Paulo

@djangoproject Contributor |
@djangoCMS Core developer |
@pylatam organizer

[Paulo @czpython]

“Don’t ask again” shouldn’t mean “save my password.”

Researchers found 1,379 secrets in Claude Code approval files on public GitHub.

In Druks, AI/GitHub tokens stay outside the sandbox. Approval records stay outside the repo.

Source: https://t.co/oXrzmH4vWf

[Paulo @czpython]

Before leaving Sherpany, I integrated Druks into their infra during the quarterly hackathon.

When the eMudhra news broke, security asked it in Slack: “Are we affected?”

It checked 118 repos and helped engineering prepare fixes that the team then merged 🤘

[Paulo @czpython]

@anupamrjp https://t.co/LTfDaG4b3Y

[Paulo @czpython]

After eight years at Sherpany, I’ve taken the leap to build my own thing: Druks 🚀

Feels a bit crazy to leave a stable job, especially in this market. But I’m excited to see where this goes.

More soon.
https://t.co/LTfDaG4ITw

[Paulo @czpython]

I built Druks so agents could ship my side projects. Now they review PRs, write test plans, and find sales leads too. Open source.
You write the workflow once, and agents run it every time.https://t.co/OwfkDyK8y5

[Paulo @czpython]

@oldstackjournal Agreed, mostly. But "that smells wrong, try again" assumes you can smell it. Without having actually built things the hard way, most people can't spot subtly broken code.

[Paulo @czpython]

@vineerpasam

[Paulo @czpython]

@justmazer @speedrun @KatiaAmeri What If you're highly technical but never went to college 🤔

[Paulo @czpython]

@omkarships I've flipped on this. Used to think no. Now I think it depends, for most products, yes. For regulated stuff like banking, you'll still need someone technical to survive an audit.

[Paulo @czpython]

Been playing with @Cloudflare's EmDash, the agent/MCP integration is pretty good. AI-native content ops baked in from the ground up. Genuinely impressed.

[Paulo @czpython]

@rauchg Also the biggest patience test in history, negotiating daily with something that has zero accountability, no stakes, and doesn't run on any of the feedback loops we subconsciously use (guilt, embarrassment, 'I'll do better'). You just keep re-explaining until it lands.

[Paulo @czpython]

@mikejulian @DuckbillHQ Were you tracking defect escape rate? If so, did it change in any way?

[Paulo @czpython]

nothing humbles you like scrolling twitter and finding three people shipping your exact idea 🫠

[Paulo @czpython]

@mitsuhiko Python at least made __name mangling ugly enough that nobody mistakes it for ergonomic. JavaScript’s # feels designed to maximize diff noise.

[Paulo @czpython]

@saaayyyaaan Just pushed a redesign, let's gooo https://t.co/LTfDaG4b3Y (twitter hasn't updated the card image😪)

[Paulo @czpython]

Lately been seeing a lot of "hot takes" related to programming, curious if genuine or just bait

[Paulo @czpython]

@oldstackjournal Hey! I’ve been building https://t.co/LTfDaG4b3Y pretty much in silence. No proper launch yet.

[Paulo @czpython]

@suni_code Distribution

[Paulo @czpython]

@ardent__dev learn to graph

[Paulo @czpython]

@danielkleach yuup and AI has made this way worse