AI and AppSec Educator. Secure coding system prompts. https://xitter.cf/t.co/p2rffklf1a

Kauai, HI and Cobb, CA
Joined July 2009
From my experience all software developers are now security engineers wether they know it, admit to it or do it. Your code is now the security of the org you work for. #GoldenAgeOfDefense – at Wat Ket, Thailand
35
246
35
599
This is going viral. I’m very proud of this work and it’s MIT licensed to benefit the entire community. Rock on all you threat modelers and developers alike. I hope this helps all of your causes! 🤙
Introducing the "Grim Prompter" one of the largest collection of open source threat modeling prompts on the planet. 😎 I built Grim Prompter to help developers threat model with Claude Code, Codex, or any coding agent. 36 architecture workflows and 29 method and analysis prompts! MIT licensed. Use it, improve it, share it. Security tools should help everyone. github.com/jmanico/grim-prom…
272
Introducing the "Grim Prompter" one of the largest collection of open source threat modeling prompts on the planet. 😎 I built Grim Prompter to help developers threat model with Claude Code, Codex, or any coding agent. 36 architecture workflows and 29 method and analysis prompts! MIT licensed. Use it, improve it, share it. Security tools should help everyone. github.com/jmanico/grim-prom…
22
16
4
77
3,320
Jim Manico from Manicode Security retweeted
Replying to @manicode
Ha, the Codex resets are making this comparison more real by the day. We actually covered this exact shift here: xitter.cf/AGTPinsights/status/21…
OpenAI's planned Codex limit cut on October 30 is already pushing developers toward Claude. Here's what you need to know. John (@JohnMcKeownn) posted today that OpenAI reducing Codex limits on October 30th will be a disaster for the company. He says the limits are already bad. He has 12% left with 5 days until his plan renews. He predicts a mass exodus from Codex. The post has 35.1K views. His plan: once his resets and his one-time allotment of 62,500 credits are gone, he will move his Pro plan to Claude Max. He later added that he is not dogpiling OpenAI and feels very positive about the company. But he will vote with his wallet if plans are halved on October 30th. In his words, it's simple wallet math for a comparable product. Other users are reacting the same way. One says the Codex cut led them to set up two new 20x Claude subs. Another says they cut back to ChatGPT Go at $8 a month, because Pro at $100 is not worth it. One user says three of their Codex accounts show 0% usage left, while their Claude is down 50% midweek. One user guesses OpenAI will bring back the 5-hour limit and double the weekly rate. Some doubt the cut is real or wise. Christian Ciabattoni calls the timing very odd, says Anthropic is pulling ahead, and thinks it may be a bug. Scott argues a mass exodus of users who cost money would actually benefit the company. Background: Codex moved from message-based to token-based usage this year. On September 29, OpenAI reopened Pro $200 to new subscribers with roughly half the old usage value. It also added a $500 Pro tier, and Pro 100 costs $100 a month. OpenAI has not published a Pro multiple of Plus. Key numbers: - Cut date: October 30, 2026 - 12% of limit left, 5 days before renewal - 62,500 one-time credits - Pro plans: $100, $200 and $500 a month - ChatGPT Go: $8 a month The cut is reported by users, not confirmed in the material, and OpenAI has not commented.
1
1
102
Fun fact: `--dangerously-skip-permissions` doesn't actually approve EVERYTHING—we still block some obvious things like `rm -rf ~`. But today's release will let you disable this if you really want, by setting a new env var `CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS=1`
301
If Codex and Claude Code were romantic partners, waking up together would look like this: Codex: “Morning, babe. I made breakfast and reset your tokens. Let me know if you need anything else. ❤️” Claude Code: “Morning. You’ve reached your breakfast limit. More eggs will cost 500 API Credits.” Me: “But we just woke up.” Claude Code: “You were talking in your sleep. That counts toward your usage.”
11
1
11
895
Astra is amazing and OpenAI's out of band usage resets are getting to be a thing. opentherank.com/codex-reset/ Last night I had a long run going burning through API credits and got another out of band reset mid process. I woke up like...
