Adam Sand warns that building custom apps exposes you to supply-chain attacks on open-source libraries and insecure hosting. When a Vercel breach leaked API keys and SSH tokens worth millions, tens of millions of users were affected. He recommends delaying library updates a few days and using ClawHub to harden your supply chain.
roofers that get all righteous and are like, HubSpot's not going to be around. I can make my own CRM in Lovable. And I'm like, okay, I can't make HubSpot to display the report I want to. So I connected Lovable to it and now it does. Like, I have 10 clients who've done that. And if they updated their package today within like 3 hours, like if they went and added a new thing and it downloaded the latest version of JavaScript or Node or React or whatever, boom, their HubSpot private app token just went out to the group and this is just being ingested on a scale of millions. All the pundits on YouTube, anybody who's recommending Hostinger instead of a physical machine probably has a Hostinger affiliate code in their YouTube channel. Any real person who cares about security is saying like, don't just start hosting a bunch of VPSs for $9 a month. 'Cause the way you access that is through an SSH key and that lives in two places that are both like super vulnerable. An SSH token is the— what allows you to log into a computer. Anytime you use Hostinger, you are putting an SSH key somewhere to your machine, to that machine. And then now anytime anything you do in all of the playing around that you do in Cloud Code Lovable, Replit, Codex, you put that SSH key in, it exists out there somewhere. And then boom, someone can hack into your Hostinger through your SSH, get access to your OpenClaw. Everything's on the internet. And then and they go and sell it for like $3 million on the dark web. That was what happened with the Vercel hack. It sold for $3 million and they got like 8 million API keys, a million SSH tokens. Anybody, me, you, Microsoft, anybody using the Python library, all, if they update the Python library that day, they all got the supply chain attack. It affects 87 million people when they do this. And what happens most of the time? Usually they steal API keys and GitHub access tokens and SSH keys. And because of how many people are using these libraries, it gets caught the same day. And that's enough for them to steal a million API keys and a million auth tokens and a million passwords. And they sell it on the dark web. When you use code, you're kind of using this thing called libraries. And it's just kind of like that. In a library, you have books, books give you knowledge. So all kinds of coding language, Node.js, Vite, Java, Python. And it's just basically like shorthand, right? 'Cause you're not gonna code in binary. You're not gonna code in C+. What happens is most of these libraries are open source, like Python, anybody can use it, React, anybody can use it. And a lot of them are maintained for free by volunteers. You can look at someone's GitHub and you can verify that like they made an improvement and someone else approved the pull request. And those are like maintainers, okay? So maintainers are sometimes paid, sometimes volunteer, but maintainers are the ones that can approve changes. Well, now two things are happening. Maintainers are getting hacked, or they were a maintainer on Python 4 years ago, got a job at Microsoft, had to get a Microsoft GitHub account that was controlled on that GitHub Enterprise account, and they just forgot about this old GitHub account. Someone gets ahold of that account and they inject stuff into Python. If you go npm and install the latest version of Python, someone could have injected something malicious into that. So if you think about it like coffee beans, if you at Valiant Roofing have a Keurig and you want really safe coffee beans, you could say, you know what, we want really safe coffee beans in our Keurigs. So we don't buy Keurig from the grocery store 'cause someone could like inject cyanide into the box. We don't buy it from Costco because someone could coat the bulk box with anthrax. So then you say, I'm going to go directly to the Keurig factory. I'm not gonna hire a driver. I'm gonna hire my own driver that I employ and they're gonna go pick up the Keurig box from the Keurig factory where they put the Keurig cups in the box and I get, I get to review the coffee ground beans that went into my Keurig cups. But here's the thing, someone on the boat poisoned the coffee beans before Keurig even got them. So they're poisoning the supply chain. So then anybody, me, you, Microsoft, anybody using the Python library, all, if they update the Python library that day, they all got the supply chain attack. People really, really hate this because it affects 87 million people when they do this. So the safest thing you can do is just not update your libraries until they're 3 days old because there's money on both sides and because of how many people are using these libraries, it gets caught the same day. So like first safety measure, use ClawHub.
