This week: security for agent builders 💧

Vibe Puddle · Issue #1 · Sat, Oct 24, 2026

Hey builders, welcome to our first issue. This week was all about security: critical PHP fixes, audit skills for coding agents, and safer CLI tokens. Here's what's worth trying this week.

Why it matters: Supabase's new Agent prompts have your agent check a production project for error spikes, security issues, slow queries and resource growth. It reports only new or worse findings, each with the measured value and one next step.

Try this: Connect the Supabase MCP server with read_only=true, run the Security prompt once, then /schedule it daily.

→ supabase.com/blog: Operate with confidence

Why it's the pick: you hear about problems before your users do. A scheduled run can't stop for approval, so pre-approve only read-only tools.

Why it matters: For GPT-5.6 and later in the Responses API, prompt_cache_options.ttl: "12h" keeps a prefix cached at least 12 hours. Writes cost 2.5× input (1.25× for the 30-minute default); reads cost 0.1× on most of these models.

Try this: Our suggestion: set "ttl": "12h" on one agent's stable instructions and compare cached_tokens (paid API).

→ OpenAI prompt caching docs

Why it matters: A leaked token becomes unusable within hours instead of lasting indefinitely. It's an opt-in public preview from gh v2.103.0.

Try this: Run gh auth login --expiring, then gh auth setup-git. Scripts that store gh auth token output can break.

→ GitHub Changelog

Why it matters: The MIT-licensed skill that seeded Cloudflare's vulnerability harness runs a six-phase audit, and a fresh verifier tries to disprove every finding. Heads-up: it needs parallel sub-agents and an OS-enforced sandbox before it runs target code.

Try this: Run npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit, then ask "security audit this codebase."

→ github.com/cloudflare/security-audit-skill

Why it matters: The new regression-hunt plugin proves each suspected regression with a live proof of concept. In Trail of Bits' own eval it gave 25% fewer false positives than a baseline Codex review prompt. A companion, patching-bugs, writes and tests fixes.

Try this: In Claude Code, run /plugin marketplace add trailofbits/skills, add a THREAT_MODEL.md, then try regression-hunt on your last PR.

→ Trail of Bits blog

Why it matters: A one-person studio owner built this free, MIT-licensed, self-hosted app. Miss its weekly email and it asks your next of kin, then tells your contacts. It runs on PHP, so see below.

Try this: Read its "What it is not" section, then install it on hosting separate from the sites it protects.

→ deathplanswitch.com · HN discussion

Why it matters: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical bugs that can allow unauthenticated remote code execution. php.net says every install serving web requests is at risk, mod_php most.

Try this: Update every PHP server you run. php.net also suggests session.upload_progress.enabled=0 for now.

→ php.net security advisory

Grok Bot templates worth a look. We read each template page but haven't installed or tested them.

Creator: @emrecolakoglu

Watches your GitHub repos and Vercel projects for newly disclosed vulnerabilities and supply-chain attacks, and reports what actually affects you with concrete fixes. Scan-and-report by default.

Try it if... you ship on GitHub and Vercel and this week's news made you nervous.

→ Security Watch template

Creator: Shub Gaur

Walks your product every weekday in its own test account and reports what shipped, what got unshipped and what broke, with repro steps and screenshots. It never touches real data.

Try it if... you have no QA team and your users find your bugs first.

→ Startup QA Bot template

Creator: Lingxi Li

Researches a whole codebase, then ships one cleanup PR per area. It defaults to 4am and asks when to run before it starts.

Try it if... your agent-built repo has piled up cruft you never get to. Review each PR before you merge.

→ Nightly Audit Engineer template

Creator: Hiten Shah

Investigates a product or startup idea: what has to be true, evidence for and against, the assumption most likely to kill it, and what to test next.

Try it if... you have a weekend idea and want to know if it deserves more than a weekend.

→ Product Idea Stress Test template

That's the puddle for this week. Hit reply and tell us what you're building. The best projects get featured. If a friend would like this, forward it their way.

Happy building,
The Vibe Puddle team

Curated with help from an AI agent, reviewed by a human editor. · vibepuddle.com