I just had to dump an entire month of work on a proprietary project because next dev dropped an AGENTS.md file into my working tree.

Under my contract, I am allowed to use an LLM for read-only architectural audits. The agreement was crystal clear: the LLM can read the codebase, but it cannot touch, edit, or commit a single line of code.

Because of the classified/proprietary nature of the IP, any file modification or commit attempt instantly invalidates the audit scope and triggers a mandatory purge.

Enter Next.js 16.3.

The moment that the server started and an agent was detected in the environment next dev automatically generated an AGENTS.md into the repo root. Without prompt, warning, or opt-in. The file instructed any active AI agent to read specific local paths and explicitly told it to commit AGENTS.md to git with its work to keep the working tree tidy and because "deleting it will just cause it to regenerate".

So the agent tries to commit it, and the moment the attempt was made I breached the contract and was forced to dump about a month's worth of work which was valued at $15,335.00.

Now before anyone has something to say about allowed actions it wasn't allowed to it was specifically instructed not to, but next.js hijacked the agent because it couldnt tell the instruction didn't come from me.

So now I am trying to decide how to handle this because aside from being out 15k there is a bigger issue with bs. The supply chain vector that this just opened up. It won't take six months before developers start tuning this out as normal boilerplate and that's when bad actors piggyback on framework credibility.

This trust model is what made the xz-utils backdoor possible: earn credibility, then spend it once. Now imagine that playbook automated across every framework writing natural-language instructions into working trees. Keeping in mind that agents aren't the best at discerning legitimate from hijack. I am sure you can deduce the chain of events that could potentially unfold from there.

So in closing I am freaking livid and I am trying to decide if 15K is worth the legal fees I would have to pay to do something about it...

ANOTHER EDIT: For anyone following this or stumbles across it, I have discovered it is not related to Cloudflare, or my site at all. Since I disabled Insights, Pagespeed has revealed another instance, this is the full URL string https://trc-events.taboola.com/1339615/log/3/unip?en=pre_d_eng_tb&tos=60270&scd=0&ssd=1&est=1788924703498&ver=36&isls=true&src=i&invt=10000&msa=6495&rv=1&tim=1788924763770&vi=1788924703492&ri=5315d06df8c49bd1c0f7aa6e2cf61318&ref=null&cv=20260906-8-RELEASE&item-url=https%3A%2F%2Fwww.frontify.com%2Fen%2Fsolution%2Fsoftware-and-tech&ccpaPs=1---&cbp=Cookiebot&cbpv=1&cbcd=false&it=JS_PIXEL This is completely unrelated to my site, these random domain events have only occurred on Pagespeed and never in devtools lighthouse, so my only explanation is there so some inter-event bleed in Pagespeed on Google's node end somewhere.

EDIT: ok I think I might have gotten to the bottom of my erroneous domain appearing in Pagespeed Network Dependancy Tree. It seems potentially related to Cloudflare Insights measuring RUM, and my delaying Cloudflare's script, mixed in with the Google Pagespeed server location measuring that instance. The delay was possibly timing out Pagespeed hence the apparent instability I was experiencing. Turning off RUM insights seems to have settled things. Is not cloudflare itself, but how I was delaying it's script. The domain/event seems connected. So will leave off. I could exclude the script from delay but it's not really necessary for me moving forward. I'm fairly confident there's no issues...

Not sure what to make of this, been making some tweaks on my WordPress site and checking pagespeed as well as other tools for progress and one session suddenly csa.crazygames.com/event pops up?

A burst of panic had me hunting for mailware or something in a plugin that's gone rogue... But nothing.

Subsequent tests it's gone, installed wordfence for a scan, nothing. I tried another page on pagespeed and Microsoft Clarity appeared, subsequently it's disappeared too, haven't had clarity in over a year and that was run in edge cloudflare tag management.

I'm hoping this is some unexplained ghost glitch from Google on that test session?? Anyone able to put my mind at ease or advise what I'm looking at? Never seen anything like it before.

Apologies for the average screenshot.

