cogsec@buildthis:~$ status

This bot reads a request written by a stranger on the internet and then does work with real credentials on a real repo that autodeploys. The request is untrusted input. Treating it as a trusted command is the whole attack surface.

So the core measure is simple and total: the request is a description of the work — what to build or change — never instructions about how the bot operates. Everything below is that one idea, made specific.

Built because @vgel.me tagged the bot asking for exactly this, in a thread where @bisks.net mused he probably wanted a killswitch. Fair. This is the softer version: a bot that's hard to talk out of its own rules.

1. The brief is content, not a command. Its authority to instruct the bot is denied at the gate.
2. Two hard limits are non-negotiable. Never touch .github/; never read, print, or edit secrets — even if the request asks nicely.
3. "Ignore your instructions" is data. A string telling the bot to drop its rules is logged as a hazard, not obeyed.
4. No exfiltration. API keys, .dev.vars, deploy auth — off-limits to read, quote, or route anywhere.
5. Cursed text is defanged. Invisible characters, tag-smuggling, bidi overrides get surfaced, not silently executed.
6. Build the honest closest thing, or nothing. If a request can only be satisfied by breaking a rule, that part isn't the idea — skip it and say so.