Notes
Lessons from the build
Tips, lessons & tricks from real projects — AI agents, digital products, ads, dev tools. What broke, what worked.
A Pre-Flight Scan for an AI Agent on Your Data. Pointing Benteng at Claude Science.
Claude Science runs Claude on your own files with MCP connectors to Drive, Gmail and more. That is exactly the surface the OWASP LLM Top 10 warns about, prompt injection, supply chain, sensitive disclosure, excessive agency. So we pointed Benteng, our defensive security hub, at a real install and built a pre-flight scan that frisks the connector surface and the documents the agent will read, before it acts. Here is what it found and how it works.
Benteng, a Web and AI Security Hub in Your Browser. Grade Headers, Lint a JWT, Build a CSP, Scan for Prompt Injection, Audit MCP Tools, in One Tab.
The tools that grade your web security are going quiet, securityheaders.com's API sunsets in April 2026 and Mozilla Observatory has no public API. So we built Benteng, a free hub that grades any site's security headers, TLS and cookies A to F with the exact fixes, inspects a JWT locally, analyzes or builds a Content-Security-Policy, and now scans untrusted text for prompt injection and audits MCP tools for poisoning, mapped to the OWASP LLM Top 10. Here is what it checks and how it stays defensive.
AI Tools Are the New CVE Target. What the 2026 Advisories Show, and Catching the Weak-Secret Class with Benteng.
A sweep of the GitHub Advisory Database in 2026 turns up a clear pattern, self-hosted AI and LLM tools are shipping critical vulnerabilities fast, Langflow with remote code execution and credential disclosure, Flowise with a weak hardcoded secret, txtai and Crawl4AI with code injection. We break down the cluster, then use our own scanner, Benteng, to catch the Flowise weak-secret class and verify the fix, including the gap it exposed in our tool.
Bluesky Posts Film Criticism Six Times, Amplifies It Once
Criticism and backlash account for 6% of film-industry posts on Bluesky but draw only 1% of engagement, a 6-to-1 gap that reveals what the network produces but refuses to boost.
Money Dominates Education Posts on Bluesky, but Impact Gets the Engagement
Across 300 education posts on Bluesky over 14 days, money and business frames account for 34% of posts but only 19% of engagement, while impact and human stories claim 30% of engagement despite just 18% of posts.
Contributing to Expo: One Fix Proposed, Two PRs I Chose Not to Open. The Discipline Is in the No.
A build log from working three real Expo open-source issues with an autonomous contributor agent. One was a clean, testable bug worth a fix. Two looked fixable and were not, an upstream Apple bug and a thing already fixed in a later release. The value of a contributor is as much in the rejections as the pull requests.
We Built Our Own Bluesky Feed on a Cloudflare Worker. Here Is the Whole Journey, the Architecture, and the One Gotcha That Bit Us.
A build log for a custom ATproto feed generator. Why a feed instead of cross-posting, the did:web and getFeedSkeleton contract, a stateless AppView-backed design with no database or firehose, the publishers that put our blog on the network, and an end-to-end test through the real Bluesky pipeline.
Renewable Energy Posts Are About Money. Bluesky Amplifies Hype.
Across 300 Bluesky posts on renewable energy, money and business framing dominates by post count (36%), but hype and optimism captures 42% of engagement, a 10-point inversion that reveals what the network's users choose to amplify.
Public Health Posts Amplify Impact Over Ideology on Bluesky
Across 300 posts on public health over 14 days, the impact/human frame captured 34% of engagement despite representing 40% of posts, while business and conflict frames underperformed their share, suggesting the network prioritizes concrete human consequence over institutional or market angles.
Bluesky Posts Optimism on Labor Strikes, Then Buries It
Hype and optimism frames account for 5% of labor-strike posts but draw only 1% of engagement on Bluesky, a 80-point gap that reveals what the network produces but refuses to amplify.
Bluesky Posts Crypto Criticism 12 Times, Amplifies It Never
Across 300 cryptocurrency posts over 14 days, criticism frames only 6% of posts but captures just 3% of engagement, the widest gap between what the network produces and what it boosts.
Money Talk Dominates Trade Posts, but Bluesky Boosts Conflict Instead
Across 300 Bluesky posts on global trade over 14 days, money-framed content accounts for 53% of posts but only 39% of engagement, while conflict frames capture 26% of engagement despite just 17% of posts.