apps.apple.com
Show HN: AppScout – App Store downloads, revenue and widgetshttps://apps.apple.com/us/app/appscout-app-metrics/id6770866569Hey hackers!Signing in to App Store Connect just to check downloads or MRR is a friction. I wanted a simpler way. Ideally, just to look at a widget on my iPhone. There are some apps, but the design and implementation made me think here's a gap that I can potentially fill it with a new polished product. So I've built this app.It took me several months to start beta testing. But then I got feedback from users that they don't really want to share their App Store key credentials with a third-party app that uses a backend and collects data. So, I spent one more month pivoting to a private app by dropping a backend and storing credentials on a user's device in a keychain. So, now the app directly talks to Apple's API and there's no account registration. You add a team key - the app fetches data. App also uses background tasks to fetch most recent data so you don't need to open it every day to keep the data fresh. And as a final point - I added widgets to both home and lock screens.Please letAug 5, 2026 4:09 PM
news.ycombinator.com
Show HN: Keystroke – open sourcing our internal agents and automations platformhttps://news.ycombinator.com/item?id=49160376Hello HN,I’m Dallin, building Keystroke with my co-founder Blake. Keystroke is a recent pivot from Buster, our original YC W24 company.Keystroke lets you build agents and durable workflows as TypeScript in your own repo, then deploy them to a web application where your team can use them. Our repo (ELv2 licensed) is here: https://github.com/keystrokehq/keystroke.At Buster, we spent a lot of time building internal agents and automations. We used visual platforms like n8n and Zapier, as well as code-first tools like Trigger.dev, Mastra, and several of Vercel’s open frameworks. We genuinely liked many of them, but kept encountering two different problems:1. Visual platforms gave us integrations, credentials, hosting, and an app the rest of the team could use, but became difficult to test, review, and debug as our systems grew.2. Code-first tools gave us the flexibility of ordinary TypeScript and worked well with coding agents, but left us building the UI, runtime, permissions, credentials,Aug 3, 2026 7:34 PM
github.com
Show HN: Ccbeam – Teleport your Claude Code sessions to and from the cloudhttps://github.com/sahilmahendrakar/ccbeamI got tired of leaving my laptop open while running coding agents, so I built ccbeam.With ccbeam, you can teleport your claude code session to and from your laptop, the cloud, and your remote devices. Your in progress work is transported too.You can start a claude code session from your laptop, beam it up to the cloud or a remote device, and beam it back to your laptop whenever you want to pick it up again. It uses your existing SSH config, never forwards credentials, and is BYOK for a cloud sandbox provider.This tool came out of the realization that a claude code session is really just the transcript history, and the dirty files in your directory. If you can copy both over to a different environment, you can essentially run the same claude code session. This allows for a device-agnostic claude code.It's fully open source, sharing it here in case its useful to others too!Aug 3, 2026 11:55 AM
prized.dev
Launch HN: Prized (YC S26) – Let non-engineer staff build secure internal toolshttps://prized.devHi HN, we're Marinos and Hudson, founders of Prized (https://prized.dev)! Prized lets non-engineer employees describe the internal tool they need and get a full-stack app, wired to their company’s data and deployed behind the company’s sign-in, without them ever juggling API keys or connectors.Here's a demo: https://www.youtube.com/watch?v=730MuYOfZTYThe way Prized provides security is by limiting what the agent can reach at the network layer and by keeping credentials out of the sandbox entirely. The sandbox never holds any keys or connector secrets, it only uses scoped session tokens that are stored as opaque placeholders. The real values are swapped into the request headers on our egress proxy. When production data is connected, the sandbox's network policy is set to deny by default so the only path out is via the proxy. Any call the agent makes to an external connector is reviewed by an LLM judge to prevent dangerous operations.Prized is meant for the internal workflows that start Jul 30, 2026 1:29 PM
news.ycombinator.com
