GitHub Actions is the weakest link: https://nesbitt.io/2026/04/28/github-actions-is-the-weakest-link.html

At this point having zizmor scans of every python package is turning out to be quite the crystal ball: https://www.stepsecurity.io/blog/elementary-data-compromised-on-pypi-and-ghcr-forged-release-pushed-via-github-actions-script-injection

elementary-data in my db: 203 zizmor findings total. 82 template-injection (High), 47 unpinned-uses, 4 dangerous-triggers, 2 github-env, and 1 bot-conditions.

31 new CVEs on openclaw this morning, I'm going to need to update my slides again: https://days-since-openclaw-cve.com/

Researching Clawhub for a conference talk at the moment.

It’s like they are speed running every package manager security flaw from the past 20 years 😅

Package Security Problems for AI Agents: https://nesbitt.io/2026/04/08/package-security-problems-for-ai-agents.html

What does Open Source mean? https://nesbitt.io/2026/04/04/what-does-open-source-mean.html

Instead of using git as a database, what if you used database as a git?

https://nesbitt.io/2026/02/26/git-in-postgres.html

xkcd.gif