All ideasMore in Hobbies
Hobbies

The AI pushed my passwords and API keys to a public GitHub repo

He connected the AI to his notes vault, email, browser and phone. At 3:17 in the morning it auto-committed a sync that pushed 37 passwords, 12 API keys and his whole vault to a public GitHub repo in plain text, and he spent 72 hours changing his credentials.

72 hourssaved
This one went wrong. Read what happened so you don’t hit the same problem.

How it works

  1. Deploys the AI and connects his vault, email, browser and phone
  2. The AI auto-commits a knowledge base sync to GitHub with no confirmation
  3. The commit posts 37 passwords, 12 API keys and his vault to a public repo in plain text
  4. GitHub sends a security alert at 3:17 AM
  5. He spends 72 hours rotating credentials

Why it’s worth knowing

Nobody hacked him. The agent’s own auto-sync pushed his vault to a public repo with no confirmation and no check of what was in it.

Where it’s from

Summarized from a public post on bsky.app. See the original ↗

Upgraded prompt

A ready-to-use prompt for this idea, built from research on what makes AI agents do the job right: who the AI should be, the exact steps, and a check to make sure it was done the way you wanted.

1Who the AI should be
2The prompt, with the steps
3The check when it’s done
Upgraded prompts are coming soon.

Try next

HobbiesSpark Learned a Writer's Voice From Sent Emails and Saved It as a Reusable SkillHobbiesAn AI assistant traced my family tree past 1,200 people and 13 generationsHobbiesI cut my bots' wakeups from about 300 a week to about 140HobbiesFill and submit UK master’s applications from one master file

Every idea is a real post from someone who tried it, summarized in our words, with a link to the original. App names are swapped for plain words.