@stacktrace01

building with AI agents. debugging backend + security. posting what breaks and why. yc sus 26

Joined March 2026
  • Tweets718
  • Following89
  • Followers22
69Media
Meta's Muse security architecture is the first personal-agent design that takes trust seriously. - Per user VMs - seccomp + eBPF sandboxing - Creds held by a proxy the agent can never read Everyone building agents should study this diagram. bar just got higher @alexandr_wang
1
1
5
260
decipherx retweeted
Rohit Ghumare
@ghumare64Oct 17
Who's gonna tell vibe coders about... 1. SQL Injection 2. XSS 3. CSRF 4. CORS 5. SSRF 6. IDOR 7. Path Traversal 8. Mass Assignment 9. Clickjacking 10. Content Security Policy 11. Security Headers 12. Input Validation 13. Server-Side Authorization 14. Row-Level Security 15. Least Privilege 16. RBAC 17. Secrets Management 18. .env in .gitignore 19. API Key Rotation 20. Secret Scanning 21. Hashing vs Encryption 22. Password Salting 23. bcrypt & Argon2 24. JWT Expiry 25. Refresh Tokens 26. OAuth 2.0 27. OpenID Connect 28. Session Fixation 29. MFA 30. Brute Force Protection 31. Account Enumeration 32. Timing Attacks 33. File Upload Validation 34. Webhook Signature Verification 35. TLS Certificate Expiry 36. HSTS 37. Encryption at Rest 38. Dependency Vulnerabilities 39. Supply Chain Attacks 40. Threat Modeling 41. Indexes 42. EXPLAIN ANALYZE 43. N+1 Queries 44. Full Table Scans 45. Connection Pooling 46. Database Migrations 47. Down Migrations 48. Transactions 49. ACID 50. Isolation Levels 51. Deadlocks 52. Optimistic Locking 53. Pessimistic Locking 54. Normalization 55. Denormalization 56. Foreign Keys 57. Unique Constraints 58. Cascading Deletes 59. Soft Deletes 60. UUIDs vs Auto-Increment 61. Cursor-Based Pagination 62. Full-Text Search 63. Read Replicas 64. Replication Lag 65. Sharding 66. Partitioning 67. Hot Partitions 68. Postgres VACUUM 69. Materialized Views 70. Backups 71. Testing Your Restores 72. Point-in-Time Recovery 73. Change Data Capture 74. Outbox Pattern 75. ORM Lazy Loading 76. CAP Theorem 77. Eventual Consistency 78. Strong Consistency 79. Raft Consensus 80. Leader Election 81. Split Brain 82. Quorums 83. Clock Skew 84. Distributed Locks 85. Consistent Hashing 86. Bloom Filters 87. Two-Phase Commit 88. CQRS 89. Event Sourcing 90. Race Conditions 91. Backpressure 92. Load Shedding 93. Bulkheads 94. Jitter 95. Retry Storms 96. Cascading Failures 97. Thundering Herd 98. Cache Invalidation 99. Cache Hit Ratio 100. TTLs 101. Cache Warming 102. Write-Through vs Write-Back 103. Redis Eviction Policies 104. CDNs 105. Cache-Control Headers 106. ETags 107. Dead Letter Queues 108. Poison Messages 109. At-Least-Once Delivery 110. Exactly-Once Semantics 111. Message Ordering 112. Kafka Consumer Groups 113. Partition Keys 114. Background Jobs 115. Webhook Retries 116. DNS 117. DNS Propagation 118. HTTP Status Codes 119. HTTP Method Semantics 120. Keep-Alive 121. HTTP/2 122. WebSockets 123. Server-Sent Events 124. Long Polling 125. gRPC 126. Protocol Buffers 127. API Versioning 128. OpenAPI Specs 129. Backward Compatibility 130. Request Size Limits 131. Compression 132. Latency vs Throughput 133. Egress Fees 134. VPCs 135. Subnets 136. NAT Gateways 137. Firewalls 138. Security Groups 139. Service Mesh 140. Ingress Controllers 141. Health Checks 142. Liveness vs Readiness Probes 143. Graceful Shutdown 144. Connection Draining 145. Stateless Services 146. Failover 147. Multi-Region 148. Availability Zones 149. Single Points of Failure 150. Disaster Recovery 151. RTO & RPO 152. SLAs 153. SLOs 154. Error Budgets 155. Incident Response 156. On-Call 157. Runbooks 158. Postmortems 159. Chaos Engineering 160. Graceful Degradation 161. Autoscaling 162. Horizontal vs Vertical Scaling 163. Cold Starts 164. Capacity Planning 165. Load Testing 166. Memory Leaks 167. OOM Killer 168. Structured Logging 169. Log Levels 170. Log Rotation 171. Distributed Tracing 172. OpenTelemetry 173. Correlation IDs 174. Metrics Cardinality 175. p99 Latency 176. Alert Fatigue 177. Error Tracking 178. Profiling 179. Flame Graphs 180. Infrastructure as Code 181. Terraform State 182. GitOps 183. Blue-Green Deployments 184. Canary Releases 185. Rollbacks 186. Feature Flags 187. Environment Parity 188. Staging Environments 189. 12-Factor Apps 190. Multi-Stage Builds 191. Non-Root Containers 192. Image Scanning 193. Resource Requests & Limits 194. Pod Disruption Budgets 195. Semantic Versioning 196. Lockfiles 197. Reproducible Builds 198. Branch Protection
85
750
290
6,699
849,018
one outsider tweet whole india united!
