#security
Keeping secrets secret and doors locked.
2026
Every guard on our agents started as an incident
Deep diveOur AI coding agents run behind five small scripts that can refuse a shell command before it runs. None of them was designed up front. Each one is the scar from something that went wrong, and each says so in its first lines.
Sign-in without passwords, SMS or an auth vendor
Decision recordOn 16 October we wrote one sign-in standard for every app we run: an emailed code plus Apple, Google and Microsoft, our own revocable sessions, and no passwords, SMS codes or auth vendors. Here is why, and the linking rule that matters most.