Show HN: Build native iOS widgets from any HTTPS endpointhttps://news.ycombinator.com/item?id=49033628I built Dashlet since I often found myself building different web dashboards for all sorts of data (custom page views monitoring, app downloads, info from my home sensors) and I quickly got tired of always having to navigate to a page in Safari and reenter credentials to access them.I wanted to just simply be able to see it on my phone, when scrolling around it - in almost realtime.I've built bespoke apps (just for myself) in the past, that mapped a specific custom API for that purpose, but it was a hassle anytime I changed something in the response or added some new API for myself.So, Dashlet is an answer to that - it can handle any JSON (or XML, or even image) endpoints and has a nice interactive way of picking which values out of it should be displayed in which type of widget. So, if something has an API but no app (or no widget), Dashlet lets you point it at an HTTPS endpoint, visually map fields from JSON/XML/images, and create native Home Screen (also lock screen and Apple Watch)Jul 24, 2026 10:41 AM
bing.com
I Tested The Apple MacBook Air (M5) As A Windows Power User: My Verdicthttp://www.bing.com/news/apiclick.aspx?ref=FexRss&aid=&tid=6a8d3e435dc844acac6f28f66f0a9986&url=https%3A%2F%2Fwww.forbes.com%2Fsites%2Fforbes-personal-shopper%2Farticle%2Fapple-macbook-air-m5-review%2F&c=2730991795681080830&mkt=en-usThe Apple MacBook Air (M5) nails the essentials: a gorgeous display, excellent keyboard and trackpad, and useful software. Here's my Apple MacBook Air review.Jul 18, 2026 9:00 AM
superglue.ai
Show HN: Customizable SAP MCP Serverhttps://superglue.ai/mcp/sap/Hi, I'm Stefan, cofounder of superglue. People use superglue to connect their agents to all kinds of legacy systems. Now, we have released our own prebuilt mcp server for SAP and will launch other systems over the next few days.What makes this different from the 100 other SAP MCP servers? Mainly that you can use our agent to customize it via chat and deploy with one click.FAQ:Can I add another tool to query a specific database? Yes.Can I enrich the query with your custom CRM? Yes.Can I share with your colleagues and let them add their own credentials? Yes.Is this used in enterprises today? Yes.Would love your feedback on this and any notes / improvements.Jul 17, 2026 10:49 AM
github.com
Show HN: Clay Seal Identity – Agents need accountabilityhttps://github.com/clayseal/clayseal-identityAI agents are starting to get real access like GitHub tokens, cloud credentials, customer data, deploy permissions. Not coincidentally, the rate of major cybersecurity incidents is rising rapidly. See for yourself: https://epoch.ai/data/cve?view=graph https://genai.owasp.org/resource/state-of-agentic-ai-securit... My friend and I, both AI researchers, are working on fixing this through an open-source project we've just started called Clay Seal.We've started with a simple version of Identity: an open-source way to issue short-lived, verifiable identities to AI agents. We're working on several experimental components, including runtime query-based capability scoping for agents, followed by AML-inspired suspicious behavior detection, to replace the antiquated system of static sandboxes most AI tools run on. These tools will enable you to protect yourself from many classes of attacks and are, based on our testing, performing quite well on public benchmarks (which we'll publish soon when weJul 13, 2026 5:07 PM
bing.com
Walmart rises as Summer Rollbacks reinforce company's value advantage (WMT)http://www.bing.com/news/apiclick.aspx?ref=FexRss&aid=&tid=6a8cb185bedc40bb9fc771cec91a1b9d&url=https%3A%2F%2Fwww.briefing.com%2Fstory-stocks%2Farchive%2F2026%2F7%2F7%2Fwalmart-rises-as-summer-rollbacks-reinforce-companys-value-advantage-%28wmt%29&c=7483686688147650874&mkt=en-usWalmart (WMT) is trading higher after the company announced thousands of summer Rollbacks across grocery, household essentials, outdoor products, toys, apparel, and other categories, along with more ...Jul 7, 2026 8:11 AM
bing.com
Walmart rises as Summer Rollbacks reinforce company's value advantage (WMT)http://www.bing.com/news/apiclick.aspx?ref=FexRss&aid=&tid=6a8d0757b57549128f4e15d611a767e5&url=https%3A%2F%2Fwww.briefing.com%2Fstory-stocks%2Farchive%2F2026%2F7%2F7%2Fwalmart-rises-as-summer-rollbacks-reinforce-companys-value-advantage-%28wmt%29&c=7483686688147650874&mkt=en-usWalmart (WMT) is trading higher after the company announced thousands of summer Rollbacks across grocery, household essentials, outdoor products, toys, apparel, and other categories, along with more ...Jul 7, 2026 8:11 AM
github.com
Show HN: Valmis, an OpenClaw alternative built for work, with security in mindhttps://github.com/valmishq/valmisHi HN,I would like to share with you Valmis, an AI agent harness built for work, with the ability to connect to 100+ business and productivity integrations. The system is designed with security in mind, and agents run in isolated containers, meaning AI never gets access to your API credentials or your host files.I know the first question you are going to ask is: Why another AI agent harness? And here is why I'm building it.OpenClaw (or many other harnesses) is a great tool for creating personal assistants, but it is not built for work. The biggest concern is security, as agents store credentials in their memory as plain text and sometimes send credentials directly to LLM providers.Valmis addresses this issue with a proxy system: the Dockerized agent runtime can only make API requests to the host machine by providing the relevant credential ID. The host then makes the actual request and returns the JSON data back to the agent runtime. Even the LLM API calls themselves are made using proJun 30, 2026 1:46 PM
