Founder @sazabi ◆ Creator @cvedotnow ◆ o11y/Security/DevOps/Infra ◆ Early Eng @brexHQ ◆ 2x @ycombinator
SF
Joined May 2017
- Tweets7.7K
- Following5.3K
- Followers7.8K
- Likes13.1K
So I've been experimenting with using @sazabi to monitor my personal Hermes agent recently.
To do this, I added a implemented a dedicated Hermes log source integration for Sazabi, provisioned a Sazabi intake URL, and started piping logs from my Hermes deployment (which runs on Railway) to a Sazabi project.
Now I get alerts whenever there's a problem w/ Hermes which seems to happen often b/c Hermes is always trying to "improve itself" by committing changes to its own repo... In effect, Hermes commits suicide about 5 times/day. 😆
Anddd you guessed it, I pipe these Sazabi alerts directly to Hermes so that he can triage them + fix himself! 😲
Not only that, but I can use Sazabi to create pretty dashboards on top of my Hermes logs!!!
The screenshot below is a Sazabi dashboard that Hermes one-shotted using the Sazabi CLI... It shows Hermes' token + model consumption over the past 24h.
(My team informs me that Hermes is too expensive and I need to start cutting back. 😠)
Sazabi <> Hermes makes me happy ^_^
2
4
224
Fun fact: @cvedotnow has accumulated over 25k followers on X since launching last month. That's more than many of the top security startups!!!
Teams users are human too
🔌 Sazabi + @MicrosoftTeams
Issues land where your on-call team already talks.
- Issue cards in Teams channels, routed by delivery rules
- Mention @Sazabi in a channel and the agent investigates, then replies there with a link to the full thread
- A teammate who mentions the bot can join your Sazabi org as a standard member, once a tenant admin consents
🔗 Connect Teams: sazabi.com/integrations/micr…
ALT Sazabi integrations card: Microsoft Teams
146
New on @cvedotnow: a CLI 💻
Run one command in your repo and see which dependencies have known CVEs, grouped by the upgrade that fixes them.
npx cve.now check
1- Tells you if each one is direct or transitive, prod or dev. A critical in your test tooling isn't the same as one in your auth code
2- Fail CI on KEV, critical or high
3- Only package names + versions leave your machine. No login, no API key
npmjs.com/package/cve.now
ALT cve.now CLI card: npx cve.now check finds 91 known CVEs in an open-source Express app (54 prod, 37 dev) and lists the upgrades to do first.
See you tomorrow
Tomorrow night.
The SF Software Factory Meetup reconvenes - this time at Vercel's SF office for a special AI Engineer Code Summit edition!
- @FlyaKiet (@ParadevAI)
- @MelkeyDev (@vercel)
- @dexhorthy (@factory)
- @shcallaway (@sazabi)
Don't miss it.
🔗 Request a spot: luma.com/swmsjyp2
ALT SF Software Factory Meetup poster, AI Engineer special collaboration: Tomorrow 5:30-9pm, Vercel, downtown SF
1
1
218
New on @cvedotnow: CVE rankings 🏆
Hundreds of CVEs come out every day. A handful actually matter this week.
Rankings sort them by what makes a CVE dangerous right now: is it exploited, is there public exploit code, how many setups are exposed + is there a fix.
This week's #1: a CVSS 10 in GitLab that's on CISA KEV w/ a Metasploit module
cve.now/rankings
ALT cve.now CVE rankings card: #1 this week is a GitLab RCE (CVE-2026-97229, CVSS 10, score 89), on CISA KEV, Metasploit + 9 PoCs, EPSS 65%, fix available.
One of my best ragebaits ever
📸 SF2M lookback
"We deleted all our unit tests."
At SF2M vol. 1, @shcallaway walked through how Sazabi runs its own software factory. 800,000 lines of unit tests, gone.
AI-written unit tests lock in slop, slow you down and burn money. So we replaced them with tests the AI can't cheat on.
SF2M is back this Thursday at Vercel. 🏭
🔗 Request a spot: luma.com/swmsjyp2
2
11
522
Join us on Thursday for a lively discussion on this topic 😆
Just wanted to defend the term "Software Factory" for a second.
First, the caveats:
It's bullshit. It sounds fancier than it really is.
It's a bandwagon. People are using it to get you and their VC's hyped.
But it's also referring to a real change.
Earlier this year, most SOTA teams were using agents to work on the product. Shipping features, fixing bugs.
But now, they're building automations to help agents work on the product for them. They've moved up a layer.
What do we call the thing they're building? Loops? Workflows? Some other generic label?
"Software Factory" is as good a term as any other.
- "We're not working on the product, we're working on the factory that builds the product."
- "We're not product engineers, we're factory engineers."
I like it. I'll continue using it.
2
404
SF2M returns this Thursday ⚙️
T-77:30:00
Every engineering team is building a software factory now. Most of us are making it up as we go.
SF2M is where we compare notes: how teams wire agents into testing, code review, merges and production, what broke, and what they'd do differently. Short talks, no pitches, lots of networking.
Last time, @wuweiweiwu went deep on AI-powered QA and @abhiaiyer showed us Mastra's home-grown factory.
This Thursday: @FlyaKiet, @MelkeyDev and @dexhorthy, at Vercel during AI Engineer Code Summit week.
🔗 Request a spot: luma.com/swmsjyp2
2
7
476
47 CVEs landing at once 😵💫 @IBM
🆕 New CVEs
IBM products: 47 critical CVEs
Products: API Connect (46), Aspera Faspex (1)
Worst (API Connect): information disclosure via XXE in XML parsing (CVE-2026-16884)
Patch → see advisories
cve.now/CVE-2026-16884?relea…
s/o to those who are unfortunate enough to know what Microsoft Entra is
🆕 New CVE
Microsoft Entra Device Registration: privilege escalation in device registration (CVE-2026-109469)
An unauthenticated remote attacker can gain elevated privileges by bypassing authorization checks.
Patch → see advisory
cve.now/CVE-2026-109469?utm_…
7
963
inb4 @cvedotnow
AI can now help turn a published fix into a working exploit in hours. Patching still takes weeks, and for many old routers, cameras, and supermarket fridges, a fix never arrives.
"So the question isn't how to patch faster. It's how to stop needing to."
Six openings for new cybersecurity companies today, each one making patching "unnecessary, or someone else's job":
1. Live fixes: blocks an exploit on running systems within hours, then has AI write and ship the real code fix
2. An AI first responder: spots attacks without hand-written rules and contains them as they unfold
3. Per-request access: checks every request from a person or their AI agents, with credentials that expire in minutes
4. Proven recovery: keeps restoring your backups in a sealed-off test environment to prove they work, with records insurers will accept
5. An install gateway: holds and sandboxes every package, extension and AI agent tool before it can run
6. Security for the long tail: one managed service for water utilities, clinics and others that will never have a security team
Full piece from a16z's Asaf Ezra and Steph Zhang: a16z.news/p/defense-in-depth…
1
3
430
Some smaller stuff we shipped on @cvedotnow this week:
1- CVEs + early warnings in one feed
2- Share buttons on every page
3- cve.now/kev, /critical + /latest
4- Nicknames like cve.now/log4shell
