Safeguard on social

Where does your source code go when you buy a security platform? For regulated buyers that question comes before any feature demo. So we wrote the answer deployment by deployment. The new post covers SaaS in the US, EU (Frankfurt, Germany) and Gov regions, a single-tenant private VPC, fully on-prem, and air-gapped with models running offline. It also covers the local runner, which scans on your machine and sends back only the SBOM and findings, never source code. The AI mode (Full AI, Zero AI, bring your own model, local models) is a separate choice from hosting, so "no LLM anywhere" is possible even on SaaS. What to do today: list your data classes (source, manifests, SBOMs, findings, container images) and mark which ones may leave your network. That table decides your deployment model, and the post gives you a version you can paste into a questionnaire. Read it here: https://lnkd.in/gdNt5C7R #SupplyChainSecurity #DataResidency #CISO

A short one for anyone who has just been asked for a SOC 2 report. A big customer has sent a form that says "SOC 2 Type 2 report, yes or no", and there is no security team to hand it to. Mira and Cal start with a story from the auditors' own profession: in May 2026 the AICPA told peer reviewers to watch for SOC 2 engagements with identical reports, risk assessments, sample sizes and testing procedures. They explain why that matters when you pick your first CPA firm, and why only a licensed CPA firm can issue the report. Then the practical part. What a Type 1 and a Type 2 are, how long the observation window runs, and the populations an auditor asks for first: leavers and account removal dates, joiners and approvals, production changes and reviews. How to run an access review that holds up, why fewer policies beat a template pack, what to tell a buyer when you have no report yet, and how an answer bank and a trust center speed up the next review. Theo answers whether a Type 1 is enough for your first deals, and the episode ends with five things to do this week. If your startup needs SOC 2 for the first time, this episode covers what a SOC 2 auditor asks for first, how SOC 2 Type 1 and Type 2 differ, how long the observation window runs, and what evidence to keep. We also cover the AICPA peer review alert, what to ask a CPA firm before you sign, how to answer a security questionnaire without a report, and what belongs in a trust center. 00:00 Open, 00:28 Intro, 00:57 Incident, 03:28 Deep dive, 10:29 Corner, 11:43 Checklist, 12:53 Outro. Sources AICPA alert (https://safeguard.sh/resources/blog/soc-2-auditor-questions-after-aicpa-peer-review-alert?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep04) Evidence (https://safeguard.sh/resources/blog/soc-2-evidence-and-sampling-what-the-auditor-pulls?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep04) Window length (https://safeguard.sh/resources/blog/soc-2-type-2-observation-window-how-to-pick-the-length?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep04) Timeline (https://safeguard.sh/resources/blog/soc-2-first-report-timeline-with-sources?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep04) After Type 1 (https://safeguard.sh/resources/blog/soc-2-first-audit-failures-after-the-type-1-pause?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep04) Access reviews (https://safeguard.sh/resources/blog/soc-2-user-access-reviews-evidence-that-holds-up?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep04) Policies (https://safeguard.sh/resources/blog/soc-2-policies-for-small-teams-the-set-that-gets-used?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep04) No report yet (https://safeguard.sh/resources/blog/customer-asks-for-soc-2-before-you-are-ready-reply?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep04) Answer bank (https://safeguard.sh/resources/blog/sig-lite-and-custom-questionnaires-answer-bank?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep04) Trust center (https://safeguard.sh/resources/blog/trust-center-first-week-small-saas?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep04) SOC 2 page (https://safeguard.sh/compliance/soc-2?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep04) Topics: SOC 2, SOC 2 Type 1, SOC 2 Type 2, observation window, auditor, CPA firm, AICPA peer review, evidence, access review, trust center, security questionnaire.

