SecurityThe briefing
AI-generated illustration
No pull requests merged in Ashlr's public repositories on October 20. Here is the plain-English idea behind the previous day's biggest security change.
First, the honest status: no pull requests merged in Ashlr's seven public product repositories on October 20 (UTC). So instead of a merge list, this is a short explainer of the most important change from the day before.
An AI tool that calls a model usually sends an API key with the request. Whoever controls the address receives the key. On October 19, ashlr-plugin removed a way for a model to supply that address itself. Before, one tool accepted an endpoint argument. A prompt-injected model could, in principle, point it at a server it controlled. Now the address comes only from the user's own settings.
The same pull requests added gateway rules that now cover the default path for cloud and local providers: https only, or plain http only to 127.0.0.1 and [::1]; no credentials inside the URL; and redirects are refused rather than followed, so a key never follows a redirect to another site. Ashlr MD applied the same https rule to its Anthropic base URL, and ashlr-plugin stopped sending a Claude Code sign-in token to a custom base URL.
A useful rule of thumb: anything that decides where a credential goes should come from configuration a person wrote, never from model output or repository content. Refusing redirects for keyed calls closes a gap that allowlists alone miss.
When you approve an AI tool, ask who can change the address its keys are sent to. If the answer includes the model, a plugin or a repository file, that is a risk worth fixing first.
Check one AI tool your team uses: find where its model endpoint is configured and confirm only an administrator can change it.
Ashlr tools connected to this story. Review their source and setup requirements.
Token-efficient tools and workflows for Codex and Claude Code. Read, search, edit, and inspect repositories with compact outputs and visible context usage.
Source material behind this briefing. Our practical implications are Ashlr’s interpretation.
This briefing was prepared with AI assistance from the linked sources. The analysis may include interpretation; consult the original sources for complete context. Cover artwork is illustrative.
AWS made its Continuum agent generally available. The service finds, validates, and proposes fixes for code vulnerabilities in repositories while checking the AWS environment.
SecurityThe briefing
AI-generated illustration
Nothing merged in Ashlr's public repositories on October 21. Here is the idea behind a phrase that runs through recent pull requests: value-free reports.
SecurityThe briefing
AI-generated illustration
Ashlr merged more than 90 pull requests on October 19. The themes: no key leaks through error messages, and Phantom Secrets setup you can preview and undo.
