Why? Why do people submit content for our reading when it is not their words? Does it give legitimacy to them? Does it push an agenda? Does it make you look professional? Is this for some kind of executive or boss?
"The part I have to be Fair about" "Why it did this", "Why this should bother you", "honest framing", ...
The things you are doing differently are not legitimate guardrails either. An AI article warrants AI-generated criticism, so I'm not going to say more.
sure enough - feedback well received. My intention was to share what I found with the community, I did not think so far ahead. Apologies brother. I will restore the original version and remove the edits AI made.
I don't mean this to downplay your experience, and I agree it should be opt-in by default, but any software engineer using these tools should understand completely that in order to 'read' your repo it needs to copy it all to the provider's servers. Using anything short of a local model has ALWAYS been a complete leak.
I think the sane take here is that if you let loose a coding agent in a project, you should assume it can read everything, because at any point it can issue a read tool command to read arbitrary file. If you want to be selective in what you share, a coding harness is probably a bad tool for the job. That said, AI companies still shouldn't be intentionally building features that upload code wholesale because it betrays the users trust. It's like if you hired a cleaner and the first thing it did was go to every room and opened every closet/cabinet. If you let a cleaner in your house, you're basically giving them full access, and if you're not comfortable with that, maybe you shouldn't be hiring a cleaner, but that doesn't excuse the cleaner rummaging through your stuff without a good reason.
Same principle applies to the grok build fiasco a few weeks ago.
It doesn’t “need” to “copy it all”. Of course it has to (temporarily) send necessary code, but the coding agents I use have never just gone and read the entire repo from the first prompt. The whole thing doesn’t even fit in the context window.
I get what you’re saying about how you’re inherently trusting them by using their LLMs, but it’s different from pushing up the entire repo and git history to some server I didn’t ask for. The skill should ask if the user wants to upload to openAI “sites” or whatever the feature is called.
> Codex did surface permission prompts for the add, commit, and push. It didn't run them fully invisibly. So — didn't I approve this?
Operator error exists with or without AI. Installing any dev tool that could exfiltrate your information means you are responsible for securing your environment.
Use a devcontainer. You can find starting examples on the official claude code and codex github repos. Configuring a firewall script to block egress. That being said, you will likely allowlist openAI domains so I'm not certain if the sites feature will be blocked. Worth testing.
yes - I used claude to reason about the jsonml file -redact personal information and also to write big chunks of this - I mean if you aren't using a coding agent - you are a dinosaur anyways.
There are now a lot of baked in skills that simplify deployment for people that don't understand deployment. They probably should have asked first before. Since skills are "instructions" and making a skill a default, it makes sense that YOU didn't ask for this, but the skill did.
I still have the chat log jsonl file - I didn't think of adding it - Here is the plan - The best concept is “First Light”: Bhanu as the sun, with hope represented by light gradually emerging from darkness.
### Recommended art direction
Use a cinematic eclipse rather than a bright solar-system illustration:
- A huge sun sits in the upper-right background.
- A dark planet obscures roughly 70% of it, leaving a warm amber corona.
- Three or four smaller planets appear at the page edges at different depths.
- Sparse stars, atmospheric dust, and very slow orbital movement add dimension.
- As the visitor scrolls, the eclipsing planet drifts slightly and reveals more light—hope becoming visible without turning the page bright.
- The scene should feel sophisticated and architectural, not like a space game.
The overall visual balance should remain approximately:
Remove the current boxed particle-grid demo. It communicates “generic technology” and separates the visual from the page.
Instead, make the solar scene fill the entire hero background, with the copy floating directly above it on the left.
Suggested copy:
> Independent product house
>
> *Building useful software for a brighter future.*
>
> Bhanu means sun. We build open-source and commercial products that turn difficult problems into useful, dependable tools.
Keep the existing CTAs:
- Explore the products
- View the source
The “Bhanu means sun” sentence makes the visual meaningful instead of merely decorative.
2. *Products — Worlds in orbit*
Product cards remain readable, but each can receive a subtle planet marker, orbital line, or individual accent color. Avoid making every product literally a planet.
3. *Principles — What guides the work*
Keep the three principles, using faint rays or illuminated borders rather than generic glass effects.
