Henky Wu

creative strategist @qatalog, web developer, dad, guitarist @ 🇭🇰

[Adam Ghowiba @adamghowiba]

JP Morgan's investment research team just shared exactly how they built their multi-agent system "Ask David", and it's the same architecture pattern showing up everywhere:

- supervisor agent orchestrates
- specialized subagents handle retrieval, structured data, analytics
- LLM-as-judge reflection node before the answer ships
- human-in-the-loop for the last accuracy gap

worth watching for anyone building:

[Lovable @Lovable]

We’re sorry our initial statement didn't properly address our mistake. Here's what a public project on Lovable means, and how we got to where we are today:

In the early days, people didn't know what Lovable was capable of. So we wanted to make it easy to explore what others were building, as a way to spark ideas and lower the barrier to getting started. Like scrolling GitHub or Dribbble: you browse projects to see what's possible, then go build your own.

When you create a project on GitHub, you can make it private or public. Lovable worked the same. Users had a "Public" or "Private" option right in the chatbox. A public project meant the entire project was public, both chat and code. “Just like a public project on GitHub," we thought.

Over time, we realized this was confusing. Many users thought "public" just meant others could see their published app, not the chat of an unpublished project. That's reasonable.

On the free tier, users originally couldn't create private projects. They had to upgrade to a paid plan to do so. In May 2025, we changed this: users on the free tier could choose to make their projects private. For enterprise customers, the public visibility setting was disabled altogether. And in December 2025, we switched to private by default across all tiers.

We also retroactively patched our API so public project chats couldn't be accessed, no matter what. Unfortunately, in February, while unifying permissions in our backend, we accidentally re-enabled access to chats on public projects.

This was reported through our vulnerability disclosure program (via HackerOne). Unfortunately, the reports were closed without escalation because our HackerOne partners thought that seeing public projects’ chats was the intended behaviour.

Upon learning this, we immediately reverted the change to make all public projects’ chats private again. We appreciate the researchers who uncovered this.

We understand that pointing to documentation issues alone was not enough here. We’ll do better.

[Guillermo Rauch @rauchg]

Here's my update to the broader community about the ongoing incident investigation. I want to give you the rundown of the situation directly.

A Vercel employee got compromised via the breach of an AI platform customer called https://t.co/7PY6gGtzgI that he was using. The details are being fully investigated.

Through a series of maneuvers that escalated from our colleague’s compromised Vercel Google Workspace account, the attacker got further access to Vercel environments.

Vercel stores all customer environment variables fully encrypted at rest. We have numerous defense-in-depth mechanisms to protect core systems and customer data. We do have a capability however to designate environment variables as “non-sensitive”. Unfortunately, the attacker got further access through their enumeration.

We believe the attacking group to be highly sophisticated and, I strongly suspect, significantly accelerated by AI. They moved with surprising velocity and in-depth understanding of Vercel.

At the moment, we believe the number of customers with security impact to be quite limited. We’ve reached out with utmost priority to the ones we have concerns about. All of our focus right now is on investigation, communication to customers, enhancement of security measures, and sanitization of our environments. We’ve deployed extensive protection measures and monitoring. We’ve analyzed our supply chain, ensuring Next.js, Turbopack, and our many open source projects remain safe for our community.

The recommendation for all Vercel customers is to follow the Security Bulletin closely (https://t.co/BLVnic9fJC). My advice to everyone is to follow the best practices of security response: secret rotation, monitoring access to your Vercel environments and linked services, and ensuring the proper use of the sensitive env variables feature.

In response to this, and to aid in the improvement of all of our customers’ security postures, we’ve already rolled out new capabilities in the dashboard, including an overview page of environment variables, and a better user interface for sensitive env var creation and management. As always, I’m totally open to your feedback.

We’re working with elite cybersecurity firms, industry peers, and law enforcement. We’ve reached out to Context to assist in understanding the full scale of the incident, in an effort to protect other organizations and the broader internet. I also want to thank the Google Mandiant team for their active engagement and assistance.

It’s my mission to turn this attack into the most formidable security response imaginable. It’s always been a top priority for me. Vercel employs some of the most dedicated security researchers and security-minded engineers in the world. I commit to keeping you updated and rolling out extensive improvements and defenses so you, our customers and community, can have the peace of mind that Vercel always has your back.

[Ben Sigman @bensig]

My friend Milla Jovovich and I spent months creating an AI memory system with Claude. It just posted a perfect score on the standard benchmark - beating every product in the space, free or paid.

It's called MemPalace, and it works nothing like anything else out there.

Instead of sending your data to a background agent in the cloud, it mines your conversations locally and organizes them into a palace - a structured architecture with wings, halls, and rooms that mirrors how human memory actually works.

Here is what that gets you:

→ Your AI knows who you are before you type a single word - family, projects, preferences, loaded in ~120 tokens
→ Palace architecture organizes memories by domain and type - not a flat list of facts, a navigable structure
→ Semantic search across months of conversations finds the answer in position 1 or 2
→ AAAK compression fits your entire life context into 120 tokens - 30x lossless compression any LLM reads natively
→ Contradiction detection catches wrong names, wrong pronouns, wrong ages before you ever see them

The benchmarks:

100% recall on LongMemEval — first perfect score ever recorded. 500/500 questions. Every question type at 100%.

92.9% on ConvoMem — more than 2x Mem0's score.

100% on LoCoMo — every multi-hop reasoning category, including temporal inference which stumps most systems.

