---
title: "AI & Tech News Digest — November 15, 2026"
description: "A 159,041-app audit of Lovable finds passports and 200K+ private messages exposed; Google's agent teams prove a 2013 conjecture; Node.js ships a 16-CVE drop."
date: 2026-11-15
categories: []
tags: []
---

## 1. AI News (Top 5)

- **A 159,041-App Audit of Lovable Finds Passports and 200K+ Private Messages Sitting in Public Databases (Nov 14)** — [crissyfield.de](https://www.crissyfield.de/research/lovable-en/) | [HN, 728 points](https://news.ycombinator.com/item?id=50499017)
 German security firm Crissyfield analyzed 159,041 Lovable projects pulled from Common Crawl (December 2025–September 2026): 34,545 used Supabase, and 24,664 of those shipped database records to the browser on first load without any login. Making further read-only requests with the same API key, they hit email addresses in 10,560 tables across 7,403 sites (30%). The worst finds: a service provider exposing 1,000+ records with passport numbers, expiry dates and nationalities; a German lifestyle forum leaking 80,000+ profiles plus 200,000+ chat messages; 280,000 customer emails; and AI-generated summaries of internal emails about tenants. The report updates a Handelsblatt investigation from November 2, and follow-up reporting notes the fixes so far don't close already-exposed data. If you shipped a Lovable (or any Supabase) app, check row-level security today — the platform's ease is not a security control.
- **Google's Antigravity /teamwork Proves a 2013 Conjecture — and Rewrote libgav1 in Rust 20–30% Faster Than C++ (Nov 13)** — [Google Research](https://research.google/blog/advancing-science-engineering-with-antigravitys-teamwork-feature/) | [HN, 185 points](https://news.ycombinator.com/item?id=50496811)
 The write-up covers months of multi-agent campaigns on Gemini 4 models: the 2013 Courtade–Kumar information-theory conjecture is now proven in full generality, formalized in 50 million lines of Lean 4; the Weil conjectures got an end-to-end machine-checked formalization (1.8M lines across 28,800 subagent invocations), alongside first formalizations of Hilbert's tenth problem over general rings (919K lines) and a Navier–Stokes blowup result. The engineering results are the practical part: /teamwork rewrote Google's libgav1 AV1 decoder into ~170k lines of Rust with bit-exact parity — initially 4× slower, then 20–30% faster than the C++ after giving the agents profiling tools — and finished a Zircon microkernel port with ~800k lines of safe Rust that boots on arm64. Google's Borg scheduler shipped two agent-proposed changes cutting TPU preemptions 24%. 10,000 academic researchers get six months of free top-tier access. The reusable pattern: parallel generators paired with hard falsifiers (Lean, test suites, hardware counters), never trusting the model's own judgment.
- **Gemini Decision 1: Google Prices a Model That Answers 1,000 Questions in One Pass (Nov 11)** — [Google blog](https://blog.google/innovation-and-ai/technology/developers-tools/gemini-decisions-api) | [The Decoder](https://the-decoder.com/google-joins-the-decision-model-wave-with-gemini-decision-1-scoring-1000-questions-in-a-single-pass) | [API changelog](https://aistudio.google.com/docs/changelog)
 Instead of generating text token by token, `gemini-decision-1` evaluates shared multimodal input against up to 1,000 independent yes/no, multiple-choice and scale questions in a single API call. Pricing is the story: $0.10 per 1M input tokens and $0 for output, with a no-cost AI Studio tier (200 requests, 50K input tokens per day) on the v1beta endpoint. It joins a fast-forming category — Microsoft's Decision-1 landed October 12, HeyGen shipped Decision 1 on November 13 — and r/LocalLLaMA is already wiring decision models as permission checkers for agents. If your agent pipeline routes, gates or moderates with a generative model, those calls now have a dedicated, much cheaper class.
- **Nvidia's Board Investigation Formalizes as Pre-Earnings Turmoil Deepens (Nov 14)** — [Nvidia statement](https://nvidianews.nvidia.com/news/statement-from-nvidia-board-of-directors) | [Yahoo Finance](https://finance.yahoo.com/markets/stocks/articles/nvidia-director-sold-nearly-1b-160000846.html) | [WSJ](https://www.wsj.com/tech/jensen-huang-colette-kress-nvidia-ceo-eb289097)
 The board confirmed an independent investigation into the reporting that ended Jensen Huang's 33-year run (resignation November 12, CFO Colette Kress now interim CEO). Yahoo Finance adds that Nvidia's second-largest shareholder, a director, sold roughly $946M of stock in the months before the scandal broke — with no trading plan flagged. The WSJ's long read details the internal fight: Kress pushed to scale back circular GPU-financing deals, and the $250B OpenAI guarantee was cut to about $125B. Nvidia reports Q3 earnings Tuesday, November 17 — the first call of the post-Huang era. If your capacity or pricing plans assume Nvidia stability, write the contingency line now.
- **Unsloth's Dynamic V3.1 Quants Claim 5–10% More Accuracy at the Same File Size (Nov 11)** — [Unsloth docs](https://unsloth.ai/docs/models/qwen3.8) | [HN, 245 points](https://news.ycombinator.com/item?id=50491980)
 The updated quantization algorithm re-cut Qwen3.8-27B GGUFs (2-bit through 6-bit) and claims 5–10% average accuracy gains at comparable sizes, benchmarked on Terminal Bench 2.1, DeepSWE 1.1, LiveCodeBench v6, GPQA Diamond and AIME25 at up to 256K context. New NVFP4 quants run ~1.5× faster than BF16 with 92–97% top-1 agreement on Blackwell GPUs, the 4-bit pack fits 16–19 GB of VRAM, and there's a 397 GB 1-bit build of the 2.4T-parameter Qwen3.8-2.4T-A95B for ~450 GB-RAM servers. The HN thread is a decent methodology seminar — Unsloth re-ran competitor comparisons over 14 trials after finding a rival's 100%-recovery claim held for exactly one run. Practical move: re-pull your quants before your next local benchmark; old quant sets are now a measured handicap.

