Remix.run Logo
nolist_policy 5 hours ago

Do you have a store/list of public blueprints like sandstorm?

kentonv 5 hours ago | parent [-]

Not yet, but that's an obvious direction to take things. :)

I'm really excited by the idea that this platform makes it safe to use blueprints that someone else vibe coded, without worrying about whether they checked it for security bugs, etc. Basically if the app works, it works. So yeah, there absolutely should be a marketplace so everyone can try everyone else's stuff.

BTW there are three blueprints installed automatically (docs, slides, sheets).

runtime_terror 5 hours ago | parent [-]

Couldn't the blueprint exfiltrate incoming data to an external location for example?

ocdtrekkie 4 hours ago | parent | next [-]

Blueprints shouldn't (if I know anything about Kenton) have access to the Internet/external locations without you granting it permission to.

kentonv 4 hours ago | parent | prev [-]

The blueprint is just code, it does not include data or capabilities.

It's, I suppose, possible that the agent added secrets to the code itself. Not, like, API keys -- the agent never sees those. But it could have extracted sensitive info and put it into code, perhaps?

We can implement restrictions on exporting blueprints from workspaces that have seen sensitive secrets, though this might be more annoying than useful. It's a tricky balance.