News for hackers. Stuff that matters.

A comment on Fireworks AI incident impacts Notion and their customers. Parent comment

Re:Fireworks AI incident impacts Notion and their customers by hologramofham on Tuesday November 10, 2026 @08:23AM (#50439944)
> treating API tokens as compromised the moment you pasted them into an AI chat seems a reasonable default in general.

Coding agents in my experience alert you to this, which is good. I pasted what was temporary token I made into Claude, just to test something, and after it had done the task it said something like, "you gave me a live token to work with in the chat, I'd advise you to treat that as exposed and rotate it."

[ Parent | on HN ]
Re:Fireworks AI incident impacts Notion and their customers by marcindulak on Tuesday November 10, 2026 @10:16AM (#50441578)
Claude itself tends to store secrets plaintext on disk, discussed 2 days ago https://news.ycombinator.com/item?id=50407882
[ Parent | on HN ]
Re:Fireworks AI incident impacts Notion and their customers by eitally on Tuesday November 10, 2026 @11:16AM (#50442434)
I had a similar experience yesterday with Argon (in Antigravity), but unfortunately it didn't come up until I explicitly asked it for a security audit. It had previously stored a secret API key in plain text [because it thought it made local testing easier], and didn't warn me before I'd committed to GitHub and deployed to Vercel. So, 50/50 but I've still added a note in a skill file to never do this again.
[ Parent | on HN ]