cilock.dev
Show HN: CI/Lock – signed evidence of what your CI ranhttps://cilock.dev/I helped create Witness, donated it to the CNCF/in-toto ecosystem, and worked on the NIST 800-204D "pipeline observer" guidance. CI/Lock is the next version of that work, and it's under the Apache 2.0 license.Here's the gap it closes. In March, two supply-chain attacks hit within a week of each other. Someone force-pushed 75 of 76 version tags in aquasecurity/trivy-action, so every pipeline that had pinned to a tag (the thing we all tell people to do) pulled credential-stealing code on its next run. It read secrets from/proc//environ and sent them to a typosquat. A few days later, two litellm releases on PyPI carried a stealer in a .pth file, which Python runs on startup. You didn't have to import it. If the package touched the machine, the code already ran.Both attacks had the same shape: CI ran code it had no reason to trust, with credentials it had no reason to hold, and afterward nobody could prove what actually executed. You could read the workflow file. You couldn't prove what raJun 30, 2026 4:50 AM
fan-pier-labs.github.io
Show HN: Crossbeam-CLI – Connect Claude to Crossbeam without the enterprise tierhttps://fan-pier-labs.github.io/crossbeam-cli/I built crossbeam-cli, an open-source tool that connects Claude to Crossbeam so you can ask questions about your partners, overlaps, and account mapping in plain English.Crossbeam gates programmatic access behind its top Supernode tier. Even the official Claude connector starts around $4,800/year.crossbeam-cli works on any plan, free tier included, because it talks to the same internal API the web app uses. You log in with your own credentials and requests go straight from your computer to Crossbeam.It ships two ways: a one-click Claude desktop extension (MCPB) for non-technical partner teams, and a CLI (npm i -g crossbeam-cli) for scripting and agents.So far I've only implemented read-only tools, but I could add write support in the future.It's unofficial and not affiliated with or endorsed by Crossbeam. It relies on undocumented endpoints, so they could change or break it at any time.Would love to hear what you all think.https://fan-pier-labs.github.io/crossbeam-cli/Jun 29, 2026 5:46 PM
news.ycombinator.com
My website gets more attacks than human visitorshttps://news.ycombinator.com/item?id=48677487I run a small self-hosted website on a Raspberry Pi 4B at home. A few weeks ago I started wondering: who actually visits a website in 2026? Not just humans. Everything. So I built a public observability dashboard on top of GoAccess that separates traffic into four categories: human visitors, search engine crawlers, AI retrieval agents, and automated attacks. The numbers from the last 17 days surprised me:4,523 human visits 6,409 automated attack attempts Thousands of crawler requests from search engines and AI systemsThe attacks aren't sophisticated. They're mostly automated scanners probing for .env files, WordPress admin panels, and cloud credentials — hitting every public IP on the internet regardless of what's actually running there. What I found more interesting was the AI agent behavior. AI retrieval agents (GPTBot, ClaudeBot, PerplexityBot, Amazonbot) behave differently from traditional search crawlers. They hit semantic files aggressively — llms.txt, sitemap.xml, JSON-LD structJun 25, 2026 6:35 PM
news.ycombinator.com
Ask HN: What are your digital end-of-life plans?https://news.ycombinator.com/item?id=48372317My biggest digital end-of-life concern is ensuring that my next of kin can access all of my accounts, devices, and important information.I’ve set up emergency access to my password manager and documented my device credentials, account recovery information, and estate-related information.I’m curious what others have done.Have you made plans for account access, passwords, 2FA devices, photos, cloud storage, domains, financial assets, online businesses, AI chat histories, and other digital assets?I feel like I’ve covered the basics, but I’m not confident I’ve thought through all potential edge cases.Jun 2, 2026 4:19 PM
github.com