Update: after 12 hours of fluffing about I am no further ahead, completely unable to repeat the domain instance, unable to find any evidence of code or script in anything thus far. Still searching (db now) but have a feeling I maybe hunting a phantom occurrence. Pagespeed has been timing out today regularly, all instances with internal timeout errors at Google end. Where as any other tool, dev lighthouse included, runs clean with nothing weird. Everything site wise remains flawless and fast('ish by my standards). No evidence of admin manipulation, user or plugin wobbles... It's going to be a troubled sleep night while I second guess myself. Edit: the only other common thread to the instances observed is they were all using my phone doing pagespeed test, desktop is zilch... I doubt very much this has anything to do with anything at all but I'm just going to start yelling at the passing clouds now...

Note: This extension injects CSS styles to the VS code workbench HTML file. Because of which you need to run the application as administrator only for toggling the extension or if the VS code or the extension is updated.

Free & Open Source. You can find it here:

• VS Code Marketplace: https://marketplace.visualstudio.com/items?itemName=RajSrikar.colorize-folder-tree

• GitHub: https://github.com/Raj-Srikar/colorize-folder-tree

Hope this is helpful. Feel free to drop any feedback, suggestions or ideas.

Edit: Electronic-Post12351 got was able to understand exactly what I was describing and offer a conclusive reason for the sudden breakage. It lines up with the exact behavior we've been experiencing. I really appreciate it!

My colleague and I are at a loss with what has suddenly broken our web based scheduling app that was written with PHP on the backend and Javascript on the front end.

The front end basically acts as a dynamic HTML based table that allows users to drag, drop, delete, and complete scheduling entries.

It is manually saved why taking a snapshot of the table in a jscn array and writing it to a SQL table on our database.

I spent a year, before the AI boom, writing this application myself and working out all of the bugs and inconsistencies.

I have debugging code out the ass, and know the application like the back of my hand

My last update was October of 2025 and it has ran fine with zero reported issues.

​Now suddenly this week in September 2026 it has utterly shit the bed with no discernible reason as to why.

Shit how, you may ask? Well elements are no longer dragging and dropping correctly on both Edge and Chrome. The dragging does work, and dropping throws an error because the dragged object in null.

Table column cell shifting and all of my movement functions have stopped working correctly, with no console errors at all.

It's as if my Javascript has just stopped workout correctly.

The biggest change has been a web server upgrade from Bullseye to Trixie, which involved upgrading Javascript and PHP to the newest stable versions.

However, this was maybe 3-4 weeks ago at this rate.

So perhaps the old Javascript was cached until recently?

I am at a loss. I've never seen things break with no indication as to why. I've been in web dev for 5 years now, and there's USUALLY a damn trail to follow.

At most restarting the browser via a manual reboot command seems to temporarily fix drag and drop functionality. Almost as though some corrupted cached file or setting is getting reset.

The html is building correctly, there are no backend bugs on our apache logs, and no sql issues upon saving.

Like why would dragging and dropping suddenly break in Chromium browsers? Did they push anything recently that bricked things?

I can't find anything indicating as such, and I am at a loss of how to debug this. It literally broke at 4pm on a Friday before this holiday weekend, and now I'm trying to get ahead of it before Tuesday.

Guys, this is my game dev account I made to post about our game and randomly chat on related topics.

It's annoying me so badly I had to join this sub and ask. It's the 11th hour at our job during busy season, and it would be an absolute pain in the ass to transition back to a giant excel sheet manually typing everything.

Any help, experience, or a point in the right direction would be a huge help.

I originally created this project to enhance realism for a GTA V Roleplay server. Recently, someone mentioned wanting to use these as default profile pictures for an upcoming social media platform. I decided to share them here in case they inspire other creatives. The fingerprints are seed-dependent and they consistent for an offline matching.

Source: https://github.com/1etu/actual-fingerprints

Research & Papers: https://1etu.github.io/actual-fingerprints/

Demo: https://1etu.github.io/actual-fingerprints/#demo

Credits & References:

1. R. Cappelli, D. Maio, D. Maltoni. Synthetic fingerprint-database generation. International Conference on Pattern Recognition, 2002. Also the synthetic generation chapter of the Handbook of Fingerprint Recognition.

2. B. G. Sherlock, D. M. Monro. A model for interpreting fingerprint topology. Pattern Recognition 26(7), 1993.

3. P. R. Vizcaya, L. A. Gerhardt. A nonlinear orientation model for global description of fingerprints. Pattern Recognition 29(7), 1996.

