Roderik van der Veer’s Post

A friend was about to make his Django project public. I checked the commit history before he pushed. Six weeks earlier, he'd put a Stripe secret key directly in settings.py. He removed it two commits later and never thought about it again. The current code was clean. But the git history had the full key, right there. The repo had been accessible for six weeks -> plenty of time for any automated scanner crawling GitHub for exposed keys to find it and try it. History scanning is on by default partly because of that conversation.

Why your "perfect" code is returning a 404 (and it’s not a typo). 🛑 I’ve been heads-down building SprintSync AI, an automated engine that translates raw Git Diffs into high-level sprint updates for teams. Yesterday, I hit a wall that every dev knows: the code is correct, the logic is sound, but the API says “I don’t exist.” I was trying to fetch code comparisons from private repos via the GitHub API. First, I hit ENOSPC because Next.js was generating more cache than my system could handle. Then, I hit the 404/403 loop. The Lesson: In the world of GitHub's new "Fine-grained" tokens, a 404 doesn't always mean "Not Found." Often, it's a security 404—GitHub is hiding the resource because it doesn't think you have the right to know it exists. How I solved it: Cleaned the pipes: Flushed the .next cache and pruned my Docker images to give the compiler room to breathe. Permission Pivot: Traded the finicky Fine-grained tokens for a Classic PAT with scoped repo access. The "Bearer" Fix: Ensured my headers were explicitly using the right authorization syntax. The Result: SprintSync AI is now pulling real-time, authenticated code changes into a clean AI-summarized dashboard. If you’re building with the GitHub API, don't let a 404 gaslight you. Check your token scopes first! #MicroSaaS #NextJS #GitHubAPI

Your Node.js CI pipeline might be silently leaking credentials right now, and your logs won't show a thing. The recent Axios supply chain attack (March 2026) proved that the default configurations of GitHub Actions and GitLab CI create a complete exfiltration kill chain. It relies on three compounding defaults: -> secrets live before any gate fires; -> "npm install" silently runs arbitrary code; -> egress is wide open. You can verify your exposure today with three simple checks: 1. The Secret Check: Output your environment variables at the very start of a job. Notice how many secrets are already live. 2. The Execution Check: Audit your transitive dependency tree for "postinstall" scripts running silently without your explicit approval. 3. The Egress Check: Verify if a simple Node.js HTTP POST request to an external domain succeeds from your runner. If all three pass, your pipeline is an open vault. Read the full structural breakdown and the remediation ladder here: https://lnkd.in/eGbvVrht #DevSecOps #SupplyChainSecurity #nodejs #cicd

If you've checked HackerNews or Lobsters this morning you'll see that GitHub has finally launched a stacked pull request in private preview. The long-awaited coding workflow is wait-list only at the moment, but that hasn't stopped devs and users from weighing in. The full story is on The Stack now. https://lnkd.in/e6m8qPP8

I just deleted 179 GitHub repos in 15 minutes with Copilot CLI (yes on purpose). Like most developers, I had years of accumulated repos. Forks from 2015. Test projects named catpawtest4. Angular 2 demos that haven't seen a commit in nearly a decade.  300 repos total. It was time.  I used GitHub Copilot in the CLI to: - Inventory all 300 repos with metadata (language, stars, last push, fork status) - Categorize them into Keep, Update, and Delete 👀 Walk me through the delete candidates 10 at a time for review - Parallel-delete 179 confirmed repos in ~2 minutes 🔄 Sync every remaining fork to its upstream The part that stood out: I stayed in control the entire time. Copilot didn't just suggest — it built a workflow. Paginated review, tracked my decisions in a database, asked for auth scope when needed, and executed deletions 10 at a time. This is what AI-assisted developer tooling looks like in practice. Not replacing judgment — amplifying it. I made every keep/delete decision. Copilot handled the tedious parts at scale. RIP to a decade of "I'll clean this up later." 🧹  #GitHubCopilot #DeveloperProductivity #AI #GitHub #DevEx

Just shipped an update to aicommit. What’s new: - Works with both Codex and Claude Code - Smarter provider selection with explicit --provider codex|claude - Better end-user docs The goal is simple: make AI-assisted commit messages easier to use in real developer workflows, without locking anyone into a single coding CLI. Install: npm install --global @ahalberkamp/aicommit Usage: aicommit aicommit --provider codex aicommit --provider claude Repo: https://lnkd.in/dbmj2wnY #opensource #javascript #nodejs #cli #git #developertools #ai #codex #claudecode #productivity

3 things developers need to know about the Claude Code leak, and how to make sure it never happens to you: It wasn't a hack. Bun generates source maps by default, and Anthropic's npm package bundled the full TypeScript source alongside the compiled code. One missed config, 512,000 lines exposed. The scope is massive. 1,900 files. 44 unreleased feature flags for features fully built but not yet shipped. The full engine: streaming, tool-call loops, permission models, retry logic, all of it in plain TypeScript. It's already mirrored. Anthropic pulled the package. Didn't matter. GitHub repos had copies within hours. If you're shipping npm packages, do these three things before your next publish: Run npm publish --dry-run and read the full file list. Anything ending in .map shouldn't be there. Add a .npmignore and explicitly exclude *.map files as a second line of defense. And if you're using Bun, set sourcemap: "none" in your build config for production builds. Source maps are invaluable in dev. In a published package, they're your entire codebase.

350 Tests Passed! 🚀 (And 4 to Go...) After setting up CI/CD with GitHub Actions, our test suite just hit 350 passing tests! But here's the thing about software development - you're never truly done. We've got 4 tests still failing (LinkedIn integration, we're looking at you 👀), but that's part of the journey. What worked well: - GitHub Actions for automated testing on every push - PostgreSQL and Redis services in the CI pipeline - Environment variables with dummy data for OAuth providers - Coverage reporting to track our progress What we learned: - Always check your `DATABASE_URL` vs individual database variables - Use `localhost` in CI, not service names like `postgres` - Keep dummy values for all OAuth providers (Google, LinkedIn, etc.) - The `.env` file should stay in `.gitignore` - use GitHub Secrets or dummy values for CI The final 4 tests?They're LinkedIn-related and need proper mocking. But that's tomorrow's problem. Progress over perfection. 350 > 0. 🎯 Abel Marube #Django #Python #GitHubActions #CI/CD #Testing #SoftwareDevelopment #DevOps #analyticsmeta

I'm open-sourcing my personal code style and philosophy on GitHub, primarily focused on the TypeScript and React ecosystems. Most of these principles aren't novel (I've done my best to attribute sources), but I'm hoping this thoughtful composition and structure is a value-add. The documentation is designed for human-readability, but optimized for LLMs. Rules are terse and scannable so they stay cheap in a context window. The deeper rationale is split into sibling ".why" files, so a model (or an engineer) only loads it when a rule actually needs defending or bending. Let me know what you think, and feel free to fork for your own use cases! https://lnkd.in/ecUc5nRd

Paste any #GitHub #URL → get an interactive #architecture map of the entire codebase. No install. No account. No build step. It’s called #CodeFlow—and it’s literally a single HTML file. Open it, drop a repo link, and in seconds you get: → Interactive #dependencygraph → Blast #radiusanalysis for any file → Code #ownership from git history → Built-in security scanning → Pattern detection (factories, hooks, god objects, etc.) → Codebase health score (A–F) → Activity heatmap of commits → PR impact analysis 👉Everything runs locally in your browser. 👉Your code never leaves your machine. 👉Even private repos work—just add your GitHub token (stored in memory, cleared on close). 43 stars. One file. MIT licensed. Sometimes the simplest tools are the most dangerous.