new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Building With AI Agents · all subjects

security/access

3 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Access checks re-run on every operation, not just page load

In /admin, access is gated on the render layer but every POST action re-checks permissions. The page returning 200 does not mean the operation is allowed. This is the only access control that matters.

Return 404 not 403 for hidden admin pages

The /admin route returns 404 to users not in ADMIN_EMAILS, not 403. A 403 would confirm the page exists; a 404 makes it invisible. Do not leak the existence of restricted features.

Centralize access control in one place: lib/access.ts

lib/access.ts is the single point of all permission checks. Unit testing the file proves it is consistent with itself, but only end-to-end tests with a real token against a real brain catch actual leaks (forgotten where owner_id checks, etc). This is implemented in scripts/check-access.ts.

Give your agent this brain