API & Supply-Chain Security14 August 2026
Datasette's New Upload API Turns a Bearer Token Into a Production Database Swap
The datasette-upload-dbs 0.5a0 release formalises a POST API for hot-swapping a live SQLite database — a convenient CD primitive that is only as safe as the bearer token and permission scope guarding it.
api-securitydevsecopssecrets-management
4 min readRead
Software Supply Chain & DevSecOps9 August 2026
GitHub Models Retirement: The CI/CD Secrets Lesson Nobody Flagged
GitHub quietly retired its Models API on 30 July 2026, cutting off a feature that let Actions workflows call LLMs using the same GITHUB_TOKEN already sitting in the pipeline. That convenience is worth a second look.
github-actionsci-cd-securitysupply-chain
4 min readRead
AI Agent Security30 June 2026
Agents That Film Their Own Work: The Security Read on shot-scraper video
Simon Willison's shot-scraper 1.10 lets coding agents record video "proof" of browser-driven work using Playwright's new screencast API — a convenience that quietly expands the credential and trust surface security teams need to govern.
ai-agentsagent-securitybrowser-automation
4 min readRead