共 15 篇文章
An independent security and reliability review of cc-connect, covering chat-account compromise, allowlists, admin commands, yolo mode, work directories, shell and cron, attachments, web admin exposure, provider credentials, isolation, and release caveats.
A factual review of browser-only repository analysis across public, private, and local modes, with focus on token scope, vendored dependencies, scanner limits, dynamic import blind spots, and a safe trial plan.
An English security guide to OpenCode 1.x configuration, provider auth, model ID drift, Bun-installed plugins, and the boundary between official OpenCode and third-party harnesses like Oh My OpenCode / Oh My OpenAgent.
A security-minded review of Aliens Eye: what its 840-plus-site username scan can establish, what it cannot, and how to keep OSINT collection authorized and auditable.
A practical checklist for evaluating browser-extension income claims: revenue quality, users, conversion, refunds, tax, policy, support, security, dependencies, and a 30-day evidence test.
A security-focused review of wigolo covering local cache, keys, SSRF guards, robots, rate limits, tokenized serving, blocked challenges, and safe agent boundaries.
A security-first OpenCodex guide covering credentials, routing authority, account pools, logs, exposure, and recovery boundaries.
A practical English review of Hermes Agent v0.19, focused on secret delivery, deny rules, profile routing, delivery records, transcript handling, and safe session export.
A security-focused Docker guide covering rootless mode, non-root containers, privileged mode, docker.sock, port exposure, image pinning, and secret handling.
A security-focused review of Casdoor covering multi-tenancy, OAuth/OIDC and SAML failure modes, SCIM tokens, MFA recovery, webhooks, databases, and agent authorization boundaries.
A practical evaluation guide for croc, focused on temporary cross-device file transfer, operating boundaries, failure behavior, and production readiness.
World Monitor can be self-hosted, but production use requires private Redis, authenticated relay, data-health checks, and agent API governance.
tempmail.ee helps reduce inbox exposure during low-risk signups, but disposable email should be treated as a boundary tool rather than an identity system.
The useful question is not whether acme.sh can issue a certificate, but whether renewal, DNS credentials, deploy hooks, reloads, logs, and recovery are governed.
peerd is best read as a browser-agent governance sample: local custody, actor isolation, egress control, scoped grants, and auditability before autonomy.