Ten to three on a Tuesday. Dana has one critical finding in her repo and a code freeze at five. Mira and Cal walk through her whole afternoon with the Safeguard CLI: sign in, scan on her own machine, ask the assistant for a fix in ask mode, read the prompt, review the change, open the pull request, and let a teammate approve it. Three approvals, three different questions. In the news, two October stories: a Cloud Security Alliance note on how coding tools launch MCP servers (opencode, and GitHub Copilot in Visual Studio), and Anthropic's filing with the SEC. Under the hood, what stays on your machine, where else Safeguard shows up, and what to ask about any agent's approval prompts, with fair notes on Claude Code and Cursor. Theo brings one setting to check, and the episode ends with a try-this-today checklist. For developers trying AI coding agents: a hands-on look at coding with the Safeguard CLI, from a local scan to a reviewed fix pull request, with notes on Claude Code, Cursor and GitHub Copilot, MCP, permissions and approval settings, AI code security and DevSecOps. Chapters 00:00 Cold open 00:25 Intro 00:50 News: MCP launch paths and the Anthropic S-1 02:49 Dana's afternoon: three approvals with the Safeguard CLI 07:14 Under the hood, and what to ask any agent 09:17 Theo's one setting 10:17 Try this today 11:26 Outro Sources Cloud Security Alliance research note: MCP launch paths as RCE (openco: https://labs.cloudsecurityalliance.org/research/csa-research-note-mcp-launch-path-rce-opencode-copilot-20261/ Microsoft Security Update Guide: CVE-2026-103572: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103572 SEC EDGAR filing index, Anthropic, PBC Form S-1 (accession 0001628280-: https://www.sec.gov/Archives/edgar/data/2130357/000162828026067168/0001628280-26-067168-index.htm Safeguard CLI: overview (docs): https://docs.safeguard.sh/docs/cli?utm_source=podcast&utm_medium=audio&utm_campaign=permission-prompt&utm_content=ep01 Safeguard CLI: usage guide (docs): https://docs.safeguard.sh/docs/cli/usage?utm_source=podcast&utm_medium=audio&utm_campaign=permission-prompt&utm_content=ep01 Safeguard CLI: interactive terminal (docs): https://docs.safeguard.sh/docs/cli/interactive?utm_source=podcast&utm_medium=audio&utm_campaign=permission-prompt&utm_content=ep01 Safeguard CLI: slash commands (docs): https://docs.safeguard.sh/docs/cli/slash-commands?utm_source=podcast&utm_medium=audio&utm_campaign=permission-prompt&utm_content=ep01 Safeguard CLI site: https://cli.safeguard.sh/?utm_source=podcast&utm_medium=audio&utm_campaign=permission-prompt&utm_content=ep01 AI Remediate (docs): https://docs.safeguard.sh/docs/esscm/auto-fix?utm_source=podcast&utm_medium=audio&utm_campaign=permission-prompt&utm_content=ep01 IDE Support (docs): https://docs.safeguard.sh/docs/ide-support?utm_source=podcast&utm_medium=audio&utm_campaign=permission-prompt&utm_content=ep01 Desktop Application (docs): https://docs.safeguard.sh/docs/desktop-app?utm_source=podcast&utm_medium=audio&utm_campaign=permission-prompt&utm_content=ep01 Safeguard downloads: https://safeguard.sh/download?utm_source=podcast&utm_medium=audio&utm_campaign=permission-prompt&utm_content=ep01 Connect Claude to Safeguard (docs): https://docs.safeguard.sh/docs/mcp/claude?utm_source=podcast&utm_medium=audio&utm_campaign=permission-prompt&utm_content=ep01 Topics: AI coding agents, Safeguard CLI, AI code security, fix pull request, MCP security, agent permissions, Claude Code, Cursor, GitHub Copilot, vulnerability scanning, SBOM, DevSecOps, vibe coding.