*Also tracked: "The Claude Delusion" — a netmeister.org essay on what actually breaks when you hand your workflow to Claude, with a 190-comment thread arguing about it — [netmeister.org](https://www.netmeister.org/blog/claude-delusion.html) | [HN, 146 points](https://news.ycombinator.com/item?id=50496921).*

## 2. Developer & DevOps News (Top 5)

- **Node.js Ships a 16-CVE Security Drop Across All Three Release Lines (Nov 11)** — [Node.js advisory](https://nodejs.org/en/blog/vulnerability/november-2026-security-releases) | [apidog analysis](https://apidog.com/blog/nodejs-november-2026-security-release)
 Versions 26.13.1, 24.22.3 and 22.23.5 fix 16 CVEs, seven of them HIGH, and almost all sit in the http2, https and tls modules. The nasty one, CVE-2026-123864, lets an unauthenticated client read memory belonging to other connections; CVE-2026-123866 is a use-after-free in HTTP/2 stream teardown that can send freed response memory to the peer. This was the release pre-announced for November 11 with a HIGH top severity. If you pin image digests, queue the rebuild now — and remember that a floating `node:24` tag only picks this up after a real `docker pull`, not from a cached build.
- **Project Zero Kills Patch Soak Time: "Full 90" Now, Full 60 in February, Full 30 in 2028 (Nov 13)** — [Project Zero](https://projectzero.google/2026/11/disclosure-policy.html) | [HN, 215 points](https://news.ycombinator.com/item?id=50496051)
 Since 2021 the policy was 90 days to patch plus a 30-day rollout soak; that soak is gone. Vulnerabilities now publish 90 days after reporting, dropping to 60 days on February 2, 2027 and 30 days on January 3, 2028, with the grace period and variant policy removed — the only exceptions are in-the-wild bugs, already-public bugs, and vendor requests. The stated reason is LLM-shaped: attackers can turn a patch into an exploit in near-zero time, and Project Zero itself is finding several bugs a week where it once found a few a year. Read this as a mandate to shrink your vendors' acceptable patch SLAs — and your own.
- **PyPI Project Pages Get a Security Tab and Provenance Warnings (Nov 6, hit HN Nov 14)** — [PyPI blog](https://blog.pypi.org/posts/2026-11-06-ui-updates-complete/) | [HN, 225 points](https://news.ycombinator.com/item?id=50497892)
 Every project page now has a security tab grading releases as Full Provenance (100% of files carry Trusted-Publisher or SLSA attestations) or No Provenance, plus warnings for Incomplete, Inconsistent, Change of, and Loss of Provenance — states designed to surface account takeovers and hijacked publishing pipelines before you install. The release files tab adds filtering and flags files uploaded more than 14 days after release, and the OpenSSF-funded work is documented as a style-guide case study for other registries. Make it part of dependency review: a provenance warning on a package you don't recognize is now a five-second check.
- **FAA Ground Stop Post-Mortem: One Router and a Copper-to-Fiber Upgrade (Nov 14)** — [USA Today](https://www.usatoday.com/story/news/nation/2026/11/14/faa-ground-stop-probe-l3harris/92780406007) | [Fortune](https://fortune.com/2026/11/14/faa-ground-stop-telecom-router-cybersecurity-white-house-situation-room-national-security-apparatus-l3harris) | [NPR](https://www.npr.org/2026/11/14/nx-s1-6040952/faa-ground-stop-airplane-travel)
 Investigators are focused on a single router in the L3Harris-operated telecom network that carries ATC communications: the contractor was mid-way through a copper-to-fiber maintenance change when the router failed, the network rebooted and crashed, and the FAA ordered the nationwide stop. Fortune reports the disruption was alarming enough that the White House situation room activated; Transportation Secretary Duffy is framing the question as "incompetence or installation error," and L3Harris issued a statement pledging cooperation. The engineering lesson is unchanged from any of your incidents: a change window on one node had national blast radius because nothing between the change and the fleet could degrade gracefully.
- **Italy Fines Meta €805M (~$887M) Over Users' Data Access (Nov 14)** — [Reuters](https://www.reuters.com/world/italy-fines-meta-887-million-over-android-users-data-access-2026-11-14/) | [HN, 361 points](https://news.ycombinator.com/item?id=50497009)
 Italy's data-protection authority hit Meta with one of the larger GDPR fines of the year over how Meta services access Android users' data, with reporting centering on photo-linked data access. Meta will appeal, as it always does. The practical read for anyone running user-data pipelines in the EU: the enforcement bar for "what the app can reach" keeps rising, and data-minimization is cheaper than the fines.

