LayerV AI

TechCrunch Verified account @TechCrunch · 3d

Security researchers found hundreds of servers hosting the penetration testing tool Artex exposed to the internet, allowing anyone access to the hacking tool.
spr.ly/6012BHNcta

View quoted post on X

Craig Hewitt Verified account @TheCraigHewitt · 23h

Dudes @Cloudflare is doing more to secure the internet than any other company right now.

And most of it is free.

View quoted post on X

Tirtha Sarker Verified account @tirthaexe · 3d

If your data privacy matters to you, please read this patiently before your next AI coding session.

Yesterday, OpenAI launched GPT-6 Cyber, a model that helped discover serious vulnerabilities in Firefox and Linux.

BUT also last night, a claude code user reported that their personal email address had been sent to 3rd party websites through HTTP User-Agent headers without their permission.

And here's what's concerning. This wasn't the first report.

The issue of claude code exposing account emails to the model was reported back in JULY.

A contributor to Anthropic's claude code repository explained that they'd introduced a built-in privacy guard in version 2.1.317.

But that guard only checks specific shell commands, and the person reporting the incident was already using version 2.1.318.

So please don't assume updating alone protects everything.

If you're getting started with Claude Code, here are 5 things I'd strongly recommend:

1. Update Claude Code and check /plugins to ensure cc-plugin-privacy is enabled. It blocks certain attempts to send your account email in User-Agent headers, but doesn't cover every possible leak.

2. Open /permissions and REVIEW what you've permanently approved. Especially Bash commands, network requests and MCP tools. Be careful with the "don't ask again" option because some approvals persist across future sessions.

3. Enable /sandbox, but understand what it actually protects. It restricts shell commands, NOT every tool claude can use. WebFetch and MCP tools need their own permission controls. Restrict network access rather than approving every domain.

4. Protect your credentials properly. Your .env files, SSH keys and cloud credentials should not be freely accessible. Configure explicit file restrictions and remove unnecessary secrets from the agent's environment. Simply telling Claude not to read them isn't enough.

5. If you're working with sensitive code or customer data, run claude code itself inside an isolated container or VM with limited network access. Keep production credentials outside that environment and review what the agent is allowed to send externally.

And please don't use --dangerously-skip-permissions casually on a machine containing sensitive information.

This also applies to agents reading websites, repository files and third-party MCP responses. Any of those could contain instructions that try to trick an agent into revealing information.

Telling an AI agent not to leak your information DOES NOT WORK !

You need actual restrictions on what it can read, what it can execute and where it can send your data.

Lastly, I want to remind everyone, your privacy is ultimately YOUR responsibility.

Don't blindly assume that OpenAI, Anthropic or any other AI company cares about your data.

View quoted post on X

DeFi Warhol Verified account @Defi_Warhol · 5d

PASTE THESE 10 SECURITY PROMPTS INTO CLAUDE BEFORE DEPLOYING YOUR VIBE CODED APP:

1. "Map the application's attack surface, trust boundaries, data flows, and privileged operations. Identify realistic attack paths and rank risks by exploitability and impact."

2. "Audit every API endpoint, server action, and database query for broken access controls, IDOR/BOLA, privilege escalation, and cross-tenant data leakage. Write regression tests."

3. "Audit row-level security policies, database roles, storage permissions, and service-role usage. Verify default-deny access and test whether users can read or modify another user's data."

4. "Trace untrusted inputs to sensitive operations. Check for SQL/NoSQL injection, XSS, SSRF, command injection, path traversal, and unsafe deserialization. Provide specific fixes."

5. "Scan source code, configuration, CI/CD workflows, and Git history for exposed credentials. Verify secret isolation, least-privilege access, and rotation procedures."

6. "Review OAuth flows, JWT validation, cookie attributes, CSRF protections, session expiration, token revocation, and account recovery for authentication bypasses."

7. "Identify ways attackers could manipulate payments, bypass quotas, replay webhooks, exploit race conditions, or abuse resource-intensive endpoints."

8. "Audit dependencies, lockfiles, build scripts, and CI/CD actions for vulnerable packages, malicious install scripts, dependency confusion, and compromised build pipelines."

9. "Review cloud IAM policies, public storage, network exposure, CORS, TLS, security headers, environment isolation, and excessive production permissions."

10. "Create adversarial tests for all critical findings, run SAST and dependency scans, verify security logging and alerts, and define blocking release criteria."

What else?

View quoted post on X

Luana 🔜 BreakPoint 2026 🇬🇧 Verified account @Luacantu · 6d

call me crazy but the sexiest thing a man can do is keep his API keys in a .env file, add it to .gitignore & never expose his secrets on GitHub

View quoted post on X