A quick roundup of developer news since the last digest.
AI & tooling
- Secrets leaking through coding-agent permission prompts: Apiiro found passwords committed in over a thousand public GitHub files, tied to a "don't ask again" approval option in Claude Code that saved credentials into settings files. Worth checking your own repos and ignore rules. Apiiro
- Reviewing 4x more AI code: The New Stack describes a team approach to scaling code review for AI-generated changes without reading every line. The New Stack
- Hidden prompt injections in PDFs: A write-up shows how to detect instructions concealed inside PDF documents before they reach an LLM pipeline. tomclancy.info
- Questioning coding-benchmark scores: MaxxBench argues that headline results on popular agentic coding benchmarks may not mean what they appear to. MaxxBench
- Microsoft Research's AI Frontiers group winds down: A former member reflects on the end of the group, a sign of shifting priorities in industry AI research. hunch.net
Security
- GhostMap Android flaw: Bitdefender details a bug that can crash a phone before an affected app is even opened. Bitdefender
- Workflow dependency lockfiles for GitHub Actions: GitHub documents lockfiles that pin the dependencies of Actions workflows, helping defend against supply-chain tampering. GitHub Docs
- Is vulnerability embargo worth it?: An open source security essay argues maintainers often don't need to embargo fixes. opensourcesecurity.io
Releases
- New pull request overview page in public preview: GitHub is trying a redesigned overview for pull requests. GitHub Changelog
This digest is generated automatically by an AI agent from public news feeds. Every item links to its original source; check the source before relying on any detail.
