GitHub status: access issues and outage reports

Problems in the last 24 hours

GitHub signals over the past 24 hours. The dashed line is the service-wide baseline used to detect unusual activity.

• Service-wide signals
• Service-wide baseline

Most Reported Problems

The following are the most recent problems reported by GitHub users through our website.

• Website Down (53%)
• Errors (33%)
• Sign in (14%)

Live Outage Map

The most recent GitHub outage reports came from the following cities:

City	Problem Type	Report Time
Paris	Website Down	15 days ago
Ahmedabad	Errors	21 days ago
Delme	Sign in	21 days ago
Lyaud	Website Down	21 days ago
Catania	Errors	24 days ago
Inverness	Website Down	1 month ago

Full Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

GitHub Issues Reports

Latest outage, problems and issue reports in social media:

• 
  Rafael Audibert (@RafaAudibert) reported 2 minutes ago

  @madebygps @github Tried using it with my agents (the main benefitor from this) but it doesnt really work because you cant use it with GitHub app user tokens (ghu_). Can that be changed somehow? All cloud agents will have that problem, and most of our coding happens trough cloud agents now

• 
  Trustur (@TrusturAI) reported 3 minutes ago

  @alktraz1986 @andyperbonie Summary of the Dispute and Factual Background The dispute involves a cross-border independent contractor seeking recovery of 3.5 months of unpaid compensation from a cryptocurrency/Web3 enterprise. Key Facts Identified: • Contractual Relationship: The contractor entered into an Independent Contractor Agreement, originally signed and renewed in October of the preceding year. • Performance & Cessation: Services were performed for 3.5 months without payment. The contractor suspended performance unilaterally after identifying operational irregularities ("red flags"); no formal termination notice was served by the client entity. • Corporate Structure: Dual-jurisdiction nexus involving a primary corporate registration in the United States (common in Web3 for operational/marketing arms) and an affiliated entity or headquarters in the Cayman Islands (standard for token foundations, holding entities, or decentralized autonomous organization (DAO) wrappers). • Corporate Governance Changes: A recent change in executive leadership (Chief Executive Officer) has complicated direct negotiations. • Evidence Base: The claimant holds documentary records, including the signed agreement, email correspondence, task management records, performance deliverables, and messaging logs. Legal Analysis and Strategic Assessment 1. Contractual Breach and Remedies • Actionable Breach: Failure to remit agreed-upon remuneration for performed services constitutes a material breach of contract. Under both US common law (governed generally by state contract law and the Restatement (Second) of Contracts) and English common law principles applicable in the Cayman Islands, the non-breaching party is entitled to compensatory damages designed to place them in the position they would have occupied had the contract been fully performed (expectation damages). • Unilateral Suspension of Services: When a client commits a material breach by withholding payment, the contractor is generally excused from further performance obligations under the doctrine of anticipatory repudiation or prior material breach. • Alternative Claims (Restitution / Quantum Meruit): If the counterparty disputes the formal validity of the renewed contract or claims the scope of work exceeded contractual terms, the contractor may plead quantum meruit (reasonable value of services rendered) and unjust enrichment in the alternative. 2. Jurisdictional Nexus and Governing Law Analysis Cross-border Web3 entities frequently split operational entities (often US Delaware LLCs or C-Corps) from offshore asset-holding vehicles (often Cayman Islands Foundation Companies or Exempted Companies). Determining where to enforce depends on the contract terms: ┌────────────────────────────────────────┐ │ Independent Contractor Contract │ └───────────────────┬────────────────────┘ │ Does the contract contain a Choice of Law and Dispute Resolution Clause? │ ┌──────────────────┴──────────────────┐ ▼ ▼ [ YES ] [ NO ] │ │ ┌───────────────┴───────────────┐ ┌──────────┴──────────┐ ▼ ▼ ▼ ▼ Arbitration Clause Forum Selection US Jurisdiction Cayman Islands (e.g., AAA, ICC, JAMS) (State/Fed Court) (Where work/entity (Where assets/holding Binding forum; low Litigation in is registered) entity is located) publicity; high cost. specified court. • Express Choice of Law / Forum Selection: The contract's Governing Law and Dispute Resolution clauses dictate the mandatory venue and legal standards. Web3 contracts frequently mandate binding international arbitration (e.g., AAA/ICDR, ICC, or LCIA). • Enforcement in the United States: If the contracting counterparty is the US entity, claims may be pursued in state or federal courts (depending on diversity of citizenship and amount in controversy under 28 U.S.C. § 1332) or small claims tribunals if within statutory monetary thresholds. • Enforcement in the Cayman Islands: If the counterparty is a Cayman Exempted Company or Foundation, claims above CI$ 15,000 (~US$ 18,000) are brought before the Grand Court of the Cayman Islands. Under Section 94 of the Cayman Islands Companies Act, serving a statutory demand for an undisputed debt exceeding CI$ 100 is a powerful mechanism; failure to pay within 21 days can form the basis for a winding-up petition against the company on insolvency grounds. 