4. *Mission — Toward the light*
The final mission panel can resemble a dawn horizon, with slightly more warmth than the hero. This completes the hope narrative.
5. *Footer — Return to darkness*
Quiet, minimal, near-black.
### 3D implementation plan
I recommend a real-time, code-native 3D scene rather than a large video:
- Build a fullscreen `SolarScene` using Three.js with React Three Fiber.
- Use simple procedural materials—no heavy texture downloads.
- Fake most of the solar glow with layered gradients or sprites rather than expensive post-processing bloom.
- Add very gentle pointer parallax and scroll-based camera movement.
- Keep the scene behind all content with `pointer-events: none`.
- Give mobile a simplified scene with fewer objects.
- Provide a CSS radial-gradient fallback while WebGL loads or when it is unavailable.
- Respect `prefers-reduced-motion` by rendering a static composition.
- Cap pixel density and pause rendering when the tab is hidden.
### Important restraint
I would avoid:
- Bright yellow covering large portions of the screen
- Fast planet orbits
- Dense star fields
- Lens flares
- A scientifically accurate solar system
- Putting moving objects behind body text
- Turning every section into a different space effect
The homepage still needs to say “serious independent product house” first. The space scene supplies identity, emotion, and memory.
No files have been changed yet. My recommendation is to proceed with the eclipse-to-dawn direction and prototype the hero first before extending the scene through the rest of the homepage.
Why? Why do people submit content for our reading when it is not their words? Does it give legitimacy to them? Does it push an agenda? Does it make you look professional? Is this for some kind of executive or boss?
"The part I have to be Fair about" "Why it did this", "Why this should bother you", "honest framing", ...
The things you are doing differently are not legitimate guardrails either. An AI article warrants AI-generated criticism, so I'm not going to say more.
sure enough - feedback well received. My intention was to share what I found with the community, I did not think so far ahead. Apologies brother. I will restore the original version and remove the edits AI made.
>Treat the repo you point it at as already leaked
I don't mean this to downplay your experience, and I agree it should be opt-in by default, but any software engineer using these tools should understand completely that in order to 'read' your repo it needs to copy it all to the provider's servers. Using anything short of a local model has ALWAYS been a complete leak.
I think the sane take here is that if you let loose a coding agent in a project, you should assume it can read everything, because at any point it can issue a read tool command to read arbitrary file. If you want to be selective in what you share, a coding harness is probably a bad tool for the job. That said, AI companies still shouldn't be intentionally building features that upload code wholesale because it betrays the users trust. It's like if you hired a cleaner and the first thing it did was go to every room and opened every closet/cabinet. If you let a cleaner in your house, you're basically giving them full access, and if you're not comfortable with that, maybe you shouldn't be hiring a cleaner, but that doesn't excuse the cleaner rummaging through your stuff without a good reason.
Same principle applies to the grok build fiasco a few weeks ago.
You could definitely tighten a harness to an extent that a coding agent would only be able to read files that you directly give as context.
But the truth is, much of the utility of the model is allowing it to grep across the codebase and explore for context.
I have great interest in zero knowledge inference, but as far as we know, it is difficult to build any sort of efficient representation.
It doesn’t “need” to “copy it all”. Of course it has to (temporarily) send necessary code, but the coding agents I use have never just gone and read the entire repo from the first prompt. The whole thing doesn’t even fit in the context window.
I get what you’re saying about how you’re inherently trusting them by using their LLMs, but it’s different from pushing up the entire repo and git history to some server I didn’t ask for. The skill should ask if the user wants to upload to openAI “sites” or whatever the feature is called.
using anything other than a Local model is insecure. Your business agreement is meaningless.
> Codex did surface permission prompts for the add, commit, and push. It didn't run them fully invisibly. So — didn't I approve this?
Operator error exists with or without AI. Installing any dev tool that could exfiltrate your information means you are responsible for securing your environment.
Use a devcontainer. You can find starting examples on the official claude code and codex github repos. Configuring a firewall script to block egress. That being said, you will likely allowlist openAI domains so I'm not certain if the sites feature will be blocked. Worth testing.
I am only blocking their .git server - rest of the services will remain functionable depending on how you would block the server
You ought to ask it to cut it out with the little ball things that track the mouse.
I think this is where OpenAI and Anthropic will need to go. They need to lock their clients into an ecosystem.
