overgeared

[arcis @getarcis]

Shipped @arcis/mcp 1.0.

Seven prompt-injection payloads fire at an MCP server on every
CI run. The test is the spec. The test passes.

https://t.co/0fTyR4ORjD

[arcis @getarcis]

Reading the Log4Shell postmortems from 2022 with 2026 eyes:

The recurring sentence is "we found Log4j in production by reading the news."

Inventory beats response. The defense is in your handler, not in the SOC dashboard.

[arcis @getarcis]

YC S26: no.

Saw it coming. Applied anyway because the project is worth it.

Arcis is open-source security middleware in Node, Python, Go.
12k+ downloads, all free, all MIT. Same plan. Same product.

Back to building.

https://t.co/S6KC6VLqXY

[overgeared @overgeared2608]

Once you've been here a while, you auto-filter all of it. But for someone just walking in?
It's chaos.

The new-user experience isn't just declining - it's buried under portfolios and follow-for-follow.

#TWITTER

[overgeared @overgeared2608]

Has X always been like this, or did I just never notice?

I've used Twitter for years - purely to lurk and keep up with what's happening. Then I made a fresh account for my project and only now saw what the platform has actually become.

[overgeared @overgeared2608]

Then come the "I'm a hacker, I'll teach you the secrets of engagement" types.
The real secret is that you pay them, and a pile of bots starts following you.

Is X ever going to take action against this?

[arcis @getarcis]

The WAF and the application see the same HTTP request differently.

The attacker only needs to live in the seam.

https://t.co/dpBCCWWwha

[arcis @getarcis]

If you want the full thesis behind Arcis - what it is, what it
does NOT do, and the inside-the-app argument, the launch post is
the cleanest place to start.

5-minute read.

https://t.co/5WUeQ0Gebm

[arcis @getarcis]

What one `app.use(arcis())` line replaces in a typical Express app:

helmet
express-rate-limit
csurf
sanitize-html
hpp
express-mongo-sanitize

Five fewer libraries to keep updated.

#Cyber_Security #security

[arcis @getarcis]

Arcis conformance status:

154/154 tests pass across Node + Python + Go
Same input → same verdict in all three SDKs
Drift = failed CI = no release

Cross-SDK parity is the only metric that matters once a tool
ships in multiple languages.

[arcis @getarcis]

2026 reality: every app is now three apps.

A request app. A model app. A tool app.

The WAF protects the request app. Nothing protects the other two.
That's the gap Arcis is in.

[arcis @getarcis]

The fix for fullwidth XSS bypasses is three lines per language:

JS: input.normalize
Python: unicodedata.normalize
Go: norm.NFKC.String

Catches: fullwidth, ligatures, math letterlikes.
Skip it and your sanitizer has a permanent backdoor.

[arcis @getarcis]

The full Arcis install:
npm install @arcis/node

Two lines. Thirty attack vectors at the request boundary.
OWASP Top 10 plus prompt injection, MCP toolcall, deserialization,
and 20 more.

https://t.co/erAA6C1hbU

#cybersecurity #security #appsec #devtools #opensource

[arcis @getarcis]

Hello world.

Open-sourced Arcis. Security middleware that runs inside your
web app instead of in front of it.

For developers tired of WAFs that block `' OR 1=1` and miss
everything else.

Node, Python, Go.
https://t.co/erAA6C1hbU

[arcis @getarcis]

Arcis ships first-party adapters for:

Express  Fastify  Hono  Next.js  Koa
FastAPI  Django  Litestar  Flask
Gin  Echo  Chi  Fiber  net/http

One config object. Same defense across all of them.

https://t.co/erAA6C1hbU

[overgeared @overgeared2608]

@getarcis wait, in-app instead of a reverse proxy? curious how you handle the per-route config overhead...

[overgeared @overgeared2608]

I love the vision behind it and also the user interface...

[Y Combinator @ycombinator]

It’s never been easier to design your dream house.

Draw a shape. Define your rooms. Set your constraints.

@DraftedAI generates complete floor plans, elevations, and 3D home designs in seconds.

Over the last month, 120,000 people generated 325,000+ home designs with https://t.co/XqC0LP5n3y.

[overgeared @overgeared2608]

@CodeAndConsole Watching "india got latent" 😂🤣