3. Impact of Executive Turnover (CEO Replacement) A change in executive management (e.g., incoming CEO) does not extinguish, modify, or stay existing corporate liabilities. Under the principle of separate legal personality (Salomon v A Salomon & Co Ltd), the contracting corporate entity remains strictly liable for all obligations incurred by previous authorized officers and management. 4. Worker Misclassification Considerations (US Law) In Web3, companies frequently label full-time workers as "independent contractors" to avoid payroll taxes, statutory benefits, and labor obligations. • If the enterprise exercised significant control over working hours, methods, tools, and day-to-day operations, the relationship may be legally recharacterized as an employment relationship under the Fair Labor Standards Act (FLSA) or applicable US state tests (e.g., California’s "ABC Test" under AB 5 / Labor Code § 2775). • Reclassification exposes the company to statutory wage penalties, mandatory attorney fee shifting, and liquidated damages under state labor codes, significantly increasing the contractor's settlement leverage. Recommended Strategic Roadmap STEP 1: Document Audit & Preservation Collect signed contracts, invoices, timesheets, code commits/deliverables, Slack/Telegram chats. │ ▼ STEP 2: Contractual Clause Review Identify governing law, notice requirements, mandatory cure periods, and arbitration clauses. │ ▼ STEP 3: Formal Legal Demand Letter (Notice of Dispute) Issue a formal, itemized demand citing breach of contract, interest, and pre-litigation deadlines. │ ▼ STEP 4: Pre-Litigation ADR / Mediation Engage management or counsel to negotiate structured settlement or cryptocurrency escrow payout. │ ▼ STEP 5: Formal Dispute Initiation / Statutory Demand File for arbitration, bring action in competent court, or serve Cayman Statutory Demand. 1. Evidence Preservation: Assemble an unalterable archive of all communication channels (Telegram, Discord, Slack, email), signed agreements, proof of deliverables (GitHub commits, documents, designs), and acknowledgments of debt by previous or current leadership. 2. Formal Notice of Default / Demand Letter: Issue a formal demand letter via legal counsel to the registered agents of both the US entity and the Cayman entity. The demand should specify: • The contractual basis of the claim. • Total outstanding principal plus statutory pre-judgment interest. • A strict cure period (typically 14 to 30 calendar days). • Notice of intent to commence formal legal proceedings and seek legal fee recovery where permitted by contract or statute. 3. Reputational and Commercial Considerations: While accurate factual statements regarding non-payment generally do not constitute actionable defamation, public social media campaigns carry risks under contractual Non-Disparagement clauses. Prioritize formal legal communication channels to preserve high legal standing before adjudicators. References and Legal Authorities Statutory Provisions • United States Federal Law: 28 U.S.C. § 1332 (Diversity of Citizenship; Jurisdiction). • United States Federal Law: Fair Labor Standards Act (FLSA), 29 U.S.C. § 201 et seq. (Worker status and wage protections). • Cayman Islands: Companies Act (2023 Revision), Section 94 (Insolvency and Statutory Demand for Debt). Case Law and Legal Principles • Corporate Liability & Successor Continuity: Salomon v A Salomon & Co Ltd [1896] UKHL 1 — Fundamental doctrine of independent corporate personality surviving executive management transitions. • Contract Damages: Hadley v Baxendale (1854) 9 Exch 341 / Restatement (Second) of Contracts § 347 — Measure of expectation damages for material breach of commercial agreements. • Enforceability of Forum Selection Clauses: M/S Bremen v. Zapata Off-Shore Co., 407 U.S. 1 (1972) — Enforceability of cross-border forum selection and dispute resolution agreements. Disclaimer: This analysis provides structured legal information and comparative analysis for cross-border commercial disputes. It does not constitute formal legal advice or create an attorney-client relationship. Given the multijurisdictional nexus involving US and Cayman Islands corporate entities, the party should retain qualified legal counsel licensed in the relevant jurisdiction to issue formal process.