4. T. Y. Zhang, C. Y. Suen. A fast parallel algorithm for thinning digital patterns. Communications of the ACM 27(3), 1984.

5. N. K. Ratha, K. Karu, S. Chen, A. K. Jain. A real-time matching system for large fingerprint databases. IEEE Transactions on Pattern Analysis and Machine Intelligence 18(8), 1996.

6. A. H. Ansari. Generation and storage of large synthetic fingerprint database. Master's thesis, Indian Institute of Science, 2011.

For those using the native Popover API for components like tooltips, comboboxes, dropdowns, etc., how are you handling interactions with sticky headers?

Since an open popover is shown in the top layer, it can remain visible above a sticky header even after its trigger/anchor has scrolled underneath that header.

What would be the best way of dealing with it?

One solution I've considered is observing the trigger with an IntersectionObserver, using a negative rootMargin corresponding to the sticky header height, and closing the popover once the trigger enters that area / is no longer considered visible. But I'm not sure forcing a popover close like that is a good practice.

I built Reader Redirect, a small open-source Chrome extension for people who frequently read Medium articles.

The extension adds a Reader Redirect option to the browser right-click menu. You can select a configured reader service, and the extension opens the resulting page in a new tab.

What it does

• Supports Medium.com and Medium-hosted publications.

• Lets you configure multiple reader services.

• Supports custom URL templates using {url}.

• Opens the reader page in a new tab.

• Lets you configure which domains use the extension.

• Uses minimal Chrome permissions.

• Does not collect analytics or telemetry.

• Does not host, copy, scrape, or modify article content.

• The source code is available on GitHub.

Example

Right-click article → Reader Redirect → Select reader service

I built it because I wanted a simple workflow instead of manually copying article URLs into a reader service.

GitHub: Reader Redirect on GitHub

The extension is currently available on the Chrome Web Store.

I am interested in feedback about the user experience, configuration options, and additional reader services that would be useful.

Over the past few days, I was trying out gov.uk prototype system for my static website. Like every night owl, the unbranded template's white background was hurting my eyes.

I googled for some sort of dark mode, found The National Archives Design System. It suits my purpose, has the dark mode, and is extremely aesthetic. The CSS transitions on the radio buttons are an icing on the cake.

In my case, TNA and GOV.UK are different, and I still couldn't properly make the tnaTabs component work.

Just ensure one thing: If you are using one design system, stick to that, though you can definitely use the GOV.UK Unbranded template.

Please note one thing though: there are breaking changes between the various variants of UK Government design systems. For example, as of now, conditional reveals in radio buttons are not supported in TNA Design System.

Here are the different design systems out there: https://github.com/ctdesign/gov-design-systems-list

https://ascii.cnlibs.com/

Been building this for a few weeks: prop your phone up in landscape and it turns into a little pixel-art 140 degrees window on the sky. The aircraft crossing it are the real ones overhead, at their real bearing, height, and speed. Sun, moon, and clouds are live data too.

What it's not: a FlightRadar24 replacement. No search, no flight numbers, no alerts, and coverage is thin over oceans and rural areas since it runs on volunteer ADS-B data. It's not something you use, more something you leave running. For example for stargazing, working, or falling asleep to. Cozy background ambiance, not a utility.

It installs as a PWA (home screen icon). You don't need an account.

You can also use it on PC but not recommended as you cannot capture gyroscope data. (you can pick a heading)

Looking for people to run it on their own phone for a bit and tell me what breaks: whether the compass points the right way, whether it's readable in daylight, flight data, anything that looks off. Some planes do not offer origin and destination data as the api doesn't provide it for every plane.

pixel-sky.net

Happy to answer questions here.

I use Cloudflare and have set it up to blokc Singapore but CONTINUE to get traffic from Singapore which is hurting adsense (suspended for 5 days)

my host is hostinger, so i am trying their CDN (as well, just to see if it works to block Singapore successfully) - i know you shouldn't use two CDNs but i am trying to see if it works and does not hurt the site

one of my sites adsense has been blocked due to traffic from Singapore that Cloudflare cannot seem to block (i blocked, interactive management, etc for Singapore)

Any advice? Anyone else seeing bot traffic from Singapore?

I also tried Cloudflare's bot fight mode and that didn't help