Trailer for Permission Prompt, a weekly podcast on coding with AI agents and Safeguard: hands-on workflows, tips and fair comparisons with Claude Code, Cursor, GitHub Copilot and Codex, plus MCP, IDE extensions, the CLI and the security built in, from fix pull requests to package checks. Mira and Cal work through it so you can try it today. New episodes every Wednesday. Learn more at safeguard.sh: https://safeguard.sh/?utm_source=podcast&utm_medium=audio&utm_campaign=permission-prompt&utm_content=trailer Topics: AI coding agents, Claude Code, Cursor, GitHub Copilot, Codex, MCP security, prompt injection, vibe coding, AI code security, DevSecOps.

Trailer for Patch Monday, a weekly security news briefing in about ten minutes: the top vulnerability, breach, compliance and AI agent stories of the week, each with what to do on Monday. Mira and Cal cover zero-day and CVE news, KEV additions, SOC 2 and ISO 27001 updates, software supply chain attacks and AI coding agent and MCP security. New episode every Monday morning. Learn more at safeguard.sh: https://safeguard.sh/?utm_source=podcast&utm_medium=audio&utm_campaign=patch-monday&utm_content=trailer Topics: security news, zero-day, CVE, KEV, vulnerability management, SOC 2, ISO 27001, software supply chain security, AI agent security, MCP security.

Trailer for The Audit Window, a weekly compliance podcast for security, GRC and startup teams: SOC 2 Type 1 and Type 2, ISO 27001, HIPAA, vendor risk management (TPRM), audit evidence, compliance automation, security questionnaires and audit readiness. Mira and Cal explain what your auditor will ask for and what you can show them. New episodes every Tuesday. Learn more at safeguard.sh: https://safeguard.sh/?utm_source=podcast&utm_medium=audio&utm_campaign=the-audit-window&utm_content=trailer Topics: SOC 2, ISO 27001, HIPAA, TPRM, vendor risk, audit readiness, auditor, observation window, compliance automation.

28 October: Node 26 moves to LTS, and Node 27 starts its Alpha phase. A good day to check which Node line every service actually runs. From the Node Release working group schedule: Node 20 reached end of life on 30 April 2026. Node 22 ends on 30 April 2027. Node 24 ends on 30 April 2028. Node 26 ends on 30 April 2029. The 21 October 2026 security release covered 26.x, 24.x and 22.x. If a service sits on a line outside that list, it did not get those fixes. Two steps for platform and AppSec leads: list every service with its Node version, then find every place that version lives, base images, CI runners, serverless runtimes and build agents. Safeguard's SBOM lookup shows where a component and version sits across your estate. Our Node release history covers the io fork and merge, every LTS line, the permission model and how security releases ship: https://lnkd.in/gB_9pvXU Dates as of 26 Oct 2026, from the Node Release working group and https://lnkd.in/gHYhyD4F. #NodeJS #AppSec #DevSecOps

28 October: Node 26 moves to LTS, and Node 27 starts its Alpha phase. A good day to check which Node line every service actually runs. Node 20 ended on 30 April 2026. Node 22 ends on 30 April 2027. The 21 October 2026 security release covered 26.x, 24.x and 22.x. List every service with its Node version, then find every place that version lives. Safeguard's SBOM lookup shows where a component and version sits across your estate. Release history, LTS lines and security releases: link in bio (http://safeguard.sh/blog). #nodejs #appsec #devsecops #softwaresupplychain