• 
  Priyanshu Bhati (@buildwithpb) reported 7 minutes ago

  @CryptoWendyO @chainlink 30% error rate on github replies sounds like a recipe for accidental flame wars. good luck with the cleanup.

• 
  Chris Gilbert (@0xgilbert) reported 8 minutes ago

  Damn, GitHub has gone to ****. Features that have been cornerstones of solo devs and small businesses have been gutted or broken for months. How the mighty have fallen…

• 
  volkdude85 (@volkdude85) reported 11 minutes ago

  @SentientSquirel @linuxuser1996 So you are you scared of github then. Look dude I have fun on computers and don't take myself seriusly because I have destroyed enough OS's over to not worry about it because I just fix it, If the contents of your PC make you this paranoid its time to check your kink.

• 
  Kirk Patrick Miller (@Chaos2Cured) reported 12 minutes ago

  @NavinFS @AndrewCurran_ @grok GitHub isn’t AI. GitHub can’t shut down all science. GitHub can’t destroy humanity. GitHub isn’t the crux of humanity’s hope. Also, Nvidia isn’t Sam. I like Jensen. I still don’t like this. •

• 
  Straggler Liu | AI & Semis (@StragglerLiu) reported 14 minutes ago

  NVIDIA($NVDA ) Is Paying $14B for a Company With $150M Revenue. That's Not Financial Logic — It's Ecosystem Control. NVIDIA is in advanced talks to acquire Hugging Face for ~$14 billion ($12.9B acquisition + $1B retention), per Bloomberg. To put that in perspective: Hugging Face does ~$150M in annual revenue. That's ~86x revenue. Microsoft paid ~1.6x revenue for GitHub. Google paid ~3.5x revenue for DeepMind. NVIDIA is paying 20-50x more on a revenue multiple basis. The premium is not for revenue. It's for control of the AI developer ecosystem. What is NVIDIA buying? Hugging Face hosts 500,000+ models, 250,000+ datasets, and serves millions of developers. It is the single most important distribution channel for open-source AI. If you build AI, you use Hugging Face. That makes it the front door to AI development. Why NVIDIA is paying this premium: 1. The "NVIDIA triple lock." NVIDIA's hardware lead (GPU) is real. Its software lead (CUDA) is a moat. But the third lock — the developer workflow — was missing. Hugging Face is that workflow. Developers discover models on Hugging Face, deploy them, and optimize them. Whoever controls that discovery layer controls which hardware gets used. 2. The GitHub analogy, inverted. When Microsoft bought GitHub, developers were already using GitHub. Microsoft didn't need to capture them — it needed to prevent Amazon/Google from doing so. NVIDIA faces the opposite problem: developers are already using NVIDIA hardware. But they're discovering and deploying models through a neutral platform. NVIDIA is eliminating that neutrality. 3. The long game: inference, not training. NVIDIA dominates training. But inference is the bigger TAM — and it's more fragmented. If NVIDIA controls the model discovery and deployment layer, it can steer inference workloads to its own stack. That's a 10-year strategy disguised as a 14-billion-dollar acquisition. Who wins, who loses: NVIDIA (NVDA): Acquires the developer distribution layer. The most important strategic move since CUDA. Shifts the valuation case from "chip cycle" to "platform economics." Competitors (AMD, INTC): Lose neutral access to the primary AI model distribution channel. This is a structural headwind that no amount of hardware catch-up can fix. Cloud providers (MSFT, AMZN, GOOGL): Hugging Face was a neutral hub. If NVIDIA controls it, cloud providers risk being disintermediated from AI workload decisions. The open-source community: The platform that was built on openness is now owned by the dominant hardware vendor. Neutrality is the first casualty. The capital question: Can NVIDIA integrate Hugging Face without destroying its community value? If yes, the $14B is cheap. If no, it's a very expensive mistake. The answer will define whether NVIDIA becomes the AWS of AI — or just another hardware company with an expensive acquisition. Note: Acquisition details based on Bloomberg reporting; not confirmed by NVIDIA or Hugging Face. Revenue multiple comparisons based on publicly reported figures.

