Security

Every SSH connection needs the right host, port, user, and sometimes a specific key, and there is no good place to write all that down outside of ~/.ssh/config. That file stays the most underused tool in any developer’s home directory. Without it you retype ssh deploy@10.0.4.17 -p 2222 -J bastion.example.com every session, forget which IP belongs to which server two weeks later, and end up with a shell history full of nearly identical commands.

Passkeys swap passwords for a public/private keypair kept in the device keychain and unlocked by Face ID, Touch ID, or Windows Hello. The WebAuthn API does the crypto work, while @simplewebauthn/server version 13.3.0 covers Node, Bun, and Deno backends. Sign-up, autofill login, and account recovery all fit in one evening of work.

What Passkeys Actually Are and Why 2026 Is the Year to Ship Them

A passkey is a public/private keypair made on the user’s device. The private key never leaves the secure enclave (Secure Enclave on Apple hardware, StrongBox on Android, TPM on Windows). Only a signed challenge travels over the wire. Your server stores no shared secret to steal and no hash to crack offline. The signature is bound to your domain, so it can’t be phished. If a user visits examp1e.com instead of example.com, the browser refuses to sign. Credential phishing ends at the protocol layer.

The viral r/ChatGPT “my OpenClaw texted my ex” post reads like a joke, but the comments treat it as a warning sign. Keep OpenClaw’s iMessage, SMS, and contacts skills off your personal Mac. Wait until LTS ships and the founder’s “rough week” supply-chain fixes land. Scope write-access skills to a disposable VPS instead.

The viral OpenClaw meme is not just a meme

A screenshot of OpenClaw happily reporting that it had texted the OP’s ex hit 4.8K upvotes and 176 comments on r/ChatGPT in about three weeks. The top replies are jokes (“Of all the things that didn’t happen, this happened the didn’test”). The serious comments point at a real safety category that is forming in real time.

AI writes about 41% of all committed code in 2026, and some teams report well above 50%. AI review tools have cut PR cycle times by as much as 59%. Yet when Sonar asked 1,149 developers for their 2026 State of Code report , 47% ranked “reviewing and validating AI-generated code for quality and security” the top skill in the AI era, above prompting at 42%. The paradox: the more code AI writes, the more vital human review becomes.

You can shrink your Linux server’s attack surface in about 30 minutes. The recipe is simple. Harden SSH with Ed25519 keys, set up nftables with default-deny, turn on auto security updates, run auditd for kernel logs, and lock down accounts with faillock. A typical Lynis score jumps from 55-62 on a stock install to 75-84 after these changes.

Each section below takes 3-7 minutes. Work through it top to bottom on a fresh server. You will have a solid security baseline before your first app deploys, whether that is a database or a privacy-respecting analytics instance .

AI test generators make it easy to hit 80% or even 90%+ line coverage. Point GitHub Copilot at a codebase, use the @Test directive, and watch it write hundreds of test methods by itself. The number looks great on a dashboard. But line coverage only measures execution, not detection. A test suite can run every line of your code while checking nothing about whether that code is correct. In one 2026 experiment, an AI-built suite scored 93.1% line coverage but only 58.6% on mutation testing. Over a third of realistic bugs slipped through undetected, with CI green across the board.