Daily Edition · Page 14

THE DAILY INDEX

Technology, AI, software, security, crypto and business

Repositories, courses and useful tools

Resources & Tools

CRASHTEST

Crashtest runs adversarial security tests against a JavaScript app's real route handlers entirely in-process, so it never opens a socket or needs a live server. Its built-in campaigns cover identity-spoofing headers, prototype pollution, cross-tenant ID enumeration, leaked secrets, and cost-amplification abuse, and every attack ends in a verdict of REFUSED, EXPLOITED, or BOUNDED (an accepted risk with a named owner). It plugs into Hono, Express, and Fastify, and its GitHub Action fails CI only on a new exploit or a regression, never on risks the team already accepted.

SAFEAGENTS

safeagents is a local proxy that sits between a coding agent and its model API and checks each tool call before the harness runs it. It blocks calls to undeclared tools and calls that reach hosts nobody mentioned in the conversation, and it runs atif-scan detectors that catch reads of /proc/1/environ or curl --noproxy. Ambiguous calls can go to an optional judge model that sees only the user's prompt, the call, and the findings, never the agent's reasoning, and it works with any harness that accepts a custom base URL, including Claude Code, OpenCode, and Hermes.

TLDR IndexPage 14