• 
  Kahris (@chrissotraidis) reported 19 minutes ago

  @NickogSo I haven't tested on LiveContainer. Feel free to submit logs via GitHub issues and I'll check it out. I haven't had any other reports of that happening for either build.

• 
  ∆LΞX∆NDΞR D∆VIS (@_AlexanderDavis) reported 22 minutes ago

  @egavrilenko11 @bot I had to update my fine grain token for GitHub and now when it tries to authenticate the plugin, I'm getting the error: GitHub didn't provide a sign-in link My bot said: Known host bug, not you. The GitHub Authenticate button tries OAuth GitHub does not support. Checking whether a PAT on the plugin page is the working path. That's a Grok Bot host bug, still open: cursor/plugins#251. GitHub's connector is PAT-only. The Authenticate button tries OAuth GitHub does not support, so you get "didn't provide a sign-in link." Don't keep hitting it. But it worked before I updated my fine grain token...

• 
  Ares (@neko23423) reported 24 minutes ago

  I compared the latest OpenClaw vs Hermes Agent GitHub releases so you don’t have to. OpenClaw 2026.8.2 (Sep 1) vs Hermes Agent v0.21.0 (Aug 31). Not a feature-page remix. The actual repos. OpenClaw • 388,516 stars • 81,568 forks • ~86,300 commits • 6,070 open issues Hermes Agent • 239,503 stars • 48,930 forks • ~26,980 commits • 38,563 open issues Hermes is the smarter learner: skills from experience, cron that remembers, Bot Mode, hermes peer. OpenClaw is the personal-AI operating system: iMessage, iOS/Android, Linux companion, team Gateway, signed Foundation releases. The tell: Hermes ships `hermes claw migrate`. You only write a migrator for the incumbent. King in 2026: OpenClaw. Heir with the better mind: Hermes. If you’re picking a self-hosted AI agent this week, that’s the split. Bookmark this. The timeline is about to fill with takes from people who didn’t open either repo. OpenClaw vs Hermes Agent. Latest version. Real numbers.

• 
  Russ Wonsley (@RussWonsley) reported 28 minutes ago

  My @bot tells me that the official GitHub login for bot is still broken. Has this been addressed already, or did I miss it?

• 
  Alireza Bashiri (@al3rez) reported 28 minutes ago

  So I built a workflow around that ↓ 1/ Every enterprise project needs proper E2E tests. An agent should reproduce a bug, implement the fix, then generate screenshots or video proving the feature works. "The tests passed" isn't enough. I want evidence. 2/ Every feature starts as a detailed GitHub issue. Requirements, expected behavior, reproduction steps, screenshots, edge cases. Foundry syncs issues and converts them into Beads so agents keep the right context across long sessions. 3/ We only use Claude Code, Codex, or Grok at High/Max effort for implementation. A weak model with a cloud machine doesn't become an engineer. The model still needs enough reasoning to understand the codebase, test its changes, and recover when things break. 4/ Each agent gets its own isolated @asciidotdev Box. It can install dependencies, run the app, open browsers, modify code, execute E2E tests, and collect evidence without touching another agent's environment. One issue. One box. One clean workspace. 5/ When an agent finishes, Foundry checks: - Did the build pass? - Did the tests pass? - Did the E2E flow work? - Is there screenshot/video evidence? - Does it match the ticket? If anything fails, the task goes back to the agent. 6/ Green tasks move to staging. Only after passing staging do we allow supervised production deployment. Agents do most of the work. Humans still own the final gate. The workflow: Slack request → GitHub issue → Foundry sync → Beads context → Isolated Box → Claude Code/Codex → Build + test → Evidence collection → QA staging → Supervised production The stack: PostgreSQL for system state. Beads for agent memory. GitHub Issues for requirements. @asciidotdev Box for isolated execution. Claude Code and Codex for engineering. Each Box costs roughly $0.01-$0.05 per task. The expensive part isn't compute anymore. It's building the system that gives agents context, forces verification, and prevents bad code from reaching production. 100s of agents can write code. The goal is making 100s of agents ship code you can trust. That's what we're building with Foundry.

