Rishit Thakur

practice

[Rishit Thakur @iamrishit8]

My brother Rajat Singh @RajatSingh2220 is a creator who built his Instagram over 12+ years.

@Meta permanently disabled it under its child-safety policy: no content identified, no human explanation, appeals answered by templates.

If this has happened to you, reply or DM. We’re documenting the pattern. Thread 👇

[rajat singh @RajatSingh2220]

My @instagram account @rajatsingh2220 (12+ years, nearly 30k followers, my full-time work) was permanently disabled by @Meta on 18 Oct.

The stated reason: its child-safety policy.

I deny it completely, and I’m asking @Meta to show me what they think I did. 🧵

[Rishit Thakur @iamrishit8]

Claude writes about 90% of the code for Claude Code.
So who reviews it?

The Claude Code team (Addy Osmani, Morgan Westlee Lunt, Qing Wang) published how they do it. Between June and September, merged PRs more than doubled and the share reverted fell by over 40%.

They didn't stop reviewing. They changed the question.

"Did someone read the code?" is a weak proxy for the real one: what could go wrong with this change, and which check, automated or human, is the right one to catch it?

The design that follows:

Layers, not a gate.
Verification before the PR, required CI, AI review, security review, human approval scaled by risk, then a merge queue with flags. Each layer has holes. They're different holes. Fast rollback sits under all of it.

Verify first.
Before a PR exists, the agent must show a result (tests, build, screenshot vs design) and a second agent reviews the diff with fresh context. Boris Cherny estimates that a verification loop improves Claude's output by 2 to 3x.

Humans go where mistakes are expensive.
Docs and copy: no person. Ordinary changes and sensitive areas: one. Highest-risk code: two. The change sets the tier, not the author, and an agent's approval never counts as a human one.

Agent reviewing agent can loop forever.
One PR cycled 50+ times overnight. About 59% of what the reviewer kept flagging was code that was there from the first pass. So they made review converge: re-evaluate the approach after three cycles, only re-review the new diff, name the whole class of bug.

Result on internal PRs: passing after one round went from 65% to 78%. Five or more rounds fell from 8.9% to 1.5%.

Incidents are the eval. Every incident or revert, once an expert confirms the bug, joins a test set. The reviewer is scored on the whole set daily. Change its prompts, tools or model, and the score has to go up.

My take: the interesting part isn't the AI reviewer. It's that human attention is treated as the scarce resource, and reverts are the guardrail. If reverts rise, you haven't saved human time. You've moved it.

The unsolved part, which they admit: review was also how people learned the codebase. If machines do the reading, how does anyone learn it? Their answer is on-demand explainers for the exact slice you're about to change.

All numbers are Anthropic's own, from its own repos. Read it as a case study, not a benchmark.

Question for anyone letting agents open PRs: which checks have you automated, and which still need a person?

[Rishit Thakur @iamrishit8]

12/ Source: "How the Claude Code team does code review" by Addy Osmani, Morgan Westlee Lunt and Qing Wang.

https://t.co/9jAVmFHiSl

[Rishit Thakur @iamrishit8]

1/ Claude writes about 90% of the code for Claude Code. So who reviews it?

The team published how they do it. Between June and September, merged PRs more than doubled. The share reverted fell by over 40%.

They didn't stop reviewing. They changed the question.

[Addy Osmani @addyosmani]

https://t.co/4Hfk0dYIBI

[Rishit Thakur @iamrishit8]

11/ Caveat: every number is Anthropic's own, from its own repos. A good case study, not a benchmark.

Which checks have you automated, and which still need a person?

[Rishit Thakur @iamrishit8]

PHP had a very bad week.

Here is what I think the story actually is.

Two critical flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both allow remote code execution.
Both score 9.2 on PHP's own scale. They affect releases back to PHP 5.4, from 2012.
Governments took sites offline: the Dutch government portal, Finland's public web services, French Interior Ministry sites, per Wikipedia and The Hacker News.
Not because they were hacked. Because they could not patch fast enough, and offline is safer than exposed.
But the bug is not the interesting part.

THE BUG, IN PLAIN WORDS
PHP runs out of memory halfway through a request and cleans up in a hurry. The cleanup leaves things half built, or pointing at memory already freed. The next piece of code trusts them. It is the oldest class of bug in systems programming.

THE TIMELINE IS THE REAL NEWS
The Hacker News reports that a core developer first spotted signs of the flaw in PHP's 2024 external audit. Only a theoretical attack was known, and the fix stalled for months. The PHP Foundation called this "a structural failure" of its decision process and resources.
Then AI entered. Researchers say it let one person do in about a week what would have taken a team months. But Calif says current models do not reliably start from an obscure twenty-year-old idea on their own. A human traced the bug back to 2004 research and pointed the model at it.
So it is not "AI finds bugs." It is "a person with taste picks the right old idea, and AI does the grind."

THE PATCH WINDOW IS GONE
Amazon logged an exploit attempt on October 17, four days before disclosure. A planned disclosure leaked, a proof-of-concept video went up by accident, and patched container images appeared hours before the fix. Cloudflare saw attempts go from tens of thousands within 45 minutes of disclosure to millions the next day.
I think patch speed becomes a core engineering metric, like uptime. "How long from CVE to production?" starts showing up in interviews.

WHO FIXES THIS STUFF
The PHP Foundation has 13 full- and part-time employees, per the Guardian as cited on Wikipedia. We spend billions on AI that finds bugs and very little on the people who fix them. Finding got cheap. Fixing did not. My bet: the next few years of security are about maintainers, not scanners.

WHAT I TAKE FROM IT
Boring dependencies are not safe dependencies. They are the ones you stopped looking at.
"Is it supported?" is a production question. PHP 8.1 and older get source backports only, and about 884,000 hosts still advertise 8.1 or older (Mallory, via Decrypt).
Detection that starts at disclosure is already late.

I am currently working in TypeScript and Node, so none of this landed on my desk. But somewhere in your stack there is a dependency that a small group maintains and almost nobody reviews.

Do you know which one it is?

[Netflix India @NetflixIndia]

there can't be another 23/10 🐐

[Rishit Thakur @iamrishit8]

No way Sam Altman and Oppenheimer share a birthday!!

[Tesla @Tesla]

From Roadster in a rocket

To rocket in a Roadster

[Rishit Thakur @iamrishit8]

I’ve been building WhisperNet for the past few months.

The idea: an anonymous social app for each individual college campus.

Anonymity comes with responsibility. So over the next few days I’ll harden the code, tighten privacy, add moderation, and make the architecture cleaner and more modular.

What it can do today:
- Upload different kinds of media
- Anonymous video calls
- Chat
- Confession mode
- Campus vibe
- Repost and quote repost your whispers
- An alternate feed (coming soon)

I’ll share a demo once the hardening is done.

More project ideas are on the way.

If you’ve built or used an app like this, what features or tips would you add?

Tell me in the comments.

[Tesla @Tesla]

Do a kickflip!