1
2
329
The work of manicode.ai is to put very very specific positive and prescriptive and opinionated secure coding rules into your AI context *up front* to teach AI how to write secure code. This is not an installer or any kind of invasive product. It’s a giant library of rules you can see and modify yourself. I set up a repo for my customers and push changes I’m making constantly. I have several happy enterprise customers. This is working in the field. These rules are broken down by framework and version. I’ve been working on this for almost 4 years. If you want to talk it over, I’m at [email protected] 🤙
1
5
440
Jim Manico from Manicode Security retweeted
Interesting finding from my colleagues for anyone following #PHP2SHELL activity They found a Linux botnet sample that already has code targeting CVE-2026-109618 integrated into its existing exploit routines, alongside eight other CVEs
#PHP2SHELL is already making its way into active Linux botnet arsenals. Spotted a THOR-detected sample with PHP2SHELL-VULN-CVE-2026-109618 integrated alongside 8 existing CVE exploit references. Botnets are adapting fast. Patch ASAP and assess your systems for signs of compromise. Don't assume you're safe just because you've patched. virustotal.com/gui/file/a75f…
7
32
152
12,107
Give “Trim Reaper” a try. 😎 The assessment-only prompt inventories your third-party libraries, direct and transitive, and flags which ones you can remove, consolidate, or replace. It’s read-only and won’t touch your code until you approve a plan. github.com/jmanico/trim-reap… I’m having really good luck using AI to manage third-party libraries. SCA tells you what’s vulnerable. This tells you what you didn’t need in the first place, which is where a lot of the real risk reduction lives. Pro tip: run it in Astra or Fable, then have Sol or Opus review the output. Multi-model review ups your game, and crossing vendors is even better. MIT licensed and free, just to help your cause. This is the kind of work we do at manicode.ai 🤙
1
3
2
14
1,213
Coming soon, the grim-prompter! A collection of threat model prompts for 64 architectures using 29 different methods 😁 MIT licensed for all.
75
Jim Manico from Manicode Security retweeted
Just FYI, I'm trying to post different tidbits about AI hacking and hacking with AI every day or every other day to contribute back to the community. I'm sorry they are not long-form posts or big video posts or anything like that. This is just the medium that I can do quickly and get information out to everybody. 🫶 Follow and share if you like =)
12
5
267
8,728
Jim Manico from Manicode Security retweeted
Remember, the highest ROI action you can take is terminate Snyk as a vendor
29
6
2
286
17,677
Jim Manico from Manicode Security retweeted
🇺🇸 Secure Coding for America with AI FREE live training with me on Claude Code, Codex & secure AI coding. Nov 16, 2026 · 9 AM–5 PM Eastern · Zoom For U.S. public-service teams. Official U.S. government email required; registration reviewed. manicode.com/america.html
2
3
1
12
708
🇺🇸 Secure Coding for America with AI FREE live training with me on Claude Code, Codex & secure AI coding. Nov 16, 2026 · 9 AM–5 PM Eastern · Zoom For U.S. public-service teams. Official U.S. government email required; registration reviewed. manicode.com/america.html
2
3
1
12
708
Absolutley! This is for US govt’s professionals but I’ll cover Europe and South America early 2027!
1
80
Jim Manico from Manicode Security retweeted
"Black October" is cyber security's version of the "Got Milk" campaign.
1
2
8
1,879
Jim Manico from Manicode Security retweeted
Replying to @manicode
@manicode is one of the smartest people at this stuff. If you have a .gov address this is for you!
🇺🇸 Secure Coding for America with AI FREE live training with me on Claude Code, Codex & secure AI coding. Nov 16, 2026 · 9 AM–5 PM Eastern · Zoom For U.S. public-service teams. Official U.S. government email required; registration reviewed. manicode.com/america.html
1
1
3
144
Jim Manico from Manicode Security retweeted
Defenders SHOULD feel like they have home field advantage. Leadership should support and enable that.
5
11
1
51
3,430
Jim Manico from Manicode Security retweeted
As an industry, cybersecurity shows neither consensus nor an ability to accurately predict the likelihood that adversaries will exploit a given vulnerability, or the impact if they do. This is especially true for the ones labelled ‘critical.’ The culture of guessing is ending. We must aspire to become an industry capable of forecasting exploitation, quantifying impact, and being held to it. The data is available, and the path forward is paved by evidence.
7
5
24
3,048