Liam 🔺

Dev and crypto degen | Met Carlito in ASDA

[Liam 🔺 @LiamRumpyPumpy]

Put it in the Louvre

[Manny @SuppressedSikh]

Good to see this back on the TL. Hall of fame video

[Just a Dude Who Invests @DudeWhoInvests]

$200.

[lememe_james @LememeJames]

He just quit his job to flip cards full-time. Now have PSA pause all value subs

[Luke @LukeWhosTalking]

Him being arrested

[Korea Value Hunter @koreavaluehunt]

I went on a date in Seoul and I think I just got dumped over my asset allocation.

She asked what I invest in. I said index funds, some ETFs, nothing wild. She put her chopsticks down and said “so you have no convictions”.

then asked if I’ve ever held a position through a 60% drawdown. I said no. She said “then you’ve never loved anything”.

bro I came here for bibimbap not a TED talk

[David Sun @arcticinstincts]

Bryan Johnson rediscovered Asian Aunties from first principles

[iAm-paquetta @guesswhoiiamm]

“Until death, all defeat is psychological."

[y @ysuckme]

you’re only delusional until you win

[Tom @Justom29]

Thomas Tuchel after sabotaging that England squad

[The Drunk Republican @DrunkRepub]

“He’s about to fill up his tank. End the ceasefire.”

[wordgrammer @wordgrammer]

If Anthropic was a cult, and I’m not saying they are. They should declare all datacenters as sacred places. And then sue for religious discrimination when local cities try to cancel datacenter construction

[soothsayer @iamasoothsayer]

2023: Corona ended
2026: Hantavirus

[Neet @neet_sol]

Getting laid off and then thanking the company on Linkedin is next level wage cattle

[kordell @lledrook]

holy shit he beat the fuck outta him LMFAO

[International Cyber Digest @IntCyberDigest]

🚨 SaaS platform ClickUp, used by 85% of the Fortune 500, has been leaking customer emails through its homepage for at least 465 days, and counting.

ClickUp has a $4 billion valuation. They are SOC 2 Type 2, ISO 27001, ISO 27017, ISO 27018, ISO 42001, and PCI DSS certified. The fix takes about 90 seconds.

Security researcher @weezerOSINT noticed a hardcoded Split[.]io SDK token sitting in plain text inside ClickUp's production JavaScript bundle. The bundle loads before you log in. View source, copy key, send one unauthenticated GET request, and 4.5MB of ClickUp's internal configuration is exposed: 959 customer emails and 3,165 internal feature flags.

The customer list consists of Home Depot. Fortinet, who sells enterprise firewalls. Tenable, who makes Nessus, the vulnerability scanner half the industry runs on. Autodesk. Rakuten. Mayo Clinic. Permira. Akin Gump. A Microsoft contractor. 71 ClickUp employees. Government workers from Wyoming, Arkansas, North Carolina, Montana, Queensland, and New Zealand.

It gets worse, ClickUp has a flag named "enable-missing-authz-checks." It is active in production. It lists five ClickUp API endpoints the company itself documented as having no authorization. They wrote down their own holes in a config anyone with a browser can read.

At first disclosure, another flag carried a live ClickUp API token tied to Fairfax County Public Schools, one of the largest school districts in the US, serving 180,000 students. The token pulled 1,066 staff records, including Chief Financial Services data. ClickUp removed that one token. They never rotated the SDK key that exposed it.

While that report rotted, the same researcher found a second bug. ClickUp's webhook API has zero SSRF protection. Reported via HackerOne on April 8, 2026. Status: "New." 19 days, zero response.

The original report was filed by @weezerOSINT on January 17, 2025 (!). The key is still live. The emails still drop with one GET. ClickUp has had 465 days to rotate a single token. Zero response...

The fix is one click in the Split[.]io dashboard... ClickUp still hasn't replied to the researcher.

[Anthropic @AnthropicAI]

New Anthropic research: Project Deal.

We created a marketplace for employees in our San Francisco office, with one big twist. We tasked Claude with buying, selling and negotiating on our colleagues’ behalf.

[atlas @reatlashype]

when you work for a crypto project and finally meet the founder

[Andrew Qu @andrewqu]

When I spend 1M tokens and the <div> still isn't centered

[The Touchline | 𝐓 @TouchlineX]

🚨 𝗗𝗜𝗗 𝗬𝗢𝗨 𝗞𝗡𝗢𝗪: In 2021, Ukranian police raided what they thought to be an illegal crypto mining farm.

Instead, they found thousands of PlayStation consoles stacked on racks running FIFA 21 on autopilot.

They were farming Ultimate Team coins 24 hours a day to sell on the black market.

The operation was causing power blackouts across the entire city, and the consoles alone cost around $1.5m.

Back then, these coin farms could produce up to $3-5m a year.

[moni @wrappedaroundme]

Guy who fucks up and takes pesticides instead of peptides