... Apple's own support pages. Apple In-App Purchase: 26%, or 15% if you're in the Small Business Program, the Mini Apps or Video Partner Programs, or on an auto-renewable subscription after the subscriber's first year. Alternative payment processing inside your app: 20%, or 10% for those same groups. Out-of-app offers with an actionable link: a 15% store services commission, or 10% for those groups, on anything bought within 7 days of the tap. Apps ... ... distributed outside the App Store entirely - an alternative

... does the baseline drop happen automatically as soon as the lockfile diff is detected, or is there a manual confirmation step? Just wondering how that works in practice when you're running it across multiple repos with different security postures. Also, really appreciate you running that round-trip test before shipping it that level of care shows in the final product. Already installed it, and I'm impressed with how fast it runs. " Comment from Giovambattista Fazioli(@gfazioli): @sumonmatrix ... ... nothing is watching. octoscope scans when you press s on a repo, so the baseline moves at that moment and not before. Each repo keeps its own, keyed by owner/name in a single file beside your config, so different postures

... deterministic. mine isnt. Comment from Adams Parker(@adams_parker): I think the tricky part is proving service identity without turning every internal request into a security project. Comment from Chandrshekhar rawan (@chandrshekhar_rawen): @riya_pariyar   That front door vs internal rooms analogy is spot on. once one service is compromised those open internal paths can turn a small breach into a much bigger one. Comment from Chandrshekhar rawan (@chandrshekhar_rawen): We authenticate users carefully then sometimes let internal services ... ... wrong after something goes wrong. Comment from Riya Pariyar(@riya_pariyar): @chandrshekhar_rawen  that gap is the most common one i see. the front door is locked tight and the internal rooms are wide open. the two security postures

... line no matter how convincing it looks. Everything else gets the budget. I'd rather have two categories I actually honor than one standard I quietly abandon by Thursday. And the last one is less a technique than a posture. If you can't explain what a piece of your product does, that's not a neutral fact about your codebase, it's a debt with an interest rate. Sometimes I take that debt on purpose I've shipped things ...

... full-stack DAST engine doing API fuzzing, cloud access-control audits, and automated compliance reporting. Built rigorously for Indian regulatory depth, but the underlying testing engine works for any company that needs to continuously test and prove their security posture, not limited to India. We're also working on a crowdsourced testing layer alongside Turin, bringing independent researchers into the platform for broader coverage. Right now I'm figuring out the best way to reach founders/decision-makers directly ...

... effective default at the repository, which is the level that actually applies to the workflows sitting there, without needing to be an org admin to see it. For your case that's the difference between a posture nobody can look at and one anybody on the team can. The honest limit, since an unstated gap reads as coverage: that response tells you the effective value, not where it came from. Org policy and a repository override are indistinguishable ... ... posture

... probably spend more than 10 hours a day at my computer and I know it s not ideal. It is actually bad. It has quite a few negative effects on our eyes, posture, stress levels, and overall well-being. Even though I try to balance it with activities like going outside or exercising, it still feels like it s not enough. Makers, how many hours do you spend at your computer every day, and how do you give yourself permission ... ... hours during work ! And then on side project another couple of hours ! Comment from Oluwanifemi Oluwadamilare(@oluwanifemi_oluwadamilare): First, your health is very important. So as long as you're moving, exercising, using the correct sitting posture

... quitting: the outage only exists at the level of the set. "Distrust everything is not an instruction, it is a mood" is going straight into my notes. That's most debugging advice, now that you've named it a posture where a next action should be. Comment from Rabnoor Singh(@rabnoor_s): Publishing the wrong bug report alongside the fix is the useful half and almost nobody does it. The failure underneath yours is worth naming: your check assumed ...

... stage is the one nobody's watching. if you've got a shape in mind for #58, dropping it as a comment there is worth more than the upvote. Comment from Giovambattista Fazioli(@gfazioli): @bill_frad  thanks "informative vs genuinely useful" is a better framing than the one i had, might steal it. the thing that tipped it for me was actually the boring case: if there's no baseline yet, the report says so out loud. sounds trivial ... ... your example is the one case it doesn't cover I don't read lockfiles at all. Threat model is a payload in the source of a repo you own, not a bad package arriving from the registry. Dependency posture

... Here's what we've learned building Murror: the moment you give someone a chat interface for emotional reflection, you've changed the activity from "writing to understand yourself" to "talking to get a response." The posture shifts. Instead of sitting with a feeling, you're waiting for validation. We tested it internally for two weeks. The journal entries got shorter. The reflections got shallower. People started asking the AI "what should I do?" instead of exploring what they actually ... ... chat box, they want something to catch them on a day when writing feels like too much. That is the need sitting under the ask, and you can answer it without the back and forth that would break the posture

... tech world gives me FOMO. To compensate, I spend time outdoors, go into nature, and stay active through sports. But I know that disconnecting from the internet for a full day would probably do wonders for my eyes, focus, posture, and overall well-being. Are you able to go completely offline? If so, for how long? And if you've managed to reduce your online time, I'd love to hear your tips. Comment from Nika(@busmark_w_nika): @omri ...

... safely a service is exposed. The headline: a database reachable with no password gets flagged as High risk on sight. Turn on "inspect automatically during scans" and a forgotten dev database is caught the moment it appears. A posture verdict: an open Redis reachable with no password Or just look inside anything Any open port the product behind it, plus a read-only peek at what it announces (an FTP/mail greeting, a database handshake, an SSH banner). The port detail ...

... even change frameworks with enough effort, and your users never really feel it. Auth is the opposite. The moment you have real accounts, your identity choice is wired into your data model, your APIs, your sessions, and your security posture, and pulling it out later means migrating live credentials and hoping you do not lock anyone out or open a hole while you do it. The nuance I would add is that locking it in early does not mean building ...

