Short Stack #8Fri, Oct 23, 2026
01
Railway says attackers may have read customer secrets. Rotate your keys
Railway disclosed on Oct 21 that an unauthorized party may have accessed encrypted environment variables and, for some, their decrypted contents: API keys, database and registry credentials. It tells all users to rotate every variable and check logs, and links the attack to a series aimed at AI inference providers. It also reset bucket credentials, GitHub tokens and API tokens.
⏱ 10-MIN TRYIf you've stored a key on Railway, rotate it at the provider, update the variable, redeploy, then check that provider's usage page for spend you didn't make.
Source: blog.railway.com
02
Replit's Monitoring Agent can find, fix and ship production bugs on its own
Replit launched Monitoring Agent on Oct 22 for apps published on Replit. With alerts and auto-fix on, it reads your production logs and metrics when something breaks, investigates the cause, validates a fix and emails you a summary. Auto-publish, if you enable it, lets it deploy the fix itself.
⏱ 10-MIN TRYOpen a published Replit app's Publishing settings, enable monitoring alerts and auto-fix with auto-publish off and read its first summary before letting it deploy.
Source: replit.com
03
Canva Craft is Canva's own image model, trained on designs instead of photos
Canva released Craft on Oct 22, its first in-house image model. It plans the composition first (elements, scale, hierarchy, any text), then renders up to 2K in 30+ aspect ratios. Canva says training on templates makes outputs convert cleanly into editable layers. It's live for all users in Dream Lab and via Canva's public API, with MCP support coming.
⏱ 10-MIN TRYOpen Dream Lab in Canva, generate a poster with a headline in the prompt, then run Magic Layers on it and check whether the text comes out as an editable layer.
Source: techcrunch.com
04
Claude Duet is Anthropic's agent that comes to you with a morning brief
Anthropic opened a waitlisted research preview of Claude Duet on Oct 21 for US Pro and Max subscribers. Built around Opus 5.5, it checks your connected apps every few hours, sends a morning brief, and keeps working in its own cloud browser while you're away. It asks before sending, paying, signing or deleting, and Anthropic says it can still misjudge what's urgent.
⏱ 10-MIN TRYJoin the waitlist, then write down the three things you'd want flagged every morning (unpaid invoices, client emails, calendar clashes) to test its judgment on day one.
Source: claude.com
05
Arc shuts down Dec 22 as The Browser Company goes all in on Dia
The Browser Company said on Oct 22 that Arc stops working on Mac and Windows on Dec 22, with accounts deactivated and data deleted within 30 days. Arc Search loses its AI features and sync on Nov 23. It cites the rising cost of keeping a browser secure. Passwords, bookmarks and history transfer to its AI browser, Dia.
⏱ 10-MIN TRYIf you use Arc, move your passwords, bookmarks and Spaces to Dia or another browser now, and write down which Arc habits you'd actually miss.
Source: techcrunch.com