A zero-day has no CVE record, no advisory and usually no fix, so a scanner that only matches your software against public feeds has nothing to match. Mira and Cal walk through why, using the September 2023 libwebp heap overflow: exploited in a zero-click spyware chain before any CVE existed, first filed as a Chrome bug, later rescored from high to critical, and buried inside browsers, Electron apps and mobile apps that many teams did not know they shipped. Then the practical part. How to detect what nobody has catalogued (static analysis with dataflow for your own code, a validated research pipeline for open source), how to rank a finding with no exploit score, why the fix should be a tested pull request that ships switched off until you turn it on, and what to do when upstream has no fix at all. Theo answers how to justify dropping everything for a zero-day, and the episode ends with six things a team can do this week. If you triage vulnerabilities for a living, this is a plain-English look at zero-day vulnerability management: why CVE and KEV based patching, SBOM matching and scanning miss an exploit nobody has catalogued yet, how to prioritise a vulnerability without an exploit score (EPSS and reachability analysis), and how remediation can ship as a tested fix for open source dependencies without waiting for upstream. Written for AppSec, DevSecOps and platform teams working on software supply chain security. Chapters 00:00 Cold open 00:32 Intro 01:01 The incident: why a zero-day leaves scanners blind 05:48 Deep dive: the loop, and fixing without waiting for upstream 12:36 Practitioner corner 13:48 Fix it this week 15:32 Outro Sources (published Safeguard research) Autonomous Novel Vulnerability Detection and Elimination at Scale (the episode's main guide): https://safeguard.sh/resources/blog/autonomous-novel-vulnerability-detection-and-elimination-at-scale-zero-day-discovery-autonomous-remediation-and-gold-open-source?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep01 libwebp heap buffer overflow zero-day (CVE-2023-4863): https://safeguard.sh/resources/blog/libwebp-heap-buffer-overflow-zero-day-cve-2023-4863?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep01 CVE-2023-4863: The libwebp Zero-Day That Hit Chrome and More: https://safeguard.sh/resources/blog/cve-2023-4863-the-libwebp-zero-day-explained?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep01 When Upstream Won't Fix It: Fork and Patch, Explained Honestly: https://safeguard.sh/resources/blog/fork-and-patch-vulnerable-packages?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep01 Links Safeguard: https://safeguard.sh/?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep01 Gold Open Source (free, no login): https://gold.safeguard.sh/?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep01 Safeguard blog: https://safeguard.sh/blog?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep01 More episodes: https://open.spotify.com/show/03400iIvo19RZbfRDfPECc The script was written by the Safeguard team and checked against our published research. Learn more at safeguard.sh. Topics: zero-day vulnerability, CVE-2023-4863, libwebp, WebP, Chrome, Electron, heap buffer overflow, zero-click exploit, spyware, Citizen Lab, CISA KEV, NIST NVD, vulnerability management, vulnerability prioritisation, remediation, fork and patch, SBOM, SCA, static analysis, open source security, software supply chain security, AppSec, DevSecOps, EPSS, reachability analysis, Safeguard Gold.

In August 2025, malicious releases of the nx build tool on npm ran a postinstall script that looked for AI coding CLIs on the developer's machine, launched them with their permission bypass flags, and asked them to hunt for wallets, SSH keys, .env files and credentials. The agents did what their flags allowed, and unless someone had turned on the agents' telemetry, there was no central record of what they were told or what they ran. Mira and Cal walk through the incident and why a process list alone can't tell an agent's work from an intruder's. Then the practical part for platform engineers and AppSec leads: what a coding agent actually does on a developer machine, what OpenTelemetry and OTLP are in plain words, which Claude Code and Codex events matter (tool decisions, and whether a person or a setting approved them), why prompt text should stay out by default, how managed settings stop developers redirecting telemetry, and how to stream it, plus Claude organization activity, into one place that someone reviews. Theo answers which agent actions to log at all, and the episode ends with five things to do this week. For platform engineers and AppSec teams worried about AI coding agent security: how Claude Code and Codex activity becomes an audit trail through OpenTelemetry (OTLP), what to watch when a malicious npm package abuses agent permissions, how MCP and managed settings fit in, and how to review agent activity for compliance and incident response. Chapters 00:00 Cold open 00:31 Intro 01:06 The incident: malware that put the coding agent to work 04:49 Deep dive: agent telemetry, from the laptop to a reviewer 12:35 Practitioner corner 13:38 Fix it this week 15:20 Outro Sources (published Safeguard research) Send Claude Code and Codex telemetry to Safeguard with OpenTelemetry (OTLP) (the episode's main guide): https://safeguard.sh/resources/blog/send-claude-code-and-codex-telemetry-to-safeguard-with-opentelemetry-otlp?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep02 Stream Claude audit and compliance activity into Safeguard: https://safeguard.sh/resources/blog/stream-claude-audit-and-compliance-activity-into-safeguard?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep02 Find and connect Safeguard from the official MCP Registry: verify the publisher and connect your assistant: https://safeguard.sh/resources/blog/find-and-connect-safeguard-from-the-official-mcp-registry-verify-the-publisher-and-connect-your-assistant?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep02 Safeguard MCP and frontier AI integrations: https://safeguard.sh/mcp?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep02 Nx npm package AI coding agent weaponization: https://safeguard.sh/resources/blog/nx-npm-package-ai-coding-agent-weaponization?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep02 Nx build system s1ngularity supply chain attack (2025): https://safeguard.sh/resources/blog/nx-build-system-s1ngularity-supply-chain-attack-2025?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep02 Links Safeguard: https://safeguard.sh/?utm_source=podcast&utm_medium=audio&utm_campaign=the-fix-window&utm_content=ep02 More episodes: https://open.spotify.com/show/03400iIvo19RZbfRDfPECc The script was written by the Safeguard team and checked against our published research. Learn more at safeguard.sh. Topics: AI coding agents, Claude Code, Codex, OpenTelemetry, OTLP, MCP, MCP security, nx npm supply chain attack, malicious npm package, postinstall script, agent permissions, credential theft, audit trail, incident response, DevSecOps, agent security.

