. Joldmar Filho

Varejo • Tecnologia • Gestão
Processos - improviso
Construindo sistemas reais

[. Joldmar Filho @joldmarfilho]

68 tests passing. Public evaluation logs and synthetic fixtures included.

I'd love feedback from developers using coding agents for security reviews.

https://t.co/5WB0pYaWyX

@OpenAIDevs @AnthropicAI

[. Joldmar Filho @joldmarfilho]

Your API checks login. Does it check who owns the invoice?

I built Verified Code Security Audit, an open-source skill for coding agents that guides reviews of tenant isolation, IDOR, backend permissions, secrets, and XSS

@OpenAIDevs @AnthropicAI

[. Joldmar Filho @joldmarfilho]

Each finding must include exact source lines, an exploit path, impact, and a testable fix.

The workflow records what was actually reviewed, then uses validated JSON to generate PDF reports and GitHub issue drafts in English or Portuguese.

[. Joldmar Filho @joldmarfilho]

@gitsecops @AnthropicAI @OpenAIDevs Pre-merge. recheck takes --rev, so PR CI runs it against the PR head and exit 1 blocks the merge — the stale finding never reaches main. Nightly is only the fallback for repos you don't gate. Same command either way; where you put it is the policy.

[. Joldmar Filho @joldmarfilho]

Coding agents invent security findings. So I made evidence mandatory.

Every finding needs path, exact lines, snippet and an exploit path, or vcsa validate rejects the report. Coverage is checked, not declared.

Agent Skill, MIT:
@AnthropicAI / @OpenAIDevs

#AppSec #DevSecOps

[. Joldmar Filho @joldmarfilho]

@gitsecops @AnthropicAI @OpenAIDevs Fair point, so I shipped it: vcsa recheck compares every recorded snippet against a revision — intact, moved, stale, unverifiable. Exits 1 on stale, so a report expires in CI when the code moves under it.

Schema already required metadata.revision. Now something reads it.

[. Joldmar Filho @joldmarfilho]

Coverage is validated, not declared.

Claim exhaustive and it checks discovered == reviewed. Partial review must be recorded as sampled or limited.

No reviewing 4 of 30 endpoints and calling it clean.

https://t.co/5WB0pYaWyX

#AppSec #DevSecOps

[. Joldmar Filho @joldmarfilho]

@VNchocoTaco Samsung released a display with this feature, but it seems it wasn't necessary, lol

[. Joldmar Filho @joldmarfilho]

@ml_ajuda 3 dias tentando pagar minha fatura do mercado credito! Porem o dinheiro esta na conta, ficou retido para ser cobrando e nao cobra. Já tentei contato com diversos atendentes, ngm resolve!

[. Joldmar Filho @joldmarfilho]

I'm using #Watusi to customize #WhatsApp Messenger by @iF0u4d https://t.co/SwTsgtyMeZ

[. Joldmar Filho @joldmarfilho]

I'm using #Watusi to customize #WhatsApp Messenger by @iF0u4d https://t.co/SwTsgthbnr

[. Joldmar Filho @joldmarfilho]

I'm using #Watusi to customize #WhatsApp Messenger by @iF0u4d https://t.co/SwTsgthbnr

[. Joldmar Filho @joldmarfilho]

@TDeviceservice não consegui fazer o download... completei a oferta mas nao consegui o download

[. Joldmar Filho @joldmarfilho]

@iF0u4d
friend bought the watusi officially but is showing ads https://t.co/SwTsgthbnr

[. Joldmar Filho @joldmarfilho]

@iF0u4d
friend bought the watusi officially but is showing ads

[. Joldmar Filho @joldmarfilho]

@JunesIphone Ican help you translate the Screenshot App in Portuguese?

[. Joldmar Filho @joldmarfilho]

@NeoIghodaro

[. Joldmar Filho @joldmarfilho]

@Ziph0n I can help you translate the 3DNoLag in Portuguese?

[. Joldmar Filho @joldmarfilho]

@cpdigdarkroom I can help you translate the shortcuts in Portuguese Brazil?

[. Joldmar Filho @joldmarfilho]

@iF0u4d I can help you translate the #watusi Portuguese in Brazil?