Samuel Tirtawidjaja

Front End Engineer. Ex Codeable Expert

[Sybre Waaijer @SybreWaaijer]

Syed Balkhi (Awesome Motive) put a backdoor in WPForms Lite three weeks ago in version 2.0.0. The plugin runs on over 5 million sites.

The file: wpforms-lite/src/SetupWizard/Bridge.php.

What it does:
It takes over your browser and opens their app on WPForms' servers. It hands that app a one-hour login token for your site. Their app can then act on your behalf on your site.

What they can do with it:
Their app can install and activate plugins. It can also turn on a switch that starts sending your form submissions to WPForms' servers. The plugin never asks first and never warns you.

When it runs:
It kicks in automatically on a fresh install during setup, only for administrators. You won't get a notice. The token expires at the end of setup, or after an hour.

What they can install:
Thirteen plugins from WordPress dot org: WP Mail SMTP, WPConsent, Uncanny Automator, AIOSEO, Universally, Duplicator, Reviews Feed, OptinMonster, MonsterInsights, ActiveLayer. Oddly (probably a bug), also Contact Form 7, Ninja Forms, and Pirate Forms.

They can also pull WPForms addons and WPForms Pro from their own servers. These servers are not moderated and could be used to push malicious code—which ought to be expected, given their track record.

Extra context:
Awesome Motive is employing and has hired WordPress Plugins Team members.

[Samuel Tirtawidjaja @sam1337dev]

Agency, please hire her. Not often could you say to a client, "This person MADE the Twenty-Twenty Five theme"

[Samuel Tirtawidjaja @sam1337dev]

@carolinapoena I've reposted this and put it around my circle as well! Hope for the best ;)

[Samuel Tirtawidjaja @sam1337dev]

Shout out to https://t.co/z938bOlWc3

[Samuel Tirtawidjaja @sam1337dev]

I am putting it here as one of my acquaintances in the community that I just recently joined is doing some research for a new plugin.

Please help fill in the survey. I will link their website in the comment below. https://t.co/32ShXz5KJE

#WordPress #WordPressCommunity

[Codez @0xCodez]

Anthropic just dropped 5 workshops, revealing the latest capabilities of Fable 5:

• 00:00 - deep look into Fable 5
• 11:22 - Fable 5 and the capability curve
• 30:54 - building managed agents with Fable 5
• 44:29 - real use cases of Fable 5 by teams
• 57:43 - how to deploy agents with Fable 5

These 1-hour of sessions will replace 100 articles on how to actually use Fable 5.

Watch them today, then read the best practices from the sessions in the article below.

[Granite @Granite0x]

He leads engineering on Gemini at Google.

instead of keeping his Claude setup private, he open-sourced it.

Addy Osmani. That Google: Chrome DevTools lead, "Learning JavaScript Design Patterns" author.

'agent-skills' - his personal loadout. Drop-in for any project.

68,925 stars. MIT.

→ https://t.co/n7NI3Sr7uu

bookmark it. This is how your Claude setup goes pro.

[Miles Deutscher @milesdeutscher]

This is an insane Fable 5 UI/UX hack.

This "Taste" skill completely kills generic AI-slop and gives Fable 5 the tools & instructions needed to ship beautiful design.

This might just be the best AI skill I've ever used.

https://t.co/XVQ6JpjYCy

[Pedro Dias @pedrodias]

Cloudflare just reshaped how AI crawlers get classified — and SEO teams need to pay attention before Sept 15.

On its second "Content Independence Day," Cloudflare moved away from the blunt "block all AI bots" model toward a behaviour-based taxonomy. Instead of asking "is this AI?", the question is now what is the bot doing, what does it store, and how does it reshare your content?

The three use cases every site owner can now control (yes, including the Free tier):

☛ Search: indexing your content to answer queries later; the behavior that drives referral traffic back to you. Allowed by default.
☛ Agent: real-time bots acting on a human's behalf (ChatGPT-User, Gemini/Claude driving Chrome).
☛ Training: crawling to permanently absorb your content into a model.

The change with the biggest SEO implications ☛ new defaults land September 15, 2026.

On pages that display ads, Training and Agent will be blocked by default while Search stays allowed (for new domains onboarding). More importantly: multi-purpose crawlers will now be blocked according to all their behaviors. That means if you block Training, combined crawlers like Googlebot, Applebot, and Bingbot get blocked too — because they crawl for both Search and Training.

You can opt out in Security settings before Sept 15 to protect your search visibility. Don't sleep on this one.