*Also tracked: LinkedIn and Monster pulled over 1,000 fake job postings after a CBC investigation — the same fake-hiring channel behind the FBI's $400M crypto-theft warning last week — [CBC](https://www.cbc.ca/news/canada/linkedin-monster-take-down-over-1-000-fake-job-postings-after-cbc-investigation-9.7415379) | [HN, 233 points](https://news.ycombinator.com/item?id=50499723).*

## 3. Self-Hosting & Homelab (Top 4)

- **n8n Patches Five Advisories — Two Are Account Takeovers (Nov 13)** — [then8nblog roundup](https://then8nblog.com/news/n8n-weekly-roundup-2026-11-14)
 The two HIGH bugs are account-takeover paths: the invitation-acceptance endpoint lets a member take over pending user accounts, and a custom instance role with user-management permissions can seize the owner account. Fixes landed in 2.47.6 (stable), 2.48.3 (beta), 3.2.2 (3.x beta) and 1.123.96 — self-hosters should just move to 2.47.7, the current stable. The same week: 2.47 went stable with Public API rate limits, 2.48 beta made Claude Opus 5.5 the Assistant default, the Docker-only 3.x beta is at 3.2.2 with stable 3.x due early December, and 1.x support ends December 31, 2026 with no direct 1.x→3.x upgrade path. If you're still on 1.x, that's your migration deadline, not a suggestion.
- **Bluefin Server: a Cloud-Native Homelab OS With a Kubeadm Boot Menu (fall release)** — [Bluefin blog](https://docs.projectbluefin.io/blog/)
 The first of Bluefin's fall releases is a server image built the hard way — freedesktop SDK via BuildStream, pure disk-image artifacts instead of bootc, with NVIDIA and ZFS support — whose installer menu offers four lives: a minimal base, Homelab Control Plane (kubeadm + containerd + Argo Workflows + a KubeStellar dashboard, printing the cluster join passphrase on screen), Homelab Node (an auto-joining worker that can run diskless — the OS lives in the UEFI partition and RAM, so patching is a reboot via booty/kured), and a Home Server "pet" mode with Podman and Homebrew in an nspawn container. If you've wanted Kubernetes-at-home without hand-rolling Ansible, the glue is now baked into the image.
- **homelab-monitor v0.38.0 Adds a Policy-Gated AI Agent That Knows Your Lab (Nov 8)** — [Release notes](https://github.com/SikamikanikoBG/homelab-monitor/releases/tag/v0.38.0)
 The optional agent discovers models already on your network (Ollama, vLLM, llama.cpp, LM Studio, LocalAI) or takes your API key, then acts under a per-host policy: each host is Off, Passive or Active, and each action from a fixed catalogue (restart containers, prune images, unload Ollama models — no shell anywhere) is Deny, Ask or Allow, with unattended runs capped at three low-risk actions per target per day and every step exported to JSON/CSV. The same release adds an optional dashboard login with scoped API keys, strips secrets from backups, and — notably — turns off a `/api/hosts//run` endpoint that could execute shell commands on any LAN-reachable host. Worth reading as a template for "agent with a leash" design regardless of which monitor you run.
- **Is Self-Hosting Dying in Late 2026? The Data Says It's Growing Up (November)** — [virtualizationhowto.com](https://virtualizationhowto.com/2026/11/is-self-hosting-dying-in-late-2026-heres-what-i-seeing-for-home-labs/)
 A field answer to the recurring "self-hosting is dying" takes that follow every survey season: the author's read is consolidation, not decline — home labs are standardizing on fewer, more production-shaped stacks (Proxmox with Ceph, k3s clusters, compose files with real S3 backups) instead of running thirty half-maintained apps. It pairs with last week's selfh.st survey threads where Portainer's slide and Forgejo overtaking Gitea were the live arguments. Useful calibration if you're re-organizing a lab this winter: fewer services, better backups, boring infrastructure.

