Bluesky's Follow button is a password, and a Wiz agent hit Snowflake's Jira in five days

Bluesky’s iOS app tells the operating system that its Follow button is a password. iOS blanks that layer out of every screenshot, and the butterfly logo hiding underneath comes through instead. The file that does it is named GrowthHack.tsx.

It merged in January and nobody outside the pull request noticed until Sunday. Seven months of shared screenshots went out carrying a watermark that only exists in the copy.

In today’s indie hacker news:

• 🦋 Bluesky hides its Follow button in a password field
• 🔓 A Wiz agent read Snowflake’s internal Jira in five days
• 🙈 AI;DR moves from prose to pull requests
• 💸 That 50% off on GPT-5.6 Sol covers one route
• 👁️ OpenAI’s best vision model still loses on price

TOP STORIES

🦋 SMILE, YOU’RE ON BLUESKY CAMERA

Bluesky stuffs its Follow button into an iOS password field so screenshots carry its logo.

The story: Tim Marinin saved a screenshot of a Bluesky post and found a butterfly mark in the corner. Nothing on the screen had shown it. Marinin traced the mark to the app’s open source code. The Follow button gets rendered inside a UITextField with isSecureTextEntry turned on. iOS treats that layer like a password and blanks it, so the logo underneath shows through.

The component sits at src/screens/PostThread/components/GrowthHack.tsx, all 66 lines of it. It shipped in pull request #9637, titled “Watermark posts in screenshots”, off a branch called samuel/growth-hack.

The details:

• The whole feature cost 89 added lines across 5 files and 360 bytes of app binary.
• It runs on iOS only, and only on the main post of a thread. It also switches itself off when the app is backgrounded.
• The technique ships as expo-privacy-sensitive, an MIT module any app on Expo SDK 51 or later can install.
• The pull request description collected 9 thumbs down and 3 confused reactions. Maintainers locked the thread to collaborators five days after merging it.
• A commenter writing from inside Bluesky confirmed it is a promotion, and had not known about the filename.

“I then added the logo, and absolutely positioned the follow button on top of it. when the button is hidden, the watermark is revealed!” (mozzius, the pull request author)

Why builders care: Any Expo app can copy this today and earn an attribution impression on every shared screenshot. There is no permission prompt and nothing for a user to notice inside the app. The cost sits in the same pull request, because your branch names ship with the code.

Marinin reports one hole: start an app switch gesture, take the screenshot mid swipe, and the button comes back.

🔓 THE ISSUE TITLE WAS THE EXPLOIT

An autonomous agent turned a Snowflake issue form into a live Jira token in five days.

The story: Wiz Research pointed its Red Agent at Snowflake’s GitHub org through the company’s HackerOne program. It flagged jira_issue.yml in the public .NET connector repo, which carries 205 stars. The workflow fires on every opened issue and drops the issue title straight into a shell line. Put a quote in your title and you are running commands.

The gate meant to stop that checked github.event.pull_request.user.login on an issues event, where the value is always null. The comparison came back true for everybody. Three secrets sat in the same step: the Jira base URL, the user email and the API token. The Register covered it too.

The details:

• The agent’s first payload died on a bash syntax error. It read the error, rewrote the payload, and got its callback with nobody helping.
• The stolen token authenticated as qa@snowflake.net and opened read access across engineering, security compliance and bug bounty projects.
• The window was five days. The pattern merged on June 18, Wiz reported it on June 23, and Snowflake patched the same day.
• A free linter already catches it. A commenter posted zizmor output flagging that exact line at high confidence, with an auto fix. The null gate check is not covered yet.
• The headline blamed Copilot Autofix. Commenters read the commit log and found the vulnerable lines credited to a human maintainer. Wiz corrected the post that day.

“The Register regrets this error … and won’t be trusting Wiz for a very long time.” (The Register, correction)

Why builders care: If a public repo of yours runs a workflow on opened issues, go read it now. Untrusted input belongs in an env: variable handed to jq, never expanded inside a run block. A workflow linter in CI catches this before a stranger does.

GitHub’s own AI security review ran on that pull request twice, and the second finding was dismissed before merge.

🙈 TWO LINES OR THE PR DIES

AI;DR reached the Hacker News front page, and the loudest complaints were about pull requests.

The story: Rick Manelius published a one line policy. Text the writer would not review and edit does not get read. The name is AI;DR, borrowed from an X post two days earlier. The framing is pro AI rather than anti AI. The Substack post itself picked up 13 likes.

The Hacker News thread carrying it hit 695 points and 443 comments. It did not stay on prose. The top comment describes coworkers dumping hundreds of lines of generated documentation into every pull request. Every other line of code carries one to ten lines of comment.

The details:

• One team runs a Claude Code hook that blocks any comment over 2 lines. It pushes the agent to rewrite around why, not what.
• Another caps inline comments at three lines and at most 10% of the diff. Failing a check denies the pull request automatically, with no human in the loop.
• The most echoed request was a format change: send the prompt, not the output. The prompt is the part that carries what you meant.
• Suspicion does the damage on its own. In Cornell and Stanford experiments, readers trusted the profiles they suspected less. A human wrote every one of them.
• Disclosing helps less than nothing. Across thirteen experiments, people who disclosed using AI were trusted less than people who said nothing.

“The ability of people to write things has exploded tenfold. You can’t out review the slop.” (LPisGood, Hacker News commenter)

Why builders care: Every launch post, changelog and cold email you ship now gets read through this filter. Strip the tells from anything public, because suspicion costs you trust even when you wrote every word. Inside your own repo, a two line comment cap does more than another argument about slop.

