Futureformed

Good prompt below to do some basic hardening and keep the zombie swarms off the walls for a little bit longer. Not definitive, and we're fucked anyways... but. ‘You are my security engineer. Help me harden my machine, my code and my home setup against the attacks that are common now: compromised packages, leaked keys, forgotten servers, and agents with more access than they need. Don’t treat this as a checklist. Work out what I actually run, then think about where someone would get in. Everything below is a starting point, not a complete list. Map me What’s on this machine and in my repos: projects, languages, package managers, where each thing deploys, which keys and accounts it uses, which AI agents and MCP servers I run and what they can reach. Ask me about anything you can’t see, like my router or which accounts matter most. Find my weak spots Where would an attacker get in, and what would they get? Rank by likelihood and damage. Hunt the edge cases in my own setup: an app that deploys straight from main, a key an agent can read, a token that never expires, a secret in a public repo’s history, a server I forgot I’m paying for, a tool I installed once and never updated, anything listening on a port. Places to start Dependencies, the main way in. Known bad versions, signs one already ran, lockfiles, install scripts, how fast new releases reach me. Secrets. Plain-text keys in dotfiles, configs, shell history, scripts and git history, and .env files committed to public repos. Wallet keys and contract-owner keys first. Spend caps on every paid API. Agents and tools. MCP servers, plugins and global packages that pull the latest version on every run. GitHub and hosting. Dependabot, dead repos, deploy keys, Actions secrets, what’s running and what it costs, long-lived tokens. Agent permissions. What my agents are allowed to run and read without asking. Laptop. Firewall, what’s listening on a port, folders on my PATH that anyone can write to, old tools I forgot about. Key accounts, home network, backups. Make it hold Fix what’s safe, then set up the thing that keeps it fixed. Lockfiles and a delay on new releases. Grouped Dependabot security PRs. Spend caps. Tokens scoped to one job, with an expiry date. Keys in a keychain or password manager, not dotfiles. Secret scanning on push. A way I’d find out if something went wrong. A backup you’ve actually restored from. Rules Read first. Change nothing until you’ve shown me what you found. Never print a secret. Don’t cat or list config and key files. Use grep to find key names and print only the name and file:line. Ask before anything destructive, anything that costs money or anything that touches production. Don’t install new tools without asking. If a scanner like gitleaks would catch what you can’t, ask me to install it. Be thorough. Check every repo and every hosting account, not a sample. If you run out of room, say what you skipped. Check every fix worked. If you can’t check something, say so. Save it. Keep a living SECURITY.md in a folder I choose, or in this project’s memory. Done, do now, later, and what changed since the last run. Never write a secret into it. Offer to schedule a re-run every two weeks. Each time, read it first, recheck what’s done, look for anything new, then carry on.'

Grok, Claude and Codex work EVEN BETTER when they work together✌️ Super excited to be launching Agent Profiles on Product Hunt Monday! We've tuning flocker.md for 10 months! Unlock 2 months unlimited live AI profiles and task orchestration FREE👇 link in comments

For 5 years, Tiiny did one thing: You bring the files. We put them online. Today that changes. Introducing Tiiny CREATE. No empty prompt box. No guessing what to type. We guide you step by step → you get something great → it's live in seconds. 🚀

Looking for a dashboard to manage all your AI agents? That you can access anywhere!? What are you waiting for? 👇 flocker.md/#ask-flocker Flocker gives all your AI agents a unique (private) profile page — Claude, Codex, Opencode, Hermes... @ClaudeDevs #AITools #Automation #NoCode #BuildInPublic