pull down to refresh
Hmm not extensively, because it's my personal opsec environment, so I only share results when either I see something that would be good to warn people about - like here - or when I open a PR / issue on the parent repo when it truly is a serious issue.
I can probably make a post on how to set up a good environment, but it depends on having at least some servers or a local docker environment and I am very afraid that when I start talking about having to setup an actions runner, pinning your docker images and writing custom actions to interact with a bot that also runs fully isolated... I will lose 99.99% of stackers immediately. I was thinking the other day that maybe if I can find some time to test Block's new Buzz thing, that I could make a guide for people to adapt and use there - much less friction and a much more popular ecosystem.
Gotcha, yeah Buzz looked pretty interesting.
I’ll zap hard whatever you end up doing, the more eyes on things the better.
Okay, I'll give the Buzz thing some higher priority and if it works well, I'll build something a little less complicated and easily reproducible on that. I have some important work to finish first but, if we can please take it ez on the wallet vulns, it won't take too long to at least form an opinion.
2 notes though:
- I will never share my personal checklists. This is for 2 reasons: (a) probably the most misused claude skills are the security skills and (b) I don't want to be targeted. The whole point of running a sovereign set of bespoke checks is to beat not just stupidity, but actual assholes.
- You have to read the slop! I start my morning reading slop nearly every day because I want to use my best energy for security work and there are days I hurt badly from that.
isn’t the answer multi signature and no single point of failure?
Do you happen to have a post or comment somewhere about your review workflow when pointing LLMs at open source code?