We just shipped an all new version of Framer. Use the built-in agent right on the canvas, or bring your own agent (Claude, Codex or Cursor) to work on your projects. Everything happens on a branch, so you review the diff and merge only when you are ready. Give it a try!

The nice thing is that other tools on your machine can use the same authentication instead of each needing their own personal access token. In scripts, you can use 'gh auth token' to retrieve the access token. Scopes can be expanded using 'gh auth refresh -s ', so you only add broader access when your tools actually need it. You can take this a step further with the gh Go module (github.com/cli/go-gh) that lets you tap into that same authentication programmatically from your own tooling. We did this for our internal developer tools that need GitHub access, so there is no need for engineers to manually generate, configure, or manage separate GitHub personal access tokens.

As an engineer at @framer, one of the things I keep pushing for is reducing the number of credentials that engineers have to manage themselves. GitHub personal access tokens are a good example. They are often scoped too broadly, stored in plaintext in dotfiles, and duplicated in multiple places. GitHub's gh CLI solves most of this. Instead of manually generating a token and pasting it somewhere, you just run 'gh auth login' to authenticate via a browser-based OAuth flow. No token touches your clipboard or shell history. It creates an access token with sane default scopes, stored securely in your OS keychain rather than a plaintext file on disk.

For your business-critical domains, move to a well-established registrar that supports registry locks (CSC, MarkMonitor, Cloudflare). Configure multi-party authorization for unlocking, so no single individual can approve changes. Use role-based contacts, not personal emails. Enforce phishing-resistant MFA. And set auto-renewal with a multi-year buffer. These controls have been around for many years. They are just underused.

You can easily check this for your own domains. Do a whois lookup and check the domain status fields. Statuses starting with "client" (e.g. clientTransferProhibited) are set by the registrar and can be removed by the registrar. Statuses starting with "server" (serverDeleteProhibited, serverTransferProhibited, serverUpdateProhibited) are set by the registry and can only be removed through the out-of-band process described above.

Locking down our business-critical domains was one of the first things I did when I joined @framer 7 years ago. To unlock any of our registry-locked domains, our registrar has to contact each designated representative at our organization by phone and verify a pre-agreed passphrase. Then the registrar goes through a separate verification with the registry operator. No single individual can authorize a domain update, transfer, or deletion on their own.

Most reputable registrars apply a "registrar lock" by default (clientTransferProhibited). This blocks domain transfers unless explicitly removed. The thing is that if the registrar itself or your registrar account gets compromised, an attacker could simply remove the lock. A "registry lock" is different, and much stronger. It sets statuses (serverDeleteProhibited, serverTransferProhibited, serverUpdateProhibited) that not even the registrar itself can override. Removing it requires out-of-band verification between the registrar and the registry operator (e.g. Verisign for .com), through phone calls, pre-agreed passphrases, and identity verification. It is slow and manual by design.

Domain registrars control the nameserver delegation for your domain. That delegation is what makes your product, APIs, email, and everything else reachable. If someone compromises your registrar account, they can transfer or delete the domain, update contact handles, or modify the nameservers. We have seen this play out time and again. In 2024, Squarespace migrated millions of domains from Google Domains. A weakness in their OAuth login flow allowed attackers to compromise accounts and hijack domains.

Domain registrars may be one of the most overlooked single points of failure in our stack. We spend serious time and resources securing our cloud infrastructure and workloads, but our domain registrars rarely get the same level of scrutiny. Even though our domains underpin everything we operate. 🧵

Shipping a pallet from across the planet into Amazon's network: $2,400. Moving it to a FedEx warehouse across the street: $132,000 in egress fees.

What if Y Combinator built GitHub?