... your own backend (qdrant/pgvector/chroma/weaviate), and our team is happy to help with that or point you at the docs. Enterprise is our hybrid and fully air gapped options; this has variable setup time, driven mostly by your security posture, networking, and existing infrastructure. Assuming right internal resources are engaged with our onboarding team, it's typically stood up and validated within one work day. Comment from Mathew Chang(@mathew_chang): Curious about how long implementation typically takes and whether there ... ... your own backend (qdrant/pgvector/chroma/weaviate), and our team is happy to help with that or point you at the docs. Enterprise is our hybrid and fully air gapped options; this has variable setup time, driven mostly by your security posture

... judgment call that will occasionally misclassify a genuinely fast reviewer. And any behavioral proxy like this can be gamed if someone is motivated. But "approved" as the only review record for AI-generated auth code is not a governance posture it is an illusion of one. The question is whether a behavioral floor, even an imperfect one, is better than no floor at all. Curious if anyone here has built or worked with review quality measurement systems and what signals ... ... found actually correlated with genuine engagement vs

... built SecURL for low-noise external posture review of public sites. It reads what a browser, auditor, or researcher can already see, headers, TLS, cookies, redirects, and DNS/email posture

... doorbell. It rings the same whether it's a package or a fire. That's basically the gap Pushary fills, same hook idea you've already wired, but the event carries a real handoff (done vs blocked vs

... their most cursed photo for it, and the prompt picker chooses the winner. Bonus points if someone screenshots your photo. I'm looking for prompt ideas i have 200 prompts. Here are a few I have so far: bad posture Just a casual photo dump profile pic idea Would love to hear what you guys come up with! The more chaotic the better. If you want to try it out: photobomb.online Comment from Millie Mason(@millie_masonn): Try prompts like ...

... confirmed working. Core tenant tables are present: tenants workspaces shopify_stores tenant_user The encrypted Shopify token vault table is present: shopify_oauth_tokens The token vault smoke test passed earlier with columns, indexes, foreign keys, and empty vault posture verified. The encrypted token service stub has been tested using fake sample data only. The token storage approval gate is working as a non-persistent review flow. The OAuth exchange dry-run receipt room is installed. The OAuth exchange approval ... ... without storing anything yet. That includes: issuing a future state receipt binding state to tenant/workspace/store/operator context showing fingerprint-only receipts previewing one-time-use state consumption previewing replay rejection previewing expired state rejection previewing session mismatch rejection previewing rollback posture

... everything stayed on-device. Same goal. Completely different trust reactions. Curious if other builders here have run into similar situations where user behavior completely changed how you thought the product should work? Comment from Will Towle(@willatsharpread): The camera vs audio finding is genuinely counterintuitive and I think it says something important about how people actually reason about trust. It's not about what's technically more private. It's about what's legible. A camera with a hardware indicator ... ... same thing - trust isn't really about privacy, it's about whether the user can see the contract clearly. Did the testers who preferred camera-based detection engage differently with the rest of the product? Curious whether that trust posture

... confirmed working. Core tenant tables are present: tenants workspaces shopify_stores tenant_user The encrypted Shopify token vault table is present: shopify_oauth_tokens The token vault smoke test passed earlier with columns, indexes, foreign keys, and empty vault posture verified. The encrypted token service stub has been tested using fake sample data only. The token storage approval gate is working as a non-persistent review flow. The OAuth exchange dry-run receipt room is installed. The OAuth exchange approval ... ... without storing anything yet. That includes: issuing a future state receipt binding state to tenant/workspace/store/operator context showing fingerprint-only receipts previewing one-time-use state consumption previewing replay rejection previewing expired state rejection previewing session mismatch rejection previewing rollback posture

... only reacting to world state dynamic contract generation, where the Underworld board now writes from live state rather than feeling like a fixed template deck the first recommendation-only Governor layer, where Blaze can suggest bounded changes to withdrawal posture, holder-gate pressure, and conversion posture

... that! Comment from Cory(@getpatch): Really validates something I keep running into. I've been building a consumer security app, and the pattern rhymes even on the B2C side. AI ships you a polished surface fast, but the security posture is a separate discipline that doesn't come for free with the tooling. On your question: I don't trust the agents to be the final word. They're great for catching the obvious stuff and moving fast ...

... metric users where appropriate). Density precedence with grams-per-cup grams-per-ml fallback. Count-noun fallback for piece terms (stick, stalk, sprig). Allergen system with explicit cache invalidation. J. Auth & Security Defense-in-depth, fail-closed posture. Bot/abuse protection (Turnstile) on public entry points. Session sync + fail-closed logout; no stale auth state in the provider tree. Strict allowlist for any dangerouslySetInnerHTML. Sitemap and crawler endpoints first-party only never expose backend provider URLs. PWA self-update: auto ... ... against an authoritative baseline. Data-quality detection: 3-step fallback chain (FK name canonical-link) plus a curated-source AI block-list. L. Violation Response On any breach: stop log entry (type, root cause, files, prevention) explain propose compliant alternative

... public . What still needs maturing includes: 1. Full operator-facing balance panel The admin side needs a cleaner, more complete control surface where operators can see: pressure inputs balance recommendations active bounds suggested changes recent balance receipts frozen vs live states restore-default controls 2. Stronger recommendation-to-action bridge The system should be able to move from: observation to recommendation to bounded execution to logged receipt without turning into silent mutation chaos. That bridge has to be careful, auditable ... ... less likely it is to balance the wrong thing. 4. Better player-facing transparency Players should not feel like the world is randomly harder for mysterious reasons. The best version of Blaze Balance Engine should communicate system posture