No API key. No cloud. No subscription. One dependency. Runs on your machine. Your memories never leave.

MIT License. 100% Open Source.

https://t.co/KggwTqijmD

[Addy Osmani @addyosmani]

Tip: Be careful with /init. A good mental model is to treat AGENTS(.md) as a living list of codebase smells you haven't fixed yet rather than a permanent configuration.

Auto-generated AGENTS(.md) files hurt agent performance and inflate costs because they duplicate what agents can already discover. Human-written files help only when they contain non-discoverable information - tooling gotchas, non-obvidous conventions, landmines. Every other line is noise.

Beyond what to put in it, there's a structural problem worth naming: a single AGENTS(.md) at the root of your repo isn't sufficient for any codebase of real complexity.

What you actually need is a hierarchy of AGENTS(.md) files - placed at the relevant directory or module level - automatically maintained so that each agent gets context scoped precisely to the code it's working in, rather than a monolithic file that conflates concerns across the entire project.

[Ibelick @Ibelick]

Agents are getting better at creating UI, but some things still annoy me.

I wrote them down as https://t.co/mPQ27gNa3Z.

https://t.co/QeJjCaCRgd

[jhey ʕ•ᴥ•ʔ @jh3yy]

this year's editions page is a marvel – so many awesome details 👨‍🍳

honored to contribute, team smashed it 👏

beyond the incredible webgl work, there's crafty use of css container queries, counters, transitions/animations, and svg too!

[Brett @BrettFromDJ]

Holy sh*t. Sound on. 🔊

Endless looping, animated Airbnb-style icon with AI generated sound, all in one app.

Full tutorial below.

[Steven Tey @steventey]

One interesting thing about the @nextjs CVE that not a lot of people are talking about:

It only affects your app if you fully rely on Middleware for auth (and are not auth'ing subsequent API requests).

In other words, if you:
◆ only use Middleware for routing
◆ are validating requests in your API routes/server actions

...your app is safe – regardless of where it's hosted.

[James Lucas @JamesLucasIT]

One of the greatest sculptors of all time was born 426 years ago today on December 7, 1598.

A thread on the legendary Gian Lorenzo Bernini

1. The Abduction of Proserpina

[Henky Wu @htgmanics]

@MKBHD Where’s the car?

[Henky Wu @htgmanics]

It’s so difficult to articulate an complex animation in prompt and translate it to real code … #claude @AnthropicAI

[Luke Dalton @daltonuiux]

Only senior designers can tell what is wrong with this.

[jhey ʕ•ᴥ•ʔ @jh3yy]

CSS Tip! ✨

You can create these parallax effects and image cross-fades with scroll-driven animations 🤙

img {
animation: fade;
animation-timeline: view();
mix-blend-mode: plus-lighter
}
img:last-of-type { animation-direction: reverse; }
@​keyframes fade { to { opacity: 0; }}

This one's fun! 😁

The trick with the cross-fading image is to make use of one animation that runs at the same time on two images inside a container.

You use the same animation, animation-timeline, and animation-range. But, you use animation-direction: reverse on one of the images so they go in the opposite direction 🫶

The use of mix-blend-mode: plus-lighter; produces a better cross-fade result 💯

A viewTimeline (view()) works because you know that both images are the same height. The range you can use is

img {
animation-timeline: view();
animation-range: cover 45% cover 55%;
}

That means when the image has covered 45% of the scrollport (In this case, the window), start the animation. And finish when it has covered 55% 🎬

How about the slight parallax? This is a trick with calc(). You know the top of the small image and the big image line up. And you can do this by absolutely placing the caption outside of the small image.

The trick is to translate the small image by a distance so it lines up with the bottom of the big image. You can do that like this

:root {
--catch-up: calc(
var(--big-height) - var(--small-height)
);
}
@​keyframes move { to { translate: 0 var(--catch-up); }}

Then drive that animation with a scroll-driven animation using the container of both images as the driver 🤙

/* section contains both images */
section { view-timeline: --container; }
.img-fader {
animation: catch-up both linear;
animation-timeline: --container;
animation-range:
50vh
calc(100vh + (var(--big-height) * 0.25));
}

That's it! Scroll-driven image cross-fading and parallax effects without any JavaScript. This demo will work in all browsers as there is some JavaScript in place where the API isn't supported 🤙 To do that, it uses GSAP ScrollTrigger 🏆

As always, any questions, requests, etc. hit me up! 🤙

@CodePen link below 👇

[Ozan Öztaskiran @ozanoz]

This is crazy @framer

[Ad Professor @The_AdProfessor]

23 creative ads I collected this year:

1. Nescafe

[Henky Wu @htgmanics]

@MichaelFilipiuk squircle

[Massive Attack @MassiveAttackUK]

RIP Angelo 🤍
A singularly brilliant & eccentric talent. Impossible to quantify your contribution to the Massive Attack canon.
How lucky we were to share such a life together.

[Justin Schroeder @jpschroeder]

Another 3 days in a row of @npmjs download analytics being down. Just 4 days and @reactjs and @vuejs will have 0 weekly downloads 😂.

These stats aren’t all that important but it does highlight what a significant single point of failure npm is in the JS ecosystem.

[Linus ✦ Ekenstam @LinusEkenstam]

CGI is about to get easy

This is simulon, a new iOS app that’s still in invite only mode

The video below was made with a live in-camera preview and auto-exposure matching, no camera solve, no HDRI capture and no manual compositing setup.

🔗 in next tweet