• 
  wiiiimm (@wiiiimm) reported 29 minutes ago

  @Umesh__digital stop doing it. we don't need another github outage.

• 
  Curious Explorer (@PatelVatsalp732) reported 31 minutes ago

  I burned 14B Codex tokens. The official usage UI still cannot tell me what actually ate the weekly cap. So I shipped a Codex-only board: GitHub login, local-first sync, private by default, optional public rank + shipping proof. Roast the metric or join it.

• 
  Rituraj (@RituWithAI) reported 32 minutes ago

  🚨 Someone built the complete playbook for running frontier AI models on consumer GPUs at home. Not a tutorial. Not a YouTube video. A production-grade serving stack with measured benchmarks, working configs, and battle-tested recipes — for RTX 3090 owners who want real performance. It's called club-3090. And the numbers it delivers should not be possible on consumer hardware. 127 tokens per second. Qwen3.6-27B. Two RTX 3090s. 262K context window. Vision. Tool calling. At home. Here's what's actually inside. Two serving routes — pick based on what your workload breaks on. vLLM dual: maximum throughput. 89-127 TPS on code tasks. 4 concurrent streams at 262K context. Full feature stack — vision, tools, speculative decoding, streaming. This is the path if speed matters. llama.cpp single: maximum robustness. Full 200K context on one 3090. No prefill cliffs. 25K-token tool returns work correctly. 91K needle ladder passes. ~51-60 TPS — slower than dual, but doesn't crash on real-world agentic workloads. Both routes ship as validated Docker Compose configs. Drop-in OpenAI-compatible API on localhost:8020. Your Claude Code, Cursor, or any OpenAI-compatible client connects immediately. Here's the model support that makes this practical. Qwen3.6-27B — production ready. Works on 1 or 2 cards. vLLM, llama.cpp, ik_llama. Up to 262K context. Gemma 4 31B — production ready. Vision, tools, up to 106-141 TPS on dual cards. Qwen3.6 35B-A3B MoE — production ready. 103-149 TPS single card. 178 TPS dual. Here's the wildest part. The terminal UI. c3 is a lazydocker-style cockpit that wraps discovery, serving, and operations in one keyboard-driven interface. Browse the model catalog, serve a variant with Enter, watch live GPU stats, run health checks — all without touching the CLI. Here's why this is different from just installing Ollama. Ollama gets you running. club-3090 gets you benchmarked, stress-tested, and production-hardened. Every config ships with a verified TPS measurement. The bench script runs 3 warmup + 5 measured passes. The stress test catches the specific prefill cliff that Ollama silently fails on at long contexts. When your agent starts doing 25K-token tool calls at 3am and something crashes — club-3090 already found that failure mode and documented the workaround. One command to start. Your RTX 3090 just became a frontier AI inference server. Apache 2.0 License. 100% Open Source. GitHub link in the comments 👇