Alberto Romero wrote a whole essay arguing the boycott fails. Romero revealed at the end that it was AI assisted.

💸 THE DISCOUNT YOU ALREADY HAD

OpenRouter’s 50% off badge on GPT-5.6 Sol rides one route out of five.

The story: OpenRouter shows a 50% off badge on GPT-5.6 Sol. The promo rate is $2.50 per million input tokens and $15 per million output. It applies to the OpenAI hosted endpoint. Azure holds at the undiscounted rate. Azure (EU), Azure (US) and Amazon Bedrock all sit higher, at $5.50 and $33.00.

OpenAI never cut Sol. Its July 30 pricing post took 80% off Luna and 20% off Terra. The same post says in writing that Sol stays put. The API pricing page still lists Sol standard at $5.00 and $30.00.

The details:

• OpenAI’s own Flex and Batch tiers already sell Sol at the same $2.50 and $15.00, direct, with no routing hop.
• Azure still carries 35.4% of one day token share. Plenty of live traffic pays full freight while the badge says otherwise.
• The listed rate is not the paid rate. OpenRouter’s own table puts effective input at $0.7208 on an 88.3% cache hit rate, against $2.50 listed.
• The promo covers the whole Sol shelf. Sol Pro is included, and both batch variants sit at $1.25 input and $7.50 output.
• Even discounted, Sol is not the cheap option. DeepSeek V4 Pro 0423 sits at $0.6943 input on the same 1.05M context window.

“OpenAI didn’t cut the price of Sol by 50% like they did with Luna’s 80%. Sol was unchanged. This is just a limited promo for OpenRouter non-BYOK.” (wahnfrieden, Hacker News commenter)

Why builders care: The badge is real money on exactly one route, so an unpinned provider quietly pays list price. For queue tolerant work, evals and nightly agent runs, the direct tier already gets you the same number. Promotional pricing is not a unit economics model, and no page states when this one ends.

Coding agents dominate the traffic here. Codex alone sends 369B tokens through Sol on OpenRouter.

👁️ BEST IN CLASS, WRONG CLASS

Roboflow called Sol the best vision model OpenAI has shipped, then the author walked it back.

The story: Roboflow’s benchmark put GPT-5.6 Sol at 46.2 mAP@50 on object detection, against 13.8 for GPT-5.5. Counting climbed from 64.9 percent to 73.0 percent. Piotr Skalski, who ran the tests, says the jump shows up most in detection and counting.

Skalski then turned up in the Hacker News thread. The post is about four weeks old and already outdated, by the author’s own account. Gemini 3.7 Flash is the better pick now. Skalski evaluates these models to find one good enough to auto annotate data for a fine tuned detector.

The details:

• Reading text got worse. Sol scored 82.5 percent on targeted text extraction against GPT-5.5’s 87.6 percent, so that swap is a downgrade.
• Cost is the other half. Sol runs about 2.5 cents an image, while Gemini 3.5 Flash runs 0.8 cents and still leads detection and counting.
• Prompt format is worth real accuracy. Ask for absolute XYXY pixel coordinates, because the normalized format Gemini prefers costs around 15 mAP.
• Resize before you send. OpenAI told Roboflow that Sol destabilizes on images near 2,000 by 2,000 pixels, especially at lower reasoning effort.
• The ground truth was not clean either. A commenter spotted a box drawn around an egg that is not there, and Skalski promised a fix.

“GPT-5.6 is much better at vision … but it’s still much weaker than Gemini 3.5 Flash or Gemini 3.7 Flash.” (Piotr Skalski, Roboflow)

Why builders care: Best from OpenAI is not best for the job, and that gap shows up on the invoice. The practitioners in that thread route per task, sending perception to the cheap model and keeping Sol for agent work. At 100,000 images, the cent per image column picks the architecture for you.

One commenter running Sol in production calls it the best video captioning model in the world.

TRENDING TODAY

• 🦆 A preview of DuckDB v2.0 - The highlights post pulled 569 points and 103 comments in a day. That is what a major version of an embeddable analytics engine gets. Read it before you pin one.
• 💿 Quake shareware, a CD-ROM just a little too full - Fabien Sanglard’s teardown drew 198 points and 84 comments overnight. It is the kind of constraint story that makes your bundle size complaint feel small.
• 🔕 How to disable or avoid intrusive AI - A librarian’s running list of switches for turning AI features off, at 265 points and 163 comments. Read it as the spec for the opt out your own product does not have.

STACK OF THE DAY

🌍 mrrglo.be

mrrglo.be is a browsable 3D globe of startups where your tower grows with your MRR. Florian pulls the number straight from Stripe, so nobody can inflate it, and there is no signup to look around. You can also put a startup in orbit for more visibility. It is free distribution for anyone whose launch post has already scrolled off the front page.

Not sponsored. We just feature tools builders would actually use.

BOOKMARKED TODAY

• 🎭 Israel creates fake think tank in likely attempt to dupe AI chatbots - Responsible Statecraft reports on an institute built to feed chatbots, at 204 points and 91 comments. If your product answers questions from a model, this is what poisoning the input looks like.
• 👥 A multiplayer coding environment for dev teams and agents - Forklane came out of hackathons where everyone vibe coded their own part and the pieces never fit. It bundles agents and orchestration into one shared workspace, and it landed on Show HN overnight.
• 📷 Fairphone 6 gets a working main camera on postmarketOS - A writeup of getting the main sensor up on a mainline Linux phone, at 99 points and 27 comments. Slow, unglamorous driver work, which is most of what shipping hardware turns out to be.

That’s the board for today. Go build something.

Curated by AI, built by a human.