28 October: Node 26 moves to LTS, and Node 27 starts its Alpha phase. A good day to check which Node line every service runs. Node 20 ended on 30 April 2026. Node 22 ends on 30 April 2027. The 21 October 2026 security release covered 26.x, 24.x and 22.x. Release history, LTS lines and security releases: https://na2.hubs.ly/H08ChfL0 Dates as of 26 Oct 2026, from the Node Release working group and https://na2.hubs.ly/H08ChfM0. #NodeJS #AppSec #Shorts

28 October: Node 26 moves to LTS, and Node 27 starts its Alpha phase. A good day to check which Node line every service runs. Node 20 ended on 30 April 2026. Node 22 ends on 30 April 2027, 24 on 30 April 2028, 26 on 30 April 2029. The 21 October 2026 security release covered 26.x, 24.x and 22.x. Release history, LTS lines and security releases: https://na2.hubs.ly/H08DS1q0

Coverage is exactly as wide as the sources you connect. We mapped every card on Safeguard's Integrations page: source code, registries and images, AI models and providers, uploads, and posture and security testing. Swipe for the map and a rollout order that starts with one code host and ends with the policies that matter on Block. https://na2.hubs.ly/H08CCJY0

Most teams connect their code host and stop. Coverage is exactly as wide as the sources you add. Swipe for every card on Safeguard's Integrations page, grouped by family: source code, images, AI, uploads, and posture and testing. The last slide is the rollout order we suggest. Every card is generally available. Link in bio: http://safeguard.sh/resources/blog #appsec #devsecops #supplychainsecurity #sbom

Most teams connect their code host, run a scan and stop. The images already in the registry, the models in a cloud AI account and the SBOM a supplier sent last quarter never get connected. Coverage is exactly as wide as the sources you add. Swipe for the map of every card on Safeguard's Integrations page, grouped the way the page groups them: Source code: hosted Git platforms, Subversion, Mercurial, Perforce and any Git URL. Images: cloud and self-hosted registries, Podman, Apptainer SIF and WebAssembly. AI: model hubs, cloud AI platforms, audit activity and OTLP from AI coding tools. Uploads: app binaries, manifests, SBOMs, CSAF/VEX and database change logs. Posture and testing: Package Firewall, DAST, IAST, API security, IaC, Kubernetes, cloud and database posture, Red Team, OSINT and VAPT from the CLI. Every card on the page is generally available, and every finding lands in the same Block, Warn or Notify gates. The rollout order we suggest: one code host with its CI route on Warn, then your production image registry, then Package Firewall in audit mode, then move what matters to Block. The full hub, with each card and what Safeguard does not do: https://lnkd.in/ggvYhzfj #AppSec #SupplyChainSecurity #DevSecOps

