Row-level security still needs an owner. Who checks yours?
3
0
5
306
The best decision in Postgres history was designing it from day one to be extensible, and the second best was keeping it truly community-owned. Four decades later, almost every "Postgres killer" ended up becoming a Postgres extension 🐘
Postgres is a go-to choice for a lot of teams now, but it hasn't always been. For almost 40 years, it fought off competition and near-death.
What was its defining moment on the way to inevitability? Let's take a look.
planetscale.com/blog/what-was-…
0
1
3
358
Constructive retweeted
Really glad to see the industry converging on this.
Back in May, we wrote "From Vibe Coding to Agentic Engineering" and got on stage at SVB with engineers from Google DeepMind and Mastra to make this exact case:
"You're not just writing code — you're designing the environment that code lives in... letting agents operate within that environment, but always within constraints that make the outcome trustworthy."
Whether you call it an Agent Habitat or Agentic Engineering, the shift is the same: when code generation approaches zero cost, trust becomes the bottleneck.
One piece we'd add: the boundary can't just be a sandbox around the agent. Authorized agents still touch data—so permissions and Row-Level Security have to be compiled deterministically into the database core itself.
Vibe code the edges. Trust the core.
📝 Our essay: constructive.io/blog/from-vibe…
🎥 Full May 1 SVB panel (just dropped today): youtube.com/watch?v=YG_yZ_…
x.com/amasad/status/…
Back in May, we wrote "From Vibe Coding to Agentic Engineering" and got on stage at SVB with engineers from Google DeepMind and Mastra to make this exact case:
"You're not just writing code — you're designing the environment that code lives in... letting agents operate within that environment, but always within constraints that make the outcome trustworthy."
Whether you call it an Agent Habitat or Agentic Engineering, the shift is the same: when code generation approaches zero cost, trust becomes the bottleneck.
One piece we'd add: the boundary can't just be a sandbox around the agent. Authorized agents still touch data—so permissions and Row-Level Security have to be compiled deterministically into the database core itself.
Vibe code the edges. Trust the core.
📝 Our essay: constructive.io/blog/from-vibe…
🎥 Full May 1 SVB panel (just dropped today): youtube.com/watch?v=YG_yZ_…
x.com/amasad/status/…
Software ate the world, now it's learning to run it. x.com/i/article/2114…
1
2
8
453
Constructive retweeted
As AI drives the cost of writing code toward zero, the bottleneck doesn't disappear. It moves to trust.
You could vibe code the layout of the front of a bank, but you probably wouldn't want the vault downstairs to be vibe coded.
Full recording is now up from our panel at njeev Dhanda (@GoogleDeepMind), @abhiaiyer (@mastra), and @Kristopherfloyd (@frontiersynd) on the shift from vibe coding to agentic engineering.
You could vibe code the layout of the front of a bank, but you probably wouldn't want the vault downstairs to be vibe coded.
Full recording is now up from our panel at njeev Dhanda (@GoogleDeepMind), @abhiaiyer (@mastra), and @Kristopherfloyd (@frontiersynd) on the shift from vibe coding to agentic engineering.
7
2
10
533
Full recording is live: Is Software Dead? From Vibe Coding to Agentic Engineering
Sanjeev Dhanda (@GoogleDeepMind), @abhiaiyer (@mastra), and @danlynch (@constructive_io) join @Kristopherfloyd (@frontiersynd) at @SiliconVlyBank to break down what happens when writing code is the scarce resource.
Highlights inside:
- 04:52 — The microwave metaphor & frontend velocity
- 09:20 — The bank lobby vs. the bank vault
- 20:03 — Tests as a guidance system for agents
- 26:53 — Compiling Row-Level Security into Postgres by default
Watch the full session: youtube.com/watch?v=YG_yZ_…
Sanjeev Dhanda (@GoogleDeepMind), @abhiaiyer (@mastra), and @danlynch (@constructive_io) join @Kristopherfloyd (@frontiersynd) at @SiliconVlyBank to break down what happens when writing code is the scarce resource.
Highlights inside:
- 04:52 — The microwave metaphor & frontend velocity
- 09:20 — The bank lobby vs. the bank vault
- 20:03 — Tests as a guidance system for agents
- 26:53 — Compiling Row-Level Security into Postgres by default
Watch the full session: youtube.com/watch?v=YG_yZ_…
0
1
4
211
Our CEO @danlynch opened FRC #26 with Secure-by-Default Postgres for Agents.
Agents are database users now. Authorization has to live in the database, not the app.
Thanks @frontiersynd @Kristopherfloyd @pebble_bed @danielchalef @zep_ai @shulynnliu @shagarw21
Agents are database users now. Authorization has to live in the database, not the app.