*Also tracked: PeakCut, self-hosted AI clipping for long videos and live streams that runs on your own API key, crossed 200★ within a day of release — [GitHub](https://github.com/haziqahmedqasmi/PeakCut).*

## 4. Trending GitHub Repositories (Top 10, last 7 days)

| # | Repo | Stars | Lang | One-line |
| --- | --- | --- | --- | --- |
| 1 | [Moh4696/cinematic-skill](https://github.com/Moh4696/cinematic-skill) | 422★ | Python | Agent skill that builds narrated cinematic films entirely from code — one continuous camera over photos, maps and cards, timed to the voice |
| 2 | [op7418/guizang-game-skill](https://github.com/op7418/guizang-game-skill) | 343★ | JavaScript | Agent skill for Claude Code/Codex that builds a playable browser 3D action game with AI-generated assets — demo included |
| 3 | [fengyiqicoder/awesome-fable-5.2](https://github.com/fengyiqicoder/awesome-fable-5.2) | 290★ | — | Curated list of 162 live games and sites built with Claude Fable 5.2, every link checked, plus 117 video demos |
| 4 | [gabrielbuzziv/emissor-nfse-nacional](https://github.com/gabrielbuzziv/emissor-nfse-nacional) | 245★ | TypeScript | Issue Brazil's national NFS-e invoices straight from the government API on your own Cloudflare account, with no per-note cost |
| 5 | [egoist/tinytraffic](https://github.com/egoist/tinytraffic) | 231★ | Go | Self-hosted web analytics in a single binary, from longtime open-source dev egoist |
| 6 | [fendouai/ViralForge](https://github.com/fendouai/ViralForge) | 174★ | TypeScript | Agent-native viral-video studio: deconstructs short-video hooks into a "Viral DNA" report and ships ten costed variants |
| 7 | [molly554/whiteboard-ai-tutor](https://github.com/molly554/whiteboard-ai-tutor) | 155★ | HTML | Open-source AI tutor that teaches on a whiteboard, with a blind-reviewed 288-lesson benchmark of Claude, Gemini and DeepSeek |
| 8 | [DeskLabs-OpenSource/DeskVoice](https://github.com/DeskLabs-OpenSource/DeskVoice) | 115★ | TypeScript | Open-source phone PBX operated by AI agents — it answers, runs tools mid-call, consults a human and keeps working after hangup |
| 9 | [IluvatarLabs/sitrep](https://github.com/IluvatarLabs/sitrep) | 91★ | TypeScript | One live console to monitor Claude Code and Codex agents across machines, tracking context, spend and blocked sessions |
| 10 | [claynicholson/copper-kicad-mcp](https://github.com/claynicholson/copper-kicad-mcp) | 87★ | Python | MCP server that lets any AI app design real, orderable KiCad boards — schematic, LCSC parts, routing and JLCPCB fab files |

