... everyone Netfox 0.8.0 is out, and it ships something that came straight from this community: a Prometheus-compatible metrics endpoint. Huge thanks to @angsak6 you asked us to expose Netfox's data to Prometheus so you could chart it in Grafana next to the rest of your homelab. Here it is. Turn it on in Settings Integrations and Netfox serves /metrics in the Prometheus text format. Point Prometheus at it, drop the series into Grafana, done. What it exposes

... Expose Your Competitors

... stays polite to your router. Port history The device History timeline now records when a port opens or closes, so you can see that a dev server ran on :3000 yesterday evening even though it's gone now service exposure over time, not just presence. Port alerts can include this Mac The "new port opened" alert can now optionally cover your own Mac an unexpected listener on your own machine is worth knowing about. On by default once ... ... wrong. Comment from Giovambattista Fazioli(@gfazioli): @micah_preston @maxwell_dean You both nailed exactly why I built it. Most network tools only answer what s open right now? but when something goes wrong, the real question is what was exposed

... Something I built led to a design decision I want to get feedback on. LineageLens is a free VS Code extension that captures every AI code insertion and scores it for risk on a 0 100 scale. Works with Cursor, Copilot, ClaudeCode, Gemini CLI. Zero config on install just start using your AI tools and your insertions start showing up in the sidebar. The scoring is deterministic rules: +28 for credential-like material, +24 for eval/exec patterns, +22 for subprocess ... ... require the prompt to be visible.The practical consequence: if you run only the extension without the proxy backend, your risk scores are 24 points higher for the same code than they would be with full prompt capture. The architecture exposes

... your audit trail can tell you what it actually saw. That is the part I keep coming back to: a flat log is easy to build, but it is not honest enough for mixed-tool AI work. One assistant exposes prompt text, another only gives you metadata, another leaves you with an editor diff. If you flatten that into one record type, you have not built provenance. You have built confidence theater. What I wanted LineageLens to do was simpler ... ... only saw the file diff, say so . If it saw nothing reliable, say that too. That sounds like a small schema choice, but it changes the whole conversation . Suddenly the record is queryable without pretending every tool exposes

... goal isn't met, everyone gets their money back. No harm, no foul. But when app developers try to force this exact model onto standard Shopify stores by offering "automatic refunds for failed campaigns," they inadvertently expose merchants to massive financial liabilities. Here is why the "charge upfront, mass-refund later" model is a ticking time bomb for your Shopify business and how you can test product demand without risking your payment processor account. 1. The Devastating Hidden Cost: Unrecoverable ... ... Fees The biggest secret that competitors

... saved login from import or autofill, it s in the  same on-device vault  as Firefox. Is the vault walled off from the assistant? For vault contents: yes, by architecture. The Oasis Assistant exposes dozens of browser tools (tabs, groups, bookmarks, history search, page summarize, etc.). There is  no   list my passwords, export logins, or vault-read tool in that set. Product-improvement telemetry (anonymous by default) is scoped to  assistant interactions   prompts, replies ... ... cloud.  It means the  password vault is a separate subsystem  from the assistant s context pipeline. Here s the honest boundary table: Scenario Vault Assistant / cloud Passwords you imported from Chrome/Safari/etc. On-device, encrypted Not exposed

... What's the process to secure a vibe-coded app to make sure you haven't done anything silly like left your API tokens exposed in the browser or accessible via the DevTools console? Or to prevent cross site scripting attacks, or ensure forms only accept sanitized inputs that can't be used to manipulate the database. Or that your user authentication is safe and secure and no one is going to be able to login to someone else ... ... Explain risk clearly 4. Suggest practical fixes 5. Prioritize critical issues first Focus especially on: - Broken access control - Authentication flaws - Missing authorization checks - IDOR vulnerabilities (Insecure Direct Object References) - SQL injection - XSS (stored, reflected, DOM) - CSRF - File upload vulnerabilities - Exposed

... building PartFinder a tool that helps manufacturers spot risky parts in their supply chain before they become a problem. You can upload a BOM or parts list, and PartFinder looks at things like lead-time changes, supplier concentration, geography exposure, disruption events, and replacement difficulty. The goal is to show which parts are exposed

