Security desk

What this is

A study file for an operator who already runs agents with keys. Captured 24 Oct 2026 from posts on 22–23 Oct. Local Mac secrets stay on /keychain. A box the public internet cannot log into stays on /aiagentvps. An agent that can book, send, or spend stays on /gymhack. This page is the index, plus the short list that survived the filter.

One-sentence TL;DR

One key per app per place, a cap on models you never call, a human on revoke, turn off the zombies, and keep the origin address out of public DNS.

The three layers

Layer 1 — Keys and spend

navuud (@navuud) — x.com/navuud/status/2113426191348875510 (23 Oct 2026, 00:24 UTC). ~305 likes / ~541 bookmarks / ~34k views at capture. He had been rotating 150+ keys since the day before. That morning a Gemini key was compromised. The attacker ran up about $2,230 before he caught it and revoked it.

Five things he wished were already true:

1. A watcher on the logs. Theirs checks AWS, Stripe, billing email, and provider usage every 10 minutes. When something fires, it investigates and sends a report on Telegram. A person still revokes.
2. One secrets store for deployed apps. He set up Doppler with one token per app and environment, so rotation is one place. Doppler is his pick. The control is “rotate from one store,” whichever store you already run.
3. Caps on models you never call. The attacker ran Gemini 4 Argon, a model his apps do not use. He says Google lets you cap requests per model per day, so he set the unused ones to 0.
4. One key per app, per place. Their AWS key lived in Railway, GitHub Actions, and a script on the server. Rotating it broke all three. Each place now has its own key, and that key can do one job.
5. A keymaster for the team. One agent issues every key. Each teammate and bot gets a scoped key at run time. That agent is a privileged insider. Same fence as /gymhack and Require Approval: it can draft and report; a human approves issue and revoke.

Replies worth keeping:

• Adam Yong: turn on Railway’s outbound static IP, then restrict each Gemini and OpenAI key to that address. He says Claude supports IP restrictions on the Enterprise plan.
• Steve Simonson: a virtual card per provider, with a limit you can raise on purpose. The card is the ceiling the key does not have.
• ChaosCrux: in the cases he knew, the keys came off Railway, the spend landed on Gemini (Argon or 3.8), and the OpenAI and xAI keys in those accounts were left alone. He put the total he had heard about near $500, separate from navuud’s $2,230.

Do this week, on anything that can call a model or move money:

1. List every place a key is pasted. One key, one place, one job.
2. Set unused models to a daily cap of 0 where the provider allows it.
3. Put a spend ceiling on the card that pays that provider.
4. Allowlist the egress IP where the provider allows it.
5. Watch billing and usage on a short loop. The report comes to you. You revoke.
6. Mac-local keys stay in the login keychain. See /keychain.

Layer 2 — Patch speed and who can see the box

Joel de la Garza, security at a16z (@YODELAGARZA) — x.com/YODELAGARZA/status/2113442391030141112 (23 Oct 2026, 01:28 UTC). ~340 likes / ~300 bookmarks / ~52k views at capture. He sent a “Patch or Die” note to portfolio CEOs the same night.

His frame: vulnerabilities are being found and used faster than before, and agents multiply it. An agent automates the attacker lifecycle. An agent you installed is also an insider. The environment was built to stop outsiders.

What he asked the CEOs to change:

1. Staff security. He says the average enterprise puts about 10% of tech spend on security, and to consider doubling that. Obscurity is over: what can be exploited will be.
2. Zero tolerance for security bugs in a new feature. Slip the launch. Ship the patch first.
3. Double-tap the zombies. Old labs, test environments, CI projects nobody owns. If it is not tied to revenue, turn it off.
4. Stop using “risk accepted” as the way a bug lives forever.

That is portfolio language. Headcount and a doubled budget are a company decision. The operator version of the same week is shorter: a named owner, a due date, and an expiry on anything you decide to live with.

Two replies change the memo:

• Justin Posey argues that when most exploits land on or before disclosure day, the attack surface is the vulnerability. Close the ports, hide the infrastructure, authenticate first. Scanners and agent swarms miss what they cannot see. He cites 87% as that rate; treat the number as his. The practice is the one already written on /aiagentvps: Tailscale-only, no public login prompt.
• Amit Gupta (Konfirmity): a Vanta or Drata dashboard proves that controls exist. It does not prove an unpatched box is off. His quarterly list for those CEOs: a risk register reviewed monthly, every risk with an owner, a due date, and an expiry; a real inventory of what you run, including libraries inside managed images; a human on isolate, rotate, and roll back; someone whose job includes saying no.

His examples from that week, in his words: PHP2Shell was exploited four days before PHP shipped a fix. LiteLLM’s release pipeline was hijacked with developer tokens read from an internal AI gateway’s logs. AWS AgentCore’s image ships its own copy of LiteLLM that never appears in your lockfile. You cannot patch what your inventory does not see. I have not re-verified those three incidents here. The inventory point stands either way.