For AI-visibility work:
☛ A new use signal extends Content Signals in robots.txt — use=immediate (store nothing), use=reference (index, excerpt, link back — the new default), or use=full (summarize and reproduce). These are stated preferences, not hard blocks.
☛ Bots that reproduce content in full can't be Verified. Abusing signals costs a bot its Verified status.
☛ "Verified" no longer means "allowed by default" — it now just makes a bot allowable within its category.

Also worth knowing:
☛ BotBase — a new searchable directory (Enterprise Bot Management) showing every tracked bot, its classification, and a copyable detection ID for security rules.
☛ Transitive trust — an experiment using the RFC 7239 Forwarded header (e.g. Forwarded: for="openai";use="reference") so operator-level trust decisions hold even through layers of intermediaries.

The through-line: control is getting granular, and the era of "search and training are the same crawler" is ending. If you manage crawl access, audit your Training rules now so you don't accidentally deindex yourself in September.

[Shiv @shivsakhuja]

Fable 5 + Goose Ads is insane – literally a full ad-creative team right in Claude Code.

1. Install the skill:

npx gooseworks install --all

npx gooseworks login

2. Ask Claude Fable to make ads for your brand.

/goose-ads create ads for my brand <your-website>.

Fable 5 pulls the ads already winning in your space and rebuilds them on-brand – your product, your palette, your copy – a whole batch, ready to test.

It can ship a month of creative testing in a single prompt.

This is also possible with Opus and Sonnet, but Fable's brand research is next level.

Link below.

[Vikas gupta @vicky_grok]

Anthropic pays $750,000+ a year for engineers who can build LLM architectures from scratch. Stanford taught the entire thing in 1 hour lecture &amp; released it for free.

Bookmark &amp; watch this today before someone takes it down and read this article below

[Samuel Tirtawidjaja @sam1337dev]

@courtneyr_dev Thanks for sharing!

[Samuel Tirtawidjaja @sam1337dev]

@CodeCrafters11 I am interested, but what's the stack?

[Samuel Tirtawidjaja @sam1337dev]

@rossmorsali I also just sent you a dm :)

[Samuel Tirtawidjaja @sam1337dev]

@bicky_grg @framer Nice

[Justin Poehnelt @JPoehnelt]

Two months ago I was fired by Google for creating the Google Workspace CLI. It went viral, hit #1 on Hacker News, gained thousands of GitHub stars and many thousands of actual users in just a couple days.

It was an incredible, confusing journey, from directors and leaders asking what they could learn from the tool to getting grilled by legal about why the Google logo and brand colors are on the Google Workspace GitHub code repositories.

I think the cause was that Workspace and certain leaders (and projects) were afraid of being disrupted. But the fear wasn't specific to my CLI, it was a broader fear in what agents meant for Workspace. Either way, the irony of my termination was the announcement at Google Cloud Next two days before I was fired that an official Workspace CLI was coming.

I want this out there because it is easier for me to explain my story and it is an experience I want to fully own. It's also part of my healing.

Nearly 7 years at Google was an incredible opportunity for me and I was fortunate to have wonderful teammates and a manager that fully supported me through these last few months. Thank you.

[Pat Simmons @per_simmons_]

Claude just became a craacked video game designer.

With the launch of Unreal Engine's MCP server last week, you can now build entire video games just by talking to Claude.

I spent the past few days building with it, and I'm telling you, this is going to forever change how video games get made and who gets to make them.

In this video I show you exactly how to set up the Unreal Engine MCP yourself and run through three demos: building a full playable city, cloning a real city from Google Earth, and creating custom buildings in Blender.

Here's the agent harness I mention too: https://t.co/mos9EwnZ2h

Intro
What I built in a few hours
Setting up the Unreal MCP server
Fixing the port 8000 connection issue
The agent harness that avoids the pitfalls
Demo 1: Building a city with City Sample
Demo 2: Cloning a real city from Google Earth with Cesium
Demo 3: Custom buildings with Blender headless
Outro

[probiex007 @probiex007]

🤯 This is a website, a simple web-based game built with WebGL and Three.js.
Website: https://t.co/G0cDgaWzKe
It's honestly surprising how far web development has come.

[Samuel Tirtawidjaja @sam1337dev]

You don’t need llms.txt or other hacks.

If you are using AI to make content please follow as well the guidelines.

https://t.co/qpgLtQfpLv

[Lily Ray 😏 @lilyraynyc]

Google just put out its first official article on optimizing for AI search (AEO/GEO)!

TL;DR:

⭐️ SEO is still the foundation for AI search.

⭐️ Create non-commodity, "people-first" content.

⭐️ Ignore most "GEO/AEO hacks like chunking and llms.txt.

https://t.co/RbUOOPFl2I

[Samuel Tirtawidjaja @sam1337dev]

@beaulebens @SybreWaaijer This is great! Thank you, sir.