lightcap.eth 🏴

Heretic @ Codezero. (also CTO/CPO)

[lightcap.eth 🏴 @lightcap]

Credentials continue to be the target of just about every attack in 2026.

[SafeDep @safedepio]

🚨 The "𝙼𝚎𝚐𝚊𝚕𝚘𝚍𝚘𝚗" Campaign is live...

𝟻,𝟽𝟷𝟾 malicious commits to 𝟻,𝟻𝟼𝟷 GitHub repositories in a six-hour window.

Using throwaway accounts and forged author identities (build-bot, auto-ci, ci-bot, pipeline-bot), the attacker injected 𝙶𝚒𝚝𝙷𝚞𝚋 𝙰𝚌𝚝𝚒𝚘𝚗𝚜 workflows containing 𝚋𝚊𝚜𝚎𝟼𝟺-𝚎𝚗𝚌𝚘𝚍𝚎𝚍 bash payloads that exfiltrate:

- CI secrets,
- cloud credentials
- SSH keys
- OIDC tokens
- source code secrets

Check your repo / Technical details: https://t.co/tua3jYU1wa

[lightcap.eth 🏴 @lightcap]

Gotta give it to the folks working on @opencode. I prefer the clean design of their TUI by *miles and miles* over any other TUI/CLI interface.

Honestly, it's beautiful and so well thought out.

Open source winning a lot these days.

[lightcap.eth 🏴 @lightcap]

@ajeetsraina @Docker Didn't realize y'all had implemented that. Nice.

[lightcap.eth 🏴 @lightcap]

@BenjaminHouy Hopefully scrubbed of PII/NPI 😬

[lightcap.eth 🏴 @lightcap]

@JacksonAtkinsX @cursor_ai I thought about trying to recreate it with their new SDK. But I can't seem to nail the prompt that ends up with these fine-grain bug finds. And it's tough to do evals because of how it works in the first place.

[lightcap.eth 🏴 @lightcap]

@JacksonAtkinsX Just wish I could run it locally rather than waiting for whole remote cycle.

[lightcap.eth 🏴 @lightcap]

I wanna try sotto but not prepared to drop $49 on the hope that it's better than other apps @thekitze. Why no trial?

[lightcap.eth 🏴 @lightcap]

@JacksonAtkinsX Yeah I don't think I've hit 21 rounds, but pretty damn close. I won't turn it off, though, because bugbot does find lots of little nitpick bugs that I think are still important. It's worth the back and forth.

My skill is called "ship" and it includes that same watch concept.

[lightcap.eth 🏴 @lightcap]

@wthisgoingon25 @UziCryptoo @romans11732 What’s your point? Medical costs are the number one reason for bankruptcy in the US. Yes taxpayers paid. You understand that’s how the insurance industry works too? Aggregate risk. People love to forget that insurance is inherently socialist.

[lightcap.eth 🏴 @lightcap]

@kneath For sure. I have it isolated with its own email, messaging etc. Not my accounts. But I do use Hermes more than others.

[lightcap.eth 🏴 @lightcap]

Everyone working on more memory and more context.

What we need is more *relevant* memory and context.

Context pruning is going to be far more important than accumulation.

[lightcap.eth 🏴 @lightcap]

@kneath "Just buy a mini"

[lightcap.eth 🏴 @lightcap]

@kneath Have you looked at Ironclaw? Folks at NEAR did it, it's not bad. Definitely better security posture from the start at least.

[lightcap.eth 🏴 @lightcap]

@steipete Still a bit too buggy for me. The idea is fantastic though. Definitely rooting for them and want the product.

[lightcap.eth 🏴 @lightcap]

@kneath I haven't played with Moltis yet. Why'd you choose it? (other than rust).

[lightcap.eth 🏴 @lightcap]

@HermesAgentTips @Bitwarden Don’t get me wrong it’s a step in the right direction. But it’s not the whole story.

[lightcap.eth 🏴 @lightcap]

@HermesAgentTips @Bitwarden It doesn’t prevent leaks into context or logs. It still puts the plaintext key in runtime where it can be logged, stolen via prompt injection and a dozen other ways. It does keep keys from lying around in plaintext in .env files or copy pasta.

[lightcap.eth 🏴 @lightcap]

@kneath What are you using these days?

[lightcap.eth 🏴 @lightcap]

@kneath Aren’t they so helpful sometimes? 😝

[lightcap.eth 🏴 @lightcap]

@itsallrandom69 @altryne @Teknium Supporting all the vaults possible. If you wanna use 1p you shouldn’t be blocked from doing it right.