Do this on the boxes you actually run:

1. Write down every environment that still has a live key. Turn off the ones with no owner.
2. Inventory what the image contains, including dependencies a lockfile will not show.
3. Patch what is reachable and has a public fix. Slip the feature if the patch is the work.
4. Keep the agent box off the public internet. /aiagentvps.
5. The agent that can spend, send, or rotate is an insider. Require Approval on those verbs. /grokbottips.

Layer 3 — The public site

@aeejazkhan (22 Oct 2026, 13:16 UTC) posted a screenshot: “Bro just gave every entrepreneur a cybersecurity degree in one post.” ~6.6k likes / ~12k bookmarks / ~366k views at capture. The image is a Reddit post by u/HardenedWeb-Official on r/Entrepreneurs, “Entrepreneurs with websites, please read this completely and you’ll thank me later.” The account presents as Hardened Web, a security-first web shop. The Cloudflare steps are their default stack. Replies on the tweet called it hosting 101 and told people to diversify CDNs.

Eight tips, compressed. He says he sees a few of them on about 45% of client sites:

1. Put the domain on Cloudflare with the proxy (orange cloud) on before the site is public, then point nameservers at Cloudflare. The origin IP stays out of DNS from day one. Spam bots that only read the A record go to the proxy.
2. Leave that proxy on so the vendor learns your traffic and can turn on under-attack mode later.
3. Keep your own backups. Host restore jobs fail even when you pay for them. A copy on your machine, or an external drive, or another cloud.
4. Old DNS is public. SecurityTrails, DNS History, and a search for “historical DNS” still show an A record you deleted. MX and SPF can leak the same box.
5. Send customer and order mail through a real SMTP service. The default PHP mailer is what inboxes mark as spam.
6. If the site and the host backup are both gone, the Wayback Machine at archive.org is a last-resort rebuild. Tedious. It is a start when your own copy is already gone. Step 3 is the copy you can rebuild from.
7. Update plugins, themes, and scripts. He says compromises he sees start from old software.
8. Never install a nulled or cracked plugin. If you will not pay for one, he says have Claude build a plugin and theme for that site, in a separate project, and ask it to re-check them when new bugs land, then install the update. The separate project is the useful half. “Ask a model” is still code. Review it the same way as any other write access on /gymhack.

For this site the list gets shorter. mikesblogdesign.com is Astro on Netlify. There is no PHP mailer and no plugin directory. Contact links are mailto:. Git is the copy of the site. Netlify is already the front, so an origin IP is not what a visitor’s DNS lookup returns.

The durable control in his step 1 is “the origin address is not the address in public DNS.” Cloudflare is one vendor that does that. A reply from @meditatedmind_ says to diversify CDNs if concentration is the worry. Hiding the origin and picking a vendor are separate decisions. Handing a Cloudflare zone to someone else, when you do use one, is /cloudflare.

Do this for any site that still has a machine behind it:

1. Proxy on before the first public A record. Check historical DNS after you change it.
2. Keep mail and the web box on different addresses when the web box should stay hidden.
3. Hold your own copy. For this repo, that copy is git plus the host you trust.
4. Update dependencies. Paid plugins, or code you review. A cracked zip file is how the old sites get owned.

What we keep vs skip

• Keep: one key per place; caps on unused models; a card limit per provider; an IP allowlist where the provider has one; a watcher that reports; a human on revoke; zombie environments off; an inventory that includes images; the agent box off the public net; your own copy of the site; origin address out of public DNS.
• Verify: the provider actually lets you set that cap or that IP restriction (Claude’s IP allowlist, in Adam Yong’s reply, is Enterprise). Amit’s PHP2Shell, LiteLLM, and AgentCore examples. Justin’s 87%.
• Skip: treating the three posts as one checklist; a GRC dashboard as proof the box is patched; a keymaster agent that can issue and revoke with no human; pasting the new key into chat (/keychain); “ask a model to write the plugin” as the security control; Cloudflare as the only way to hide an origin.

Related on this site

• Fiat vs Bitcoin — where AI hacking risk actually differs, with the sources
• macOS Keychain — keys on this Mac. Labels in chat, secret in the login keychain
• AI agent VPS — one box, Tailscale only, no public login
• Gym hack — an agent with a credential is already inside
• GrokBot tips — Require Approval on send, delete, and pay
• OpenAI × Hugging Face — agents chaining bugs from the inside of a lab
• Not me — public channels vs the private ones
• SSH + VPS · tmux — a different hop, same rule about who can log in
• Cloudflare DNS handoff — giving someone a zone without sharing the account

Primary: @navuud · @YODELAGARZA · @aeejazkhan