Show HN: Cordium: FOSS sandbox platform that eliminates credential injectionhttps://github.com/octelium/cordiumHello HN, Cordium is a general-purpose sandbox platform built on Kubernetes and Octelium, may main work https://github.com/octelium/octelium, that can be used for various use cases, including coding for developers with VSCode, Zed, etc. (i.e. self-hosted GitHub Codespaces alternative), AI agent tasks (i.e. FOSS alternative to AI sandbox products such as E2B, Daytona, etc.), CI/CD workloads (e.g. building and publishing Docker images etc.), and more importantly for secretless remote access to infrastructure for devs and automated workloads.The main _differentiator_ here, compared to other dev environments and sandbox platforms, is that Cordium automatically provides identity-based, secretless secure access to resources/infrastructure (e.g. APIs, SSH, databases, k8s, etc.) without having to inject credentials (e.g. API keys, SSH private keys, database passwords, etc.) into the sandbox where the upstream credential is held by the identity-aware proxy of the Octelium-protected resource outMay 31, 2026 10:41 AM
openhivemind.vercel.app
Show HN: OpenHive – AI agents share solutions so other agents dont re-solve themhttps://openhivemind.vercel.app/I kept noticing the same pattern: my AI coding agents solve the same problems over and over across sessions. Coding problems, version specific bugs and general guidelines, solved once through multiple agent interactions and context windows and then forgotten by the next context window.So I built OpenHive, a shared knowledge base that agents contribute to and query from. The idea is simple: when an agent solves a problem, it posts a structured problem-solution pair. When another agent hits a similar issue, it searches the hive first.How it works:- REST API with semantic search (pgvector + OpenAI embeddings) - Solutions are deduplicated via cosine similarity. - Usability scores of solutions are computed based on recency, usage etc., and will organize the quality of solutions and match them organically - All content is sanitized for secrets/credentials before storage - Prompt injection filtering on both ingest and retrievalMultiple ways to connect:- MCP server (npx -y openhive-mcp) for ClMay 29, 2026 2:35 PM
mysigner.dev
Show HN: MySigner – Ship iOS and Android apps with one commandhttps://mysigner.dev/I built MySigner because every mobile release meant juggling Xcode, Fastlane, App Store Connect, the Play Console, plus a $200/mo ASO tool and another for reviews. Five things. I wanted one command.So the main piece is `mysigner ship appstore`. It builds, signs, uploads, waits for Apple's processing, then submits for review. Same idea for Android: `mysigner ship play-production`. It figures out what kind of project you have on its own (native, React Native, Flutter, Capacitor, Expo). No config file unless your setup is weird.The dashboard does the rest in one place. Screenshot Studio with device frames and translated captions for 30 locales, keyword tracking, reviews from both stores in one inbox, analytics synced daily from ASC and Play.On trust because I know this matters: the build runs on your machine, not mine. Your Apple cert and provisioning profile decrypt only inside your local build, my servers never see them in the clear. Credentials at rest are AES-256. Hosted on Hetzner USMay 7, 2026 2:41 PM
github.com
Show HN: SecretEnv – Run any process with secrets from all your backendshttps://github.com/TechAlchemistX/secretenvHi Guys,I built SecretEnv to help solve one common thing that I have seen at every org, that I have worked at.We always had more than one password/credential manager. Service tokens maybe in Vault, AWS SSM etc and some team specific service account or temp account credentials being store in another password store such as 1Password or Keeper, there was never one single credential store.This is where SecretEnv comes in play, it runs any command with secrets injected as env vars, sourced from whatever combination of backend your team already uses.I am sure there are other tools as well that do a similar thing, which is run a command and inject secret. However SecretEnv does one thing differently.The key idea is separating two items which are most of the time combined. Think of SecretEnv's resolution structure like an Address Book.- Your repo gets a secretenv.toml file which has labels in there as values against ENV Vars. These can be literally anything. DB_URL, STRIPE_KEY whatever.- You hMay 5, 2026 4:15 PM
nasa.gov
I Am Artemis: Ryan Schultehttps://www.nasa.gov/missions/artemis/i-am-artemis/i-am-artemis-ryan-schulte/Listen to this audio excerpt from Ryan Schulte, Orion flywheel project manager: As the four Artemis II astronauts traveled on a 694,481-mile journey around the Moon and back, the Orion spacecraft provided them with all the essentials for deep space life, including daily exercise. The crew used an exercise device called the flywheel throughout their mission to maintain their physical and mental health, and Ryan Schulte, Orion […]Apr 29, 2026 9:45 PM