... meaning behind them clearer, so humans, CI, automation, and agents can reason about the repo without guessing. If software is going to be built by a mix of humans, CI, automation, and agents, then the repo needs to expose more than source code. It needs to expose

... using AI coding tools, security agents, framework defaults, and modern deployment platforms, I still kept finding serious external security gaps. Not always one-click hack type issues, but the kind of problems that slowly stack up into real risk: - exposed admin/login surfaces - weak or missing security headers - bad TLS/configuration issues - missing SPF, DKIM, or DMARC records - forgotten staging/dev endpoints - open ports that should not be public - outdated services - sensitive files accidentally exposed

... building Verso ( projectoye.com ) A workspace OS that brings Notes, Spreadsheets, Presentations, and an AI-native IDE into one environment. Today did not go as planned. I ran a security audit on the APIs and found that OpenAI keys were exposed. The whole day turned into a deep audit checking every endpoint, every environment variable, every place a key could leak. Not the day I wanted. Exactly the day I needed. For anyone building AI-native products: How are you managing ...

... server, receive webhooks (Stripe, GitHub, Slack) with built-in HMAC verification, test OAuth callbacks, or pair-program against live local code. Multi-route support maps /api to one port and / to another through a single tunnel. For homelabbers: expose Jellyfin, Home Assistant, Nextcloud no port forwarding, no DDNS, no router config. Works behind CGNAT out of the box. For SaaS teams: ship the agent alongside your product. Your cloud gets a stable named endpoint into the client's network ...

... These are baseline controls, not advanced hardening. Why This Matters A C to B range does not indicate a secure system. It indicates a partially configured one. Transport is protected, but execution and domain trust are not. This creates exposure to script injection propagation, clickjacking, data leakage through headers, and domain spoofing for phishing. Cross Platform Pattern This was not isolated to early-stage projects. The same security posture appeared across CMS platforms, AWS-backed applications, serverless deployments, and modern ... ... frontend frameworks. Different architectures, identical exposure

... about shipping fast. A senior engineer glanced at my code and asked: "Is that bucket supposed to be public?" It wasn't. I had copied a configuration from a tutorial and missed one line. One line that would have exposed 50,000 customer payment records to anyone with an internet connection. Caught it 10 minutes before deployment. That night I realized how easy it is to break things in the cloud. One wrong checkbox. One overly permissive IAM role ... ... state actors. Just settings that should have been locked down. The second problem is speed. Developers deploy infrastructure as code every day. Security teams cannot review every change manually. By the time someone notices a misconfiguration, data has been exposed

... scared me the most. Veracode tested 100+ LLMs in 2025 and found 45% of AI-generated code fails security tests. But seeing it in the wild is different than reading a report. One app had Supabase service keys exposed in the frontend bundle. Another stored passwords in plain text because the founder asked for "a login form" and the AI gave them exactly that, minus any actual security. I found apps with no input validation, no rate limiting, auth flows ... ... editing a URL parameter. One app let any user access any other user's data because there was no row-level security. Just vibes. Escape's research team found 2000+ vulnerabilities across 5,600 vibe-coded apps. 400+ exposed

... Recently, we launched Deposure a tool that lets you expose your local service to the internet with a single command. It s designed to make quick testing simple, without DevOps setup or unnecessary configuration. Deposure is especially useful for working with APIs, webhooks, dashboards, and IoT projects. You get a stable public URL that doesn t change on reconnects, which makes local development and integration testing much more predictable. Over the past months, we focused heavily on performance and reliability ... ... Europe, Asia, and Australia to reduce latency and improve connection stability. The CLI client has also been reworked to be lighter and more resilient under real-world conditions. Our goal with Deposure is to provide a clean, developer-first alternative

... stories. So each platform has a different belief system, each one with a large group of fans backing them up: LangChain says: break the world into tools and chains. LlamaIndex says: structure the context from your data. Toolhouse says: expose agentic calls cleanly, then get out of the way. AutoGen says: prompt engineers should be prompt diplomats. So... ? We re still early. Because everyone wants a piece of the pie. Look how many ... ... www.producthunt.com/search?q=MCP No one trusts the abstractions they didn t write themselves. Every framework is a political stance, a philosophy on how to do the "NEW THING" right: Where does context ends and reasoning begins? How much to expose