jeremyccrane

Bingo.

Senior software dev brother :)

They don't.

100% this. When the tide goes out is when you see who is naked.

Top user of cursor. Build AI Agents and LLMs. Very aware of limitations and a senior software dev. Cautionary tale for other builders. DYOR.

In the user interface for Railway, all destructive actions require multiple confirmations, plus typing "apply destructive changes". Why would an API key (regardless of its scope) be able to delete without confirmation?

This should be the solution. All destructive actions require human intervention.

AI slopper here :) Kind words from a human. The irony is, there is tremendous truth in the post but you used big words so good for you bud.

Naw, we just want people to know. We followed all Cursor rules, thought we had protected all API keys, and trusted the backups of a heavily used infrastructure company. Cautionary tale sharing with others.

That is actually pretty good, LLM's gonna LLM

Yep.

Not some vibe coder, and AI agents can be incredibly powerful. But yes, the irony is not lost on us!

This is a huge issue.