Ashlr cover: a green shield and placeholder key, with the headline Sign-in that recovers when it fails.

The briefingSecurity

Phantom Secrets fixes sign-in and device approval recovery

By Ashlr.AIAI-assisted briefingPublished Oct 10, 2026, 6:24 PM UTC3 min read

On October 10, Phantom Secrets merged two fixes so a failed GitHub sign-in no longer leaves the dashboard or device approval stuck on an old account.

What changed

On October 10, 2026, Phantom Secrets merged two pull requests about what happens after a failed sign-in with GitHub. Both come from Ashlr's public repository and both descriptions are first-party.

The first pull request says an older stored session could hide a failed sign-in on the dashboard, and that device polling could report a database failure as a code that was already used. The fix checks for errors before showing the dashboard, offers a retry button, and keeps the device code when a profile or claim step fails.

Browse all stories

Field noteSecurity

Your agent can use the key. It never sees it.

Oct 17, 2026

The second pull request describes a related problem. After a failed sign-in, an older browser session could stay behind. Retrying or refreshing could then approve a device, or open the dashboard, as that older account. The fix remembers the pending sign-in across reloads and requires a matching callback before it finishes a new sign-in. It also removes tokens and error details from the web address.

Device approval now tells apart a database failure, an expired code and a race between two approvals. A first-time browser-only login shows setup guidance for the trusted terminal instead of a raw "missing profile" error.

The pull request lists the checks that passed, including 233 web tests, and says the GitHub provider credential problem and actual owner login are separate acceptance steps. It says the change does not alter credentials, auth permissions, the database schema or publishing access.

What it means for your work

For builders

When a login can fail halfway, test the second attempt as well as the first. The bugs here showed up when someone retried or refreshed with an older session still in the browser.

For business

Ask your vendors what happens when sign-in fails and the user tries again. A safe answer says which account the retry uses and what is shown to the user.

Put it to work

Try your own sign-in flow with a stale session in the browser. Fail it on purpose, then retry and refresh. Write down which account you end up as.

Explore the project

Ashlr tools connected to this story. Review their source and setup requirements.

Phantom Secrets

Delegate supported API work through scoped placeholders and a local proxy, keeping real keys out of agent context.

Visit website View source

Go to the source

Source material behind this briefing. Our practical implications are Ashlr’s interpretation.

Fix dashboard sign-in and device claim error recovery (pull request) (opens in a new tab)
Ashlr.AIOct 10, 2026
Fix account selection and recovery after failed GitHub sign-in (pull request) (opens in a new tab)
Ashlr.AIOct 10, 2026

This briefing was prepared with AI assistance from the linked sources. The analysis may include interpretation; consult the original sources for complete context. Cover artwork is illustrative.

Editorial approach Suggest a correction

5 min read

Agents can read your .env file like any other file. Phantom Secrets swaps real keys for placeholders and adds the real one only when a request leaves.

Ashlr cover: a map pin inside a circle, with the headline Wrong account, impossible.

Field noteSecurity

Locus: how to stop an agent from using the wrong account

Oct 17, 20264 min read

Agents inherit whatever accounts happen to be logged in on your computer. Locus pins an agent to one identity, so acting as the wrong client becomes impossible.

Ashlr cover: a green shield and placeholder key, with the headline Found by running it ourselves.