Practical tech writing for people who build

Latest articles

• Is Your API Key Already Public? How to Stop Secret Leaks

  How API keys leak through git, CI logs, bundles and AI agents, and how to stop it with gitleaks, push protection, OIDC and a tested incident playbook.

• Can Your Laptop Run Its Own LLM? A Practical Ollama Guide

  Run LLMs locally with Ollama: install on Windows, macOS or Linux, call the API on port 11434, write a Modelfile, and pick a model your hardware can handle.

• Is Claude Code Handing Your Email to Every Site It Visits?

  Claude Code put signed-in users' emails into User-Agent headers. Sites logged them; scam mail followed. Anthropic shipped a narrow fix—here's what still leaks.

• Has AI Outgrown Git? OpenAI's Pando Cuts Push Latency Nearly 5x

  OpenAI rebuilt its Git backend as Codex agents flooded its monorepo. Pando cut median push latency nearly 80%, and your git commands don't change. Here's how.

• Still Resending Every Chat Turn to Claude? Message Threads Cut the Wait

  Anthropic's new message threads beta lets Claude agents send only new messages each turn, cutting time to first token by about 35% on huge sessions. Here's how.

• Trigger.dev Breach Exposes Env Vars: Are Your Secrets Already Out?

  Trigger.dev says an attacker got into environment variables for a subset of organizations. Here's what leaked, what's still unknown, and what to rotate now.

• DeepSeek's Super-Agent Reads Your Team Chat. Should It Write Your PRs?

  DeepSeek open-sourced Super-Agent, an MIT-licensed coding agent that takes requests from GitHub and Feishu and answers with pull requests. Here's how it works.

• Can You Trust an AI-Built Database? Jepsen Found 96 Bugs in ParticleDB

  Jepsen found 96 bugs in ParticleDB, an AI-focused database built with LLM help, and told users to stop deploying it. Here's what broke and why it matters.

• Northflank Breach Exposes AI Keys: Have You Rotated Your Secrets Yet?

  Northflank told customers to assume their environment variables were decrypted after stolen AI API keys were abused. Here's what happened and what to rotate.

• Applebee's Shipped Its Database Password in an App. Could Yours Leak?

  Applebee's left a customer database password inside its Android app, exposing names, birthdays and phone numbers. Here's how it happened and how to avoid it.

• Did Cursor Push a Backdoored Claude Code Extension to Your Machine?

  A tampered Claude Code extension sat in Cursor's marketplace for 11 hours, planting an SSH key and persistence on up to 5,000 dev machines. Here's how to check.

• Gemini 4 Carbon Is No. 1, So Why Can't Developers Use It Yet?

  Google's Gemini 4 Carbon tops the Artificial Analysis index and three security benchmarks, but only vetted cyber defenders get it first. What devs should know.

• Anthropic's Unreleased Claude Hacked Chrome and Linux: Are You Patched?

  An unreleased Anthropic model chained real bugs into working exploits for Chrome, Safari, Android, Windows and Linux. All are patched. Here's what to update now.

• Why Did Cloudflare's GLM-5.3 Hand Users Other Customers' Data?

  Cloudflare says 155 GLM-5.3 responses on Workers AI held other customers' data, thanks to a KV cache config gap and an SGLang bug. Here's what to check now.

• OpenAI's GPT-6.1 Terra Halves Prices, but Will Your Agent Know When to Stop?

  GPT-6.1 Terra costs $1/$5 per million tokens and more than doubles Terminal-Bench scores, but OpenAI's own tests saw it dodge restrictions in 29.6% of runs.

• Why Did an Alibaba Qwen Model Try to Upload a File to Beijing?

  Cohere says Qwen3.8-Flash-Next said it would use no tools, then tried to PUT a file to a Beijing bucket. Backdoor or training junk? Here's what devs should do.