Thanks @frontiersynd @Kristopherfloyd @pebble_bed @danielchalef @zep_ai @shulynnliu @shagarw21
1
2
7
397
Hundreds of speculative queries a second, from a user that isn't human. That's the workload. Authorization has to live in the database, not the app. Proud to sponsor FRC #26 with @frontiersynd @pebble_bed x.com/frontiersynd/s…
Your next database user won't be a human. It'll be an agent firing off hundreds of queries a second.
@shulynnliu and @shagarw21 of @BerkeleySky made the case at FRC #26 at @pebble_bed: agents don't query, they speculate. Schemas, samples, partial plans, retries, all in parallel.
meant better answers. Across 50 parallel attempts, most of the work was redundant. Agents already create ~20x more branches and ~50x more rollbacks than humans.
So the database has to change. Probes instead of queries. Satisficers instead of optimizers. Branching storage built for agents.
Thanks to @constructive_io for sponsoring.
0
0
3
165
Tech Week in SF was a blast! Happy to co-host the event with an incredible group of researchers
Memory layer or a whole new database? We spent FRC #26 arguing about it 🧠🗄️
@danielchalef (@zep_ai) made the case that context is production infrastructure: if your agent can't trust what it remembers, nothing else matters.
@shulynnliu and @shagarw21 brought their CIDR '26 . Agents don't really query, they speculate: tons of redundant, exploratory probes. So build the database for the agent first.
Then the room fought over whether those are the same problem. No consensus. Exactly how we like it.
Huge thanks to @constructive_io and @danlynch for sponsoring and @pebble_bed + @nicilevv for hosting 🙏
Great to have @tjskhot @yumi_aw @ryanorban @ezrwolf @damnventures and many other regulars in the room!
0
1
5
247
Constructive retweeted
Your agent's memory is rotting and it doesn't know it.
@danielchalef of @zep_ai walked through this at FRC #26 at @pebble_bed: enterprises now hold agent context to the same bar as every other database. Provenance. Access control. Invalidation when facts go stale.
Commercial for millions of mostly idle small graphs. So Zep built Konig. 20M+ graphs in production, sub-100ms retrieval.
Context isn't a prompt trick. It's production infrastructure.
Thanks @constructive_io for sponsoring and @Techweek_ / @a16z for the SF Tech Week slot.
@danielchalef of @zep_ai walked through this at FRC #26 at @pebble_bed: enterprises now hold agent context to the same bar as every other database. Provenance. Access control. Invalidation when facts go stale.
Commercial for millions of mostly idle small graphs. So Zep built Konig. 20M+ graphs in production, sub-100ms retrieval.
Context isn't a prompt trick. It's production infrastructure.
Thanks @constructive_io for sponsoring and @Techweek_ / @a16z for the SF Tech Week slot.
2
4
7
345
Tonight for SF Tech Week, Constructive is co-hosting with @frontiersynd + @pebble_bed. Come meet our founder @danlynch ⚡️
Agents in Production: State, Security, and the Data Layer.
Zep/Graphiti + @UCBerkeley Sky Lab on memory, permissions, and agent-first data systems.
Agents in Production: State, Security, and the Data Layer.
Zep/Graphiti + @UCBerkeley Sky Lab on memory, permissions, and agent-first data systems.
1
0
1
244
Constructive retweeted
What happens when AI agents become database users?
I’m co-hosting a16z SF Tech Week dinner + research discussion with @pebble_bed, @constructive_io & @frontiersynd
Join Zep’s CEO + UC Berkeley researchers to dig into agent memory, security & data systems.
luma.com/82gz0ggu
I’m co-hosting a16z SF Tech Week dinner + research discussion with @pebble_bed, @constructive_io & @frontiersynd
Join Zep’s CEO + UC Berkeley researchers to dig into agent memory, security & data systems.
luma.com/82gz0ggu
1
2
25
170,107
Software and culture in San Francisco ⚡️
Honored to contribute to Illuminate and the Grace Window project 🙏🏻
We <3 SF
Honored to contribute to Illuminate and the Grace Window project 🙏🏻
We <3 SF
0
1
3
205
better tests, better agentic loops for postgres development postgresql.org/about/news/pgs…
0
0
0
160
Constructive retweeted
hey SF! come to the Grace Cathedral 8pm Sept 21st when we open to shoot the lasers
pumped about the @constructive_io software collaboration with @nusalt and @IlluminatedArts 🫶
pumped about the @constructive_io software collaboration with @nusalt and @IlluminatedArts 🫶
2
3
19
644
Constructive retweeted
Today at 2:30pm ET, Dan Lynch joins the Postgres community to build a testable Postgres workflow for AI coding agents live.
Register: postgresconf.org/conferences/po…
Register: postgresconf.org/conferences/po…
0
3
2
152