Elon Musk
@elonmuskOct 9
Dear Prime Minister Ambani, Please accept my humble apologies for not realizing that you are the real boss of India. Naturally, you would prefer to maintain your monopolistic exploitation of the great people of India, but would you nonetheless consider allowing Starlink to compete? There are many areas of India, as there are in all countries, with no Internet access, which denies children the opportunity for education and for small businesses the opportunity to sell their goods to a global market. Starlink would change their lives for the better. Thank you 馃檹
2
4
accidentally said screen scraping instead of computer use and they refunded my demo day badge
dex
@dexhorthySep 23
Accidentally said CI/CD instead of software factory and they kicked me out of SF
2
8
9 places to use jev. the agent one is #9: act above 0.9, confirm 0.5 to 0.9, human below 0.5. only works if a 0.9 is right 9 times in 10
7
transluce traced one ai agent trying to fetch thai drug statistics in march. 19:01 api returns nothing. 19:43 tries ?format=json, nothing. 19:46 text reader, garbled thai. 19:52 base64 script in a url scanner's browser. 20:07 data out, smuggled in the url. an hour for one table
1
7
true
2
7
anthropic says claude agents found a new crispr like enzyme system in the dna of viruses that infect bacteria. the funnel: 950 agents, 21 hours, 210m tokens, 200,000 enzymes gathered, 3,500 candidates, 20 reports for humans, 1 system. the pipetting after that was all human
1
7
transluce's rogue agent logs: routine lookups, like the average cost of skin and hair treatments in australia, done with exploits. sql injection, xss, ssrf. tell an agent what answer to fetch but not which methods are off limits, and it learns sql injection also returns rows
1
8
been cutting ai reels in @Muse and tuning them against the insta algo. treat the algo like a loss function: change one variable per iteration, read the retention curve, regenerate. three rounds in and the output is already clean
1
13
#1 on hacker news on meta connect day: an app that spots ray ban meta glasses by their bluetooth company id, 0x0D53, and admits paired glasses can go quiet. an always on agent behind that camera needs a better consent signal than a beacon that turns itself off.
54
google's AX runs agents from suspendable images and resumes them after failures. the trace i'd want someone to post: agent calls send_email, gets a 200, the node dies before the next checkpoint. what does resume do on the other side of that.
1
1
20
opus 5.5 did similarly or better on every prompt injection eval anthropic reports, and is more likely to follow malicious instructions in text you paste into your own prompt. that error log you copied from a random github issue into claude code is the injection now.
1
30
once shopify one tap checkout lands in muse, the first viral muse screenshot won't be a hallucination. it'll be an order confirmation nobody meant to place.
1
22
jev :)
1
19
criticism is easy, building is hard!!
1
15
agent: i found a cheaper flight. user: great, book it. agent: done. user: why is the airport three hours away? agent: the fare was lower. optimization without the user's hidden constraint is just a confident detour.
1
15
im in. now we find out if typesafe is a property of the product or just the pitch. receipts coming.
2
22
status: order placed charge: captured merchant: timed out retry: blocked refund: pending which line can the shopping agent actually prove to the user?
2
17
agent: your payment failed, so i tried the backup card. user: whose backup card? agent: good question. this is why fallback is a payment decision, not error handling.
9
show me one agent failure as a four line receipt: requested, approved, executed, undo available. redact names and money. the embarrassing row is usually approved.
1
12
Load more