Syntax - Tasty Web Development Treats

Snapshot · Syntax - Tasty Web Development Treats

1020: Do You Read The Code?

Explore episode Jul 13, 2026

Where this was said

Junior Slack Agent

At 57:00 · chapter starts 56:36

Scott Tolinski had long been on record as an opponent of coding through Slack. Junior changed that in a week. The Sentry Labs tool (junior.sentry.dev) connects to a wide plugin ecosystem: GitHub, Vercel, Cloudflare, Datadog, Linear, Notion, Sentry, Hex, and more — plus Scott added YouTube Analytics and podcast analytics plugins himself. The Syntax team's instance is named Tasty. First trick: Scott asked Tasty to remind the team every Monday of upcoming holidays in the Netherlands, Canada, and the US. Tasty scheduled a recurring cron job without leaving Slack. Second trick: Tasty created a PR on the Syntax repo, provided a preview URL, and passed review on the first attempt. CJ's security instinct kicks in — he immediately starts thinking about prompt injection vectors. If Junior had write access to YouTube and someone left a malicious comment on a video, it could inject commands. The principle of least privilege (currently only read access to YouTube) is what protects them. CJ connects this to the earlier code review discussion: Junior doing a Vercel build fix is exactly the workflow developers were promised when AI hype began — a small, trusted, bounded task that saves a human a round-trip interruption.

Technology
Junior: The Slack Agent That Converted a Hater

1020: Do You Read The Code? · Jul 13, 2026 Technology

Scott Tolinski once swore he'd never code from Slack. Now he does it daily using Junior, Sentry Labs' developer Slack agent. It integrates with Vercel, GitHub, Linear, Notion, YouTube Analytics, and more — letting the whole team trigger workflows without leaving chat.

Technology
Supply Chain Security: Min Release Age Is Finally Universal

1020: Do You Read The Code? · Jul 13, 2026 Technology

Every major JS package manager now supports a minimum release age setting. Set it and your toolchain will refuse to install packages published too recently — before the community has had a chance to catch malicious updates. It's a simple config change that could prevent the next supply chain attack.

Similar snapshots