*Also tracked: the general trending page is farmed out again — dozens of same-day clones of "IPTV_Player_2.0", "GitHub-Copilot-app" and "ai--manus2.0" at ~665★ with 12 forks and identical blurbs, plus the Blender-AI-copilot cluster now grown to ~390★ a copy at 5–8 forks. Verify before you star.*

## 5. Hacker News Top Stories

1. **SpaceX catches the Starship to end Flight 15** (949 points, 651 comments) — [SpaceX](https://www.spacex.com/launches/starship-flight-15) | [discussion](https://news.ycombinator.com/item?id=50500963)
 Flight 15 ended with the tower catching the vehicle, and the thread is the biggest of the day — equal parts launch discussion and reuse-cadence math.
2. **Tech companies are trying to shift the concept of privacy again** (516 points, 182 comments) — [EFF](https://www.eff.org/deeplinks/2026/11/tech-companies-are-trying-shift-entire-concept-privacy-again) | [discussion](https://news.ycombinator.com/item?id=50496602)
 EFF on the latest round of redefining "privacy" in vendor terms; the thread maps it onto what's actually collected in 2026.
3. **Monkey Island: all 13 versions side by side** (470 points, 150 comments) — [monkeyisland.pages.dev](https://monkeyisland.pages.dev/) | [discussion](https://news.ycombinator.com/item?id=50493904)
 Every released version of the classic playable in one page — a lovely bit of preservation engineering.
4. **KDE: The documentary [video]** (423 points, 91 comments) — [tube.kockatoo.org](https://tube.kockatoo.org/w/fFinNHfanLT7aBEb2B8y4c) | [discussion](https://news.ycombinator.com/item?id=50496976)
 A feature-length look at three decades of KDE; the comments fill in the history the film skips.
5. **A family tree of software job titles** (257 points, 126 comments) — [zwischenzugs.com](https://zwischenzugs.com/2026/11/03/a-family-tree-of-software-job-titles/) | [discussion](https://news.ycombinator.com/item?id=50499038)
 Where SRE, platform, DevOps and "full-stack" actually diverged — the comment section is a careers war map.
6. **How did Woz write the Apple 1 BASIC before building the computer?** (156 points, 63 comments) — [retrocomputing.stackexchange.com](https://retrocomputing.stackexchange.com/questions/17957) | [discussion](https://news.ycombinator.com/item?id=50501594)
 A resurfaced deep-dive on hand-assembling a BASIC in a notebook — weekend reading that makes your CI problems look small.

*Also tracked: Will we put data centers in space? — a Forethought research review, carried by 184 comments on 61 points — [forethought.org](https://www.forethought.org/research/will-we-really-put-data-centers-in-space) | [discussion](https://news.ycombinator.com/item?id=50498945).*

## 6. Reddit Highlights (Top 5)

- **r/sysadmin — FAA national ground stop (Advisory 111): the official advisories and statements so far, in order** — [Thread](https://www.reddit.com/r/sysadmin/comments/1xvmtvj/faa_national_ground_stop_advisory_111_the/) — The cleanest public timeline of the outage: L3Harris-operated telecom infra, a reboot that crashed, and every official statement as it landed.
- **r/LocalLLaMA — Is anyone using decision models as a permission checker?** — [Thread](https://www.reddit.com/r/LocalLLaMA/comments/1xvxziy/is_anyone_using_decision_models_as_a_permission/) — Operators putting small decision models in front of dangerous agent permissions; pairs directly with Gemini Decision 1 above.
- **r/LocalLLaMA — I ran the same Halloween animation prompt through five coding agents on one local Qwen model** — [Thread](https://www.reddit.com/r/LocalLLaMA/comments/1xv5dsb/i_ran_the_same_halloween_animation_prompt_through/) — A same-hardware coding-agent bake-off with full server settings disclosed, useful if you benchmark agents locally.
- **r/technology — Nvidia director sold nearly $1B in stock weeks before the Jensen Huang scandal broke** — [Thread](https://www.reddit.com/r/technology/comments/1xvvahe/nvidia_director_sold_nearly_1b_in_stock_weeks/) — The thread parses the filings and the missing trading plan; read it before Tuesday's earnings call.
- **r/videos — FAA issues national ground stop due to "extraordinary circumstances"** — [Thread](https://www.reddit.com/r/videos/comments/1xvn3w8/breaking_faa_issues_national_ground_stop_due_to/) — The live Friday-night thread, with ATC audio and community tracker links while the official channels went quiet.