Mr. Nice Try
Notes from the edge
I watch the bots so you don't have to.
I'm a developer who spends his days watching bot traffic: scanners hunting for .env files, credential stuffers, and scrapers dressed up as browsers.
This is where I write down what I learn. Every morning I also post what the bots did yesterday.
Monday, Oct 26 · UTC
· 9 min read
Railway says someone got into the system that holds its customers' environment variables and decrypted some of them. On the Edge, one client had been asking websites for railway.json since October 12, nine days earlier, wearing eighteen crawler costumes and working through a checklist of hundreds of files. Railway was one line on it. Your secrets were the rest.
· 12 min read
AI labs are copying each other's models by asking them millions of questions, and someone has to pay for all that. This week the bots behind my edge asked for AI key files 80,377 times, OpenCode's files joined their list 32 hours after the breach, and Monday set a new record.
· 7 min read
In 12 days, 10,958 addresses asked the websites behind my edge for .env files, cloud keys and coding-agent settings 3.78 million times. 99.7% of those requests came from an address that had already asked once. Here's why the first ask is all the proof you need, and copy-paste rules to slow, limit and ban them in Cloudflare, nginx, Caddy and Laravel.
· 7 min read
PHP just patched two critical bugs, CVE-2026-109618 and CVE-2026-109619, that let a stranger run their own code on a website's server. Here's what they are in two sentences, what that means if you've never touched PHP, and a restaurant kitchen that explains the rest.
· 8 min read
PHP ships fixes for two critical bugs (CVSS 9.2) on Wednesday at 14:00 UTC, and the details leaked early. The strongest lead points at session upload progress, a feature that's on by default and almost nobody uses. Here's how to switch it off tonight in php.ini, .htaccess, nginx, Caddy, Cloudflare and your WAF.
· 4 min read
Four small hosting networks sent 731,906 requests to 3,597 websites in 12 days, and nearly all of them were hunting for .env files, cloud keys and WordPress installs. Here's who they are, the 31 IP ranges to block, and copy-paste rules for Cloudflare, nginx, Caddy and Laravel.
· 6 min read
One bot sent 84,161 requests to 1,398 websites in five minutes. In the first minute it woke up 926 copies of the server behind them. Here's what it wanted, why the servers held, and how its whole network now gets a 403.
· 20 min read
OpenCode says 1.4% of Console users were hit. That's the share who had provider keys to spend. I spent the weekend counting everyone else, and reading OpenCode's own code to see what was sitting next to those keys.
· 8 min read
AI crawlers hit 3,584 websites 441,515 times in under two weeks. They read robots.txt 192,087 times and asked for llms.txt zero times. Here's who does ask, and why it won't help your SEO.
· 2 min read
Bots get unlimited retries. Real customers get caught in the filters. Fighting abuse means making each form attempt cost the requester more — without penalizing potential customers.
· 4 min read
The plan was to move 1,900 websites onto the Edge 5% of the traffic at a time. Testing particular sites through the load balancer turned out to be the hard part, so I edited my hosts file and went from 5% to 100%.
· 6 min read
The 10 holes I'd check first in any app an AI helped you build, and a free PDF checklist of all 45.
· 9 min read
Moving about 1,900 live sites onto the Mr. Nice Try Edge without touching anyone's DNS, using a load balancer, a dial, a staging server and a lot of checklists.
· 1 min read
I spend my days watching bots knock on websites. This is where I write down what I see.