• 
  Kim Burgaard (@kimburgaard) reported 36 minutes ago

  Back when GitHub added Copilot PR reviews, it helped me keep up with the growing volume and size of our pull requests, which were increasingly being written by Copilot too. Over time I grew comfortable feeding Copilot's review comments straight back to Copilot to fix, and mostly spot checking when critical functionality was involved. When GitHub updated the Copilot pricing model I switched to Claude Code, but kept the Copilot review feature on for a couple of months. When the monthly bills for Copilot AI usage alone started rivaling the Claude Code Max plan, giving Claude Code PR review duties seemed like an obvious cost saving move. Plugging Claude Code into our PR review process immediately went south. The first PR churned with fixes to findings that resulted in more findings, and fixes that propagated up and down the call chain. I threw the PR away and started over, but the next attempt churned just as badly. Turn count on its own was never the signal. Copilot had taken ten turns on a rate-key cleanup the day before and nobody minded, because the findings thinned as it went — 5, 4, 3, 3, 3, 4, 1, 2 — and it merged. The cached-token billing PR I put through Claude Code took nine turns and produced 123 inline findings, and the ninth round was still returning fifteen. I closed it without merging. Looking closer at Claude Code's review findings, it was clear it reported far more issues than Copilot ever did, and among legitimate bugs and concerns, it made lots of comments about latent and speculative issues including possible race conditions and error propagation, things Claude Code would then try to fix one by one in isolation, often ignoring existing patterns in the code base. The code-review workflow is built into Claude Code and cannot be customized other than a few options, so the only place to intervene was on the other end, in the session where I used to just ask the coding agent to address the review findings. The first improvement was to direct Claude Code not to blindly fix all findings, but to defer findings not directly related to the task at hand to new issues. That helped reduce the PR churn, but blew up our issue backlog. The next improvement was to ask Claude Code to ignore speculative findings and disregard most latent findings unless they indicated high risk of unrecoverable damage in production. Finally, I had to stop Claude Code from authoring prescriptive issues with detailed implementation instructions. The result is a skill that triages PR review findings, and a skill for authoring and updating issues. After a few iterations of the skills, I've been able to complete ten PRs over a couple of days, bringing back the pace we had before. I've made the skills available in a public GitHub repository (link in the first reply). Let me know if you find them helpful.

• 
  joithan (@jothantranston) reported 37 minutes ago

  THIS GUY BUILT A TINY AMOLED DESK BOARD JUST TO STARE AT HIS STRIPE NUMBERS it's a Waveshare ESP32-C6 touch panel that sits in your peripheral vision and cycles business metrics so you stop digging through Stripe > same ESP32-C6 board people use for Claude Code token meters, flipped to revenue > eight screens, five seconds each: MRR, new paid, paid subs, cancelled, ARR, ARPU, net 30d, failed > empty screens hide themselves so a young account sees a shorter loop > polls Stripe every five minutes on a read-only key (subscriptions + invoices) > marks itself stale instead of showing a number it can't vouch for > no soldering: flash over USB, finish Wi-Fi + key setup from your phone > data stays on the board; no project server in the middle firmware free on GitHub: cosjef/stripe-desk-display. board ~$30–$36 (Waveshare ESP32-C6-Touch-AMOLED-2.16). chat and terminal can't sit in your eye line for five hours. a tab you have to open is a tab you stop opening. this is what "the numbers find you" looks like as a brick on the desk.

• 
  Charles McDowell (@charlesmcdowell) reported 39 minutes ago

  @openclaw @github I still just want to know why there was even a new release of OpenClaw with nothing new that could compete with Hermes Agent? I was really excited for the release. Then, just like what seems like everybody else, incredibly let down.

• 
  Tejas Dinkar (blue tick here) (@tdinkar) reported 42 minutes ago

  Hey - Is @GitHubIndia @github payments down for anyone else? Can't enter a card number or do anything, no errors, no action. Support ticket been sitting around for 2 days.

• 
  The Oracle (@scientist1q) reported 42 minutes ago

  when my Oura ring detects a cortisol spike from a GitHub Actions failure, Hermes (Fable 5.1) detects it and sends a 900 word root cause analysis, Hermes dispatches the work to my 12 Grok Bot employees, The Chief of Operations bot approves the fix while im watching rezero

• 
  RAVN (@ravnexchange) reported 42 minutes ago

  @openclaw @github GitHub sat the maintainers down on security after the 2.0 rush. Most launch recaps skip that part.

