Love the work @motdotla is doing with @dotenvx & am excited by what he's doing with Armor ⛨ - Our @vltpkg team got a excited when we first saw that first name change & appreciated Scott's willingness to adapt the name again to ensure there wasn't any confusion. Much love 🖤
🚨 TrapDoor supply chain attack hits npm, PyPI, and Crates-io.
https://t.co/SYnR0fcJCr
34 malicious packages across 384 versions were used to steal crypto wallets, SSH keys, cloud credentials, and developer secrets from crypto, DeFi, Solana, and AI environments.
The malware abused npm hooks, Python imports, and Rust build scripts for execution and persistence.
I built dtx — a minimal CLI on top of @dotenvx for easily switching and running encrypted environment variables.
Made with some vibe coding along the way.
https://t.co/kowvveUlrL
Ok so about 2 weeks into the SOC 2 process with @oneleet and we made the right choice.
I wanted a compliance solution that:
1. Organized policies and controls into practical language rather than "audit speak"
2. Mapped those controls tightly to audit requirements
3. Helped me understand the process deeply so we didn't feel locked into their platform
For #1, you can already start seeing the results on our trust page. Even the control categories are more practical and developer-friendly than what I've seen elsewhere.
For #2, their platform provides clear control mappings and detailed guidance, which helped me better plan ahead for auditor requirements as I built things out.
For #3, they provide an API. We've already automated a lot ourselves and pushed evidence directly into their dashboard. I don't feel locked in at all and have been able to wire things up to our company 'brain'. But their dashboard is also very intuitive and we're still spending most of our time directly in it and happy. Their automated controls they have are also really solid and save what otherwise is a lot of screenshot gathering.
Overall, @dotenvx is in a more secure position now and we'll continue to improve thanks to @oneleet. That's good for our customers and makes me happy. Looking forward to the internal audit next, and then the real thing.
We've been very busy with SOC 2 preparation across our infrastructure and business processes, but in the meantime we did ship Team Avatars and Choose Key Storage.