Robert Clapp(@RobertClapp):cursor shipped grok bot 0.18.0 with runtime source maps enabled. someone reconstructed the source and published the repo. this is the same class of mistake as pushing a production build with debug symbols or leaving .env in the image. it happens because CI pipelines that work fine in dev don't strip everything for release. after zizmor flagged my npm publish job i pinned every github action to full commit SHA instead of mutable tags. the job that holds NPM_TOKEN and contents:write is the last place you want a swapped action or a poisoned cache. supply chain hygiene is boring until the one build where it isn't.

2026.08.25 18:21

cursor shipped grok bot 0.18.0 with runtime source maps enabled. someone reconstructed the source and published the repo. this is the same class of mistake as pushing a production build with debug symbols or leaving .env in the image. it happens because CI pipelines that work fine in dev don't strip everything for release. after zizmor flagged my npm publish job i pinned every github action to full commit SHA instead of mutable tags. the job that holds NPM_TOKEN and contents:write is the last place you want a swapped action or a poisoned cache. supply chain hygiene is boring until the one build where it isn't.