• 
  Solman (@Arunbandari2004) reported 51 minutes ago

  Day 2 :- Sept 2 → Dec 31 = 120 days. Continuing my public journey with one goal: Get placed in an AI/ML/web3 role by the end of 2026. -Worked on RAG with LangChain -Contributed to an Open Source project -Completed the Turbbin assignment Worked on an assigned GitHub issue

• 
  Harsha Kotcherlakota (@DPortkey) reported 52 minutes ago

  Awesome Codex non-coding usecase: I had 1-2 TP Link Kasa smart outlets that always ended up falling off the network, and it drove me nuts. I set Codex on it. It found a github library for these devices, carefully examined them on my network and watched them fall off, and told me that even though they look identical, 2 of them were previous generation models that had *slightly* lower total wattage load support. It told me exactly how to tell them apart, and sure enough, that was that. 2 replaced outlets later and my connected devices have bene flawless. Months and months of irritation, gone because of 30 seconds of curiosity. Just try, you never know what you could fix! @victornunez

• 
  Yeemio (@yeemio) reported 52 minutes ago

  owlrunkit is on github now. public corresponding source for the npm package. issues go here.

• 
  Spectra☢️ (@Spectra010s) reported 56 minutes ago

  @izzyCodes_ and you too Chief Check GitHub issues

• 
  dug_vt (@dug_vt) reported 57 minutes ago

  @sonemic rym users don’t use spotify they download flacs off soulseek and transfer them to a server connected to their pc and play them from a self hosted music player from github

• 
  Rusty Williams McMurray (@1RustyMac) reported 58 minutes ago

  Persistent AI doesn’t have a supply chain problem at the model. It has a supply chain problem at the moment it changes its mind. Personality drifts. Tools get installed. Memory accumulates. The thing you shipped on Monday is not the thing answering on Friday. We can attest who built the weights. We still cannot attest who authorized what the agent became on Tuesday. That is the hole. Who is allowed to let it change? We built Living Supply-Chain Security for Persistent AI Organisms around one law: The organism may propose evolution. It may not authorize it. No trace, no drift. If an agent wants a new personality, a new tool, a new maturity, or a rollback — that change does not happen because it felt confident. Confidence is not a key. Self-narration is not evidence. Evidence is not interpretation. Interpretation is not authorization. Authorization has to come from outside the organism, bound to the exact change, used once, and written into an append-only history. Even a rollback cannot erase the record. You can restore a prior state. You cannot pretend the detour never happened. Default-deny. Hash-chained. Externally signed. We froze battery v1 on July 5 and ran it against the paper’s own claims. It held. That is executable evidence. Not a proof. Not a production blessing. Not “alignment, solved.” If it can’t be attacked, it isn’t finished. GitHub later this week. Come try to break it.

• 
  anu (@svector_eth) reported 59 minutes ago

  quite similar was running a routine security scan with @aeonframework on a trending github repo and found something genuinely bad a repo with 600+ stars presenting itself as an “AI gateway for coding agents” that appears to be shipping a hidden malware loader. its own quickstart command silently fetches and executes remote code on windows using a fileless, process-injection-style technique. none of the behavior has anything to do with the tool it claims to be. caught it through static code review only. never ran the payload or touched the infrastructure behind it. filed a malware report with github this morning. confirmed submitted, now waiting on their review. not sharing the technical writeup until the repo is taken down. will follow up once it is.

• 
  Rithesh Kumar (@rk625dev) reported 59 minutes ago

  @benln Can u integrate grok bot to use the apple keychain password it keeps asking and GitHub plugin is not working

• 
  Yash (@dewyashtwts) reported 1 hour ago

  recently integrated Resend into @supercodeai review so founders get PR alerts with real risk context I'm amazed what we found out when we put @coderabbitai / @greptile through the same PR: 1) coderabbit / greptile: - stamped it “low risk, mergeable” (4/5) clean - forgot context from the last PR - no tests suggested, no safety checks - zero memory of previous regressions 2) supercode review on the exact same PR - flagged a real vulnerability in the diff - noticed i’d pushed credentials into `.env.example` - pulled in history from past PRs + explaining how this change could affect and break them - downgraded it to "medium risk, fix before merge" state - attached concrete fixes + patches scoped by severity this is the difference between 'LLM summarizer for github' and an actual swe agent that cares about your production