2026-04-15

• #0002

  #0002Models & APIOpenAIlast month

  OpenAI evolves the Agents SDK with sandboxed execution and a model-native harness

  80radar

  Agents SDKSDK — built-in sandboxing and native harness

  OpenAI is upgrading the Agents SDK with native sandbox execution and a model-native harness for secure, long-running agent workflows. For indie developers, this suggests lower infrastructure burden when building agents that need to work across files and tools more safely.

  • —Native sandbox execution implies stronger security isolation for agent actions.
  • —A model-native harness suggests tighter orchestration between the model and runtime behavior.
  • —Indie developers may be able to ship multi-step, long-running agent products with less custom backend work.

  Source: openai.com/index/the-next-evolution-of-the-agents-sdkRead original →
• #0001

  #0001Infra & SaaSHacker News · MRRlast month

  `Fiverr` exposed customer files via public `Cloudinary` URLs

  40radar

  CloudinaryMedia CDN — optimized image and file URL delivery

  Sensitive client-worker files were served with public Cloudinary links and ended up indexed in Google, including tax forms and other PII. If uploads can contain anything regulated, unsigned asset URLs are a straight production risk, not a convenience tradeoff.

  • —Cloudinary was used like object storage for PDFs/images in messages, but Fiverr chose public URLs over signed or expiring links.
  • —Search results reportedly surfaced hundreds of exposed files, and example queries included tax-document terms such as form 1040.
  • —The report says notice went to security@fiverr.com and 40 days passed without reply, which is its own vendor-risk signal.
  • —The practical takeaway is simple: treat file delivery paths like auth surfaces, especially when uploads may contain PII, contracts, or financial docs.

  Source: news.ycombinator.com/item?id=47769796Read original →