#office-hours - April 2026

Interesting…

Post-mortem for the Axios compromise: https://github.com/axios/axios/issues/10636

S3 buckets as file systems… 🤔

https://blog.skypilot.co/research-driven-agents/

https://astral.sh/blog/open-source-security-at-astral

@paulm do you have those links handy you shared in "Office Hours" this past week, especially around how you secure your S3 buckets?

https://www.linkedin.com/posts/katcosgrove_pull-request-process-share-7448418176419250176-k9Gh?utm_source=share&utm_medium=member_ios&rcm=ACoAAABZsBUBWKMGQCIG5JlgZ3-pz7WU35HDCw8

https://vinyl-cache.org/organization/on_vinyl_cache_and_varnish_cache.html

https://blog.cloudflare.com/cf-cli-local-explorer/

https://github.github.com/gh-stack/

https://openai.com/index/scaling-trusted-access-for-cyber-defense/

https://github.com/kontext-security/kontext-cli

https://strix.ai/blog/cal-com-is-closing-its-code-due-to-ai-threats

https://www.dbreunig.com/2026/04/14/cybersecurity-is-proof-of-work-now.html

https://cal.com/blog/cal-com-goes-closed-source-why

https://x.com/alex_prompter/status/2040731938751914065?s=46&t=hxmjEyu5OyUbWbc_cO5EPQ

https://openai.com/index/codex-for-almost-everything/

https://www.anthropic.com/news/claude-opus-4-7

https://techcrunch.com/2026/04/15/after-sale-of-its-shoe-business-allbirds-pivots-to-ai/

Cloudflare gets into agentic email business https://blog.cloudflare.com/email-for-agents/

https://awesomeagents.ai/news/github-fake-stars-investigation/

https://docs.openclaw.ai/providers/anthropic

https://x.com/spacex/status/2046713419978453374?s=46&t=hxmjEyu5OyUbWbc_cO5EPQ

@paulm I deleted your message by accident

can you repost?

AWS CloudControl API info and examples, for 2026-04-22 office hours

https://sqlxpert.github.io/2026/04/22/aws-cloudcontrol-api.html

https://github.com/OneUptime/oneuptime

https://socket.dev/blog/bitwarden-cli-compromised

https://openai.com/index/axios-developer-tool-compromise/

https://www.anthropic.com/engineering/april-23-postmortem

By infiscal https://github.com/Infisical/agent-vault

https://medium.com/@affirmtechnology/how-affirm-retooled-its-engineering-organization-for-agentic-software-development-in-one-week-1fd35268fde6

Just out…

TL;DR: Today, we are announcing that all GitHub Copilot plans will transition to usage-based billing on June 1, 2026.

https://github.blog/news-insights/company-news/github-copilot-is-moving-to-usage-based-billing/

https://restofworld.org/2026/sam-altman-worldcoin-zoom-tinder-partnerships/

https://github.blog/news-insights/product-news/whats-coming-to-our-github-actions-2026-security-roadmap/

Warp is now open source https://github.com/warpdotdev/warp

https://github.blog/news-insights/company-news/an-update-on-github-availability/

Rough week for GitHub PR.

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Some news and solutions that caught my eye this week:

• A Client VPN endpoint can now be bound to a transit gateway, rather than just to one VPC. aws.amazon.com/about-aws/whats-new/2026/04/aws-client-vpn-transit-gateway
• "Lambda Just Got a File System. I Put AI Agents on It." is a worked example of using S3 Files across 3 Lambda functions. [SAM, alas, but the idea, structure, and resource definitions are useful elsewhere.] edjgeek.com/blog/s3-files-lambda-agents and github.com/singledigit/lambda-s3-files-example
• "AWS Backup Restore Testing for Aurora provisioned: Zero Lambda, Full Automation" defines a Step Function that executes SQL queries to check a restored database, using rdsdata:ExecuteStatement rather than a database client. [This person sometimes outdoes me on low-code, no-dependency designs! 😀] builder.aws.com/content/3CuMcCh8jz6tIAWFEaehy58ATHU/aws-backup-restore-testing-for-aurora-provisioned-zero-lambda-full-automation

https://handyai.substack.com/p/your-ceo-is-suffering-from-ai-psychosis