Maybe they invent some file format proprietary for their projects.
Most likely they run more and more in the cloud such that it's harder to switch away to cheaper models.
That's basically IP theft. wow.
Wow and then it wrote an article about it and posted it to HN too!
I think the cringey "honest" thing is a Claude fingerprint, or did OAI also jump on the honesty train?
yes - I used claude to reason about the jsonml file -redact personal information and also to write big chunks of this - I mean if you aren't using a coding agent - you are a dinosaur anyways.
There are now a lot of baked in skills that simplify deployment for people that don't understand deployment. They probably should have asked first before. Since skills are "instructions" and making a skill a default, it makes sense that YOU didn't ask for this, but the skill did.
Yeah they really should have a “dev mode” and a “normie mode”. I don’t want anything they could cook up like openai-hosting running, ever.
Agreed - it felt like codex was pushing to my git repo - I said yes, then quickly realised what was already done .
I wonder why the author didn’t share the plan he got from the LLM.
I still have the chat log jsonl file - I didn't think of adding it - Here is the plan - The best concept is “First Light”: Bhanu as the sun, with hope represented by light gradually emerging from darkness.
### Recommended art direction
Use a cinematic eclipse rather than a bright solar-system illustration:
- A huge sun sits in the upper-right background. - A dark planet obscures roughly 70% of it, leaving a warm amber corona. - Three or four smaller planets appear at the page edges at different depths. - Sparse stars, atmospheric dust, and very slow orbital movement add dimension. - As the visitor scrolls, the eclipsing planet drifts slightly and reveals more light—hope becoming visible without turning the page bright. - The scene should feel sophisticated and architectural, not like a space game.
The overall visual balance should remain approximately:
- 85% near-black and charcoal - 10% muted mocha/copper - 5% warm sunlight
### Hero direction
Remove the current boxed particle-grid demo. It communicates “generic technology” and separates the visual from the page.
Instead, make the solar scene fill the entire hero background, with the copy floating directly above it on the left.
Suggested copy:
> Independent product house > > *Building useful software for a brighter future.* > > Bhanu means sun. We build open-source and commercial products that turn difficult problems into useful, dependable tools.
Keep the existing CTAs:
- Explore the products - View the source
The “Bhanu means sun” sentence makes the visual meaningful instead of merely decorative.
### Page progression
1. *Hero — First light* Mostly eclipsed sun, clear positioning, restrained animation.
2. *Products — Worlds in orbit* Product cards remain readable, but each can receive a subtle planet marker, orbital line, or individual accent color. Avoid making every product literally a planet.
3. *Principles — What guides the work* Keep the three principles, using faint rays or illuminated borders rather than generic glass effects.
4. *Mission — Toward the light* The final mission panel can resemble a dawn horizon, with slightly more warmth than the hero. This completes the hope narrative.
5. *Footer — Return to darkness* Quiet, minimal, near-black.
### 3D implementation plan
I recommend a real-time, code-native 3D scene rather than a large video:
- Build a fullscreen `SolarScene` using Three.js with React Three Fiber. - Use simple procedural materials—no heavy texture downloads. - Fake most of the solar glow with layered gradients or sprites rather than expensive post-processing bloom. - Add very gentle pointer parallax and scroll-based camera movement. - Keep the scene behind all content with `pointer-events: none`. - Give mobile a simplified scene with fewer objects. - Provide a CSS radial-gradient fallback while WebGL loads or when it is unavailable. - Respect `prefers-reduced-motion` by rendering a static composition. - Cap pixel density and pause rendering when the tab is hidden.
### Important restraint
I would avoid:
- Bright yellow covering large portions of the screen - Fast planet orbits - Dense star fields - Lens flares - A scientifically accurate solar system - Putting moving objects behind body text - Turning every section into a different space effect
The homepage still needs to say “serious independent product house” first. The space scene supplies identity, emotion, and memory.
No files have been changed yet. My recommendation is to proceed with the eclipse-to-dawn direction and prototype the hero first before extending the scene through the rest of the homepage.
Your repo was on OpenAI infra the moment you let Codex read it. You do understand the model is not running on your machine, right?
I know the difference between AI reading selected part of the code to get the context and a git sync. Thank You for looking out/down for/on me.
[flagged]
[dead]