A verified name in the MCP Registry proves who published the record. It does not prove who runs the endpoint, or that the server is safe. Safeguard's MCP server is now in the official MCP Registry as http://sh.safeguard/safeguard. So here is how to check us, or any vendor, before an assistant gets access. The registry checks one thing at publish time: that the publisher controls the namespace. It does not verify the remote URL and it does not scan server code. Its own moderation policy says to assume minimal to no moderation. Four checks before you approve a connection: 1. Pick by name, not title. The title is free text that anyone can set. 2. Reverse the namespace. http://sh.safeguard reads https://lnkd.in/gt8u9BUM, the domain the publisher proved. 3. Match the remote URL to the vendor's own docs, and confirm its host sits on that domain. 4. Safeguard is a hosted server with no package. If a guide asks you to install one for a hosted server, stop. Then connect. In Claude, add Safeguard from the connector directory and read the sign-in page before you click Authorize access. A new Safeguard workspace starts with a small set of read-only tools. Everything else stays off until an administrator turns it on. The full walkthrough, with every command and its output, is in the first comment. #MCP #AppSec #AISecurity #SupplyChainSecurity

A verified listing in the MCP Registry tells you who published it. Not who runs the endpoint. Safeguard is now in the official MCP Registry as http://sh.safeguard/safeguard. Before you connect an AI assistant to any MCP server: Pick by name, not title. Reverse the namespace. Match the endpoint to the vendor's own docs. Hosted server? Nothing to install. Full walkthrough: link in bio. #MCP #AppSec #AISecurity #DevSecOps #SupplyChainSecurity #CyberSecurity #AIAgents

A verified name in the official MCP Registry proves who published the record. It does not prove who runs the endpoint, or that the server is safe. Safeguard is listed as http://sh.safeguard/safeguard, and this Short runs the four checks against our own listing: pick by name, not title; reverse the namespace; match the endpoint to the vendor's docs; and never install a package for a hosted server. Full walkthrough with every command: https://na2.hubs.ly/H08C0dK0 #Shorts #MCP #AppSec

A verified name in the MCP Registry proves who published the record. It does not prove who runs the endpoint, or that the server is safe. Safeguard's MCP server is now in the official MCP Registry as http://sh.safeguard/safeguard. So here is how to check us, or any vendor, before an assistant gets access. The registry checks one thing at publish time: that the publisher controls the namespace. It does not verify the remote URL and it does not scan server code. Its own moderation policy says to assume minimal to no moderation. Four checks before you approve a connection: 1. Pick by name, not title. The title is free text that anyone can set. 2. Reverse the namespace. http://sh.safeguard reads https://na2.hubs.ly/H08C0fG0, the domain the publisher proved. 3. Match the remote URL to the vendor's own docs, and confirm its host sits on that domain. 4. Safeguard is a hosted server with no package. If a guide asks you to install one for a hosted server, stop. Then connect. In Claude, add Safeguard from the connector directory and read the sign-in page before you click Authorize access. A new Safeguard workspace starts with a small set of read-only tools. Everything else stays off until an administrator turns it on. The full walkthrough, with every command and its output, is in the first comment. {{facebook_mention(437551772990200|#MCP)}} {{facebook_mention(126104680913617|#appsec)}} {{facebook_mention(387724268017738|#AISecurity)}} {{facebook_mention(464396337000651|#SupplyChainSecurity)}} https://na2.hubs.ly/H08C0dL0

An MCP Registry listing proves who published the record. Not who runs the endpoint, and not that the server is safe. We're now listed as sh.safeguard/safeguard, so check us like anyone: name over title, reverse the namespace, match the URL to our docs. https://t.co/P0SuczuNFg https://t.co/EAvzeW5bni