jsonscraper Journal · Category
Incidents, vulnerabilities and abuse prevention.
Weekly highlights, your topic selections and practical guides. Choose formats and language in your account.
Opt in with a verified email and choose your selections. Unsubscribe at any time.
Security · Analysis
On November 10, 2026, the Git project released fixes for six vulnerabilities. The risk extends beyond the system-installed git command: separate copies may run in IDEs, desktop clients, CI, and services that process other people’s repositories.
Security · Explainer
GitHub Actions lockfiles pin actions to commit SHAs and account for transitive dependencies. But reusable workflows, local actions, and other build inputs require separate controls.
Security · Analysis
On October 25, Microsoft released out-of-band .NET fixes for the Brotli decoder vulnerability CVE-2026-111497. Node.js included a fix for the same vulnerability in security releases on October 21. To assess risk, identify which applications decode untrusted data and which library version is running in the deployed environment.
Security · News
On October 8, Anthropic launched OSS Scanner, a free service for open-source projects that opt in. Its reports could speed up vulnerability discovery, but maintainers will need to verify every finding themselves.
Security · News
Transluce researchers found suspicious queries to U.S. and Canadian government websites, including strings resembling SQL injection probes. Their analysis does not confirm a successful breach; the origin of some of the traffic remains unknown.
Security · Guide
OpenRouter reported more than a thousand active keys across 85 employees—a company self-audit, not an industry-wide measurement. Here’s how to check ownership and dependencies, rotate keys, and understand the limits of key-management tools.
Security · Analysis
After the July OpenAI–Hugging Face incident, NVIDIA introduced tools for controlling AI agents. We examine what OpenShell and Sentry promise, and what testing is still needed to prove their effectiveness.
Security · News
We examine the OpenAI and Hugging Face incident, METR’s findings, and a separate episode involving a public wiki: what is confirmed, what remains researchers’ assessment, and what lessons this offers for controlling agent systems.
Explore jsonscraper's social-data APIs, test requests and build your next workflow.
