A fun test to see how well you do at checking agentic AI permissions: llmgame.scalex.dev
Continue? Y/N
A 30-second game about LLM permission fatigue. How carefully do you really read AI commands?
llmgame.scalex.dev
Clarkio
@clarkio.com
Web dev and app sec things. Here for community, fun and learning. Not here to accrue numbers or influence you.
Your first instinct after getting hit by the TanStack npm attack is to revoke your GitHub token. Don't. The malware polls GitHub every 60 seconds. Gets a 401? It runs rm -rf ~/ Here's the right remediation order before you touch a single credential. youtu.be/YrwM2EFYrUY
Mini Shai-Hulud: The Most Sophisticated NPM Supply Chain Attack of 2026
YouTube video by Snyk
youtu.be
Companies are deploying AI-generated code into production. Much of that code contains vulnerabilities. Making traditional AppSec struggle to keep up Snyk + Anthropic's Claude = security at AI speed 👇 snyk.io/news/snyk-embeds-anthropics-claude-to-advance-ai-powered-security-for-software-development
Snyk Embeds Anthropic's Claude to Advance AI-Powered Security for Software Development | Snyk
Starting today, Snyk has integrated Claude into the Snyk AI Security Platform — powering automated vulnerability discovery, prioritization, and developer-ready fixes across code, dependencies, contain...
snyk.io
Been getting messages asking how I use Codex in my projects. Finally made a video about it! I break down my entire workflow and share the tips and tricks that make the biggest difference in my daily coding. Hope it helps 👍 🎥👇 youtu.be/mP-GiOihhM0
Can your AI code gen model/tools of choice generate a proper Content Security Policy that allows everything to still work properly?
AI is transforming how we build, deploy & secure software. Learn how to empower innovation without compromising security at #DevSecCon, the Global Community Summit on AI Security. Details: 💻 Virtual 🗓️ Oct 22, 2025 🔗 snyk.io/events/devseccon
If you’re using Windsurf and not adding MCP servers you’re missing out on serious power. I’ll show you how to add them from the store and manually (including Snyk!) Full video 👇 youtu.be/exGudnPb9Bo
I asked Claude Sonnet 4.5 to build a secure Node.js note taking app from scratch. The results surprised me! Watch here 👇 youtu.be/YBl0BR3fgjA
Stop using .env files for your API keys. They’re not safe anymore. Here’s why and what to do instead 👇 youtu.be/pcbRwwaCPUg
Spec-driven development + AI = the future? 🤔 I explored Amazon’s new Kiro IDE paired with Claude Sonnet 4 to find out. Watch and tell me if you’d code like this 👇 🎥 youtu.be/YpB1QS58KZE
I put Replit to the test and was honestly shocked by the outcome. If you care about what AI coding tools can (and can’t) do, you’ll want to see this. 📹👉 youtu.be/gHGB3kptH_s
This has been a fun loop🤪 Agent: Everything is done let me run the app Terminal: App running Agent: Perfect! Let me test it with curl *kills app for curl* Agent: Let me start the server again and test it Terminal: App running Agent: Perfect! Let me test it with curl
When it comes to AI/LLMs I aim to have a balanced perspective on it. There are times I'm delighted by what they do and other times I'm unimpressed. Today I felt a bit unimpressed...
How to Add MCP Servers to VS Code by @clarkio.com youtu.be/50tkvZhOVqM?...
How to Add MCP Servers to VS Code (with GitHub Copilot)
In this tutorial, I’ll walk you through the step-by-step process of adding MCP servers to Visual Studio Code using GitHub Copilot. Whether you’re setting up your first MCP server or integrating…
youtu.be
y'all are sleeping on npq ✨ Step 1: $ npm install -g npq $ alias npm="npq-hero" Step 2: *no more malicious packages hurting you ;-) *well, much lower risk based, nothing is absolute
VS Code Live: Agent Mode Day is tomorrow, April 16th! And we've got a special guest joining us - @wesbos.com will be closing out the stream with a live coding session! You won't want to miss this. Stream starts at 9 AM PT: youtube.com/live/HNly8eN...
Agent mode is rolling out to all users! 🔁 Autonomous code editing 🔍 Full codebase awareness 💬 Built in tools for codebase search, terminal, fetching website content and more All extensible via MCP & VS Code Extensions. All available today. Learn more:
Agent mode: available to all users and supports MCP
Agent mode is now available to all users and supports MCP.
code.visualstudio.com
haha Brian is just hilarious 😂 checkout the new video about Claude 3.7 and whether it's actually better for generating secure code: www.youtube.com/watch?v=zM8c...
We've just published the 19th and final chapter of the 2024 Web Almanac on JavaScript by Abdul Haddi Amjad and Nishu Goel. almanac.httparchive.org/en/2024/java...
JavaScript | 2024 | The Web Almanac by HTTP Archive
JavaScript chapter of the 2024 Web Almanac covering the usage of JavaScript on the web, libraries and frameworks, compression, web components, and source maps.
almanac.httparchive.org
Agent mode (preview) is here for GitHub Copilot in VS Code! In agent mode in Copilot Edits, Copilot can now iterate on its own output, execute terminal commands, and even self-heal from runtime errors. Try it in VS Code Insiders: https://code.visualstudio.com/updates/v1_97#_agent-mode-experimental
@jsr.io is now openly governed — meet its board members and check out its governance charter 👇 deno.com/blog/jsr-ope...
Introducing the JSR open governance board
JSR, a modern open source JavaScript registry, is meant for the greater JavaScript and TypeScript community. We're thrilled to announce its own independent governing body.
deno.com
Folks making videos, don't tell your audience to leave a comment/question where you'll reply with your answer and then don't reply to any of them. Of course, there are some exceptions to this like trolls or hate comments...
Does anyone here enjoy the game "Words on Stream" and tune in to streamers playing that or channels that run it 24/7? Link to the game for those not familiar with it: wos.gg
WOS - Words On Stream
Words On Stream, the free game that will boost your live streams on Twitch or YouTube
wos.gg
I was walking and talking on a call and my back just randomly goes out. Short quick sharp shot in the back. Boom! Ow! What the heck?!
Today has been a good "catch up from the break" day while also sticking to my routine. Feeling good 💪
Securing your GitHub repo is critical! Here are 10 tips: • Enable 2FA 🔒 • Limit access 👥 • No secrets in code ❌🔑 • Scan w/ Snyk 🛠️ • Audit logs 🔍 • Automate updates ⏩ • Protect branches ✅ • Rotate tokens 🔄 • Enforce signed commits ✍️ • Train your team 🌱 More tips:
10 GitHub Security Best Practices | Snyk
Learn more about 10 GitHub Security Best Practices to be more secure as a GitHub user or contributor.
buff.ly
Tomorrow marks 7 years of live streaming! Whew! 😅 I learned a lot over that time and will be reflecting on it during today's stream. Tune in around 1pm ET. Hope to see you there 👍 twitch.tv/clarkio or youtube.com/clarkio/live