Hey, it's Matt, aka MattyMoe (@mattymoe.ai on Instagram and TikTok).
This one's late. I missed Friday, so you're getting it on Monday.
Grok has a new startup credits program, and hackers spent this week going after the API keys people keep on their app hosts. At the end there's a prompt you can paste into Claude, ChatGPT or Grok to check your own site or app for the same holes. It takes about 10 minutes.
This week in AI
Grok now gives startups credits. SpaceXSI, the company behind Grok (you probably still know it as xAI), runs a program called Grok for Startups. Approved companies get one balance of credits for the Grok app, Grok Build (its coding agent), Grok Bot (which runs jobs like sales follow-ups and weekly reports) and the Grok API. The program terms are dated October 7.
How much you get depends on your funding, revenue and current AI spend. The page says it aims for six to twelve months of real usage, and the FAQ says about six. You get 20% when you're approved and the other 80% once you finish onboarding. Credits expire six months after they land in your account, and it's one grant per company.
To qualify you need venture backing, a live product and a work email that matches your website. Personal emails get rejected. The form asks for your LinkedIn, funding, revenue, AI spend, team size and investors.
For your business: if you've raised money and your product is live, apply on the program page. Got credits from them before? You can still apply, but you have to list them. If you're self-funded, you won't qualify yet. Claude for Startups doesn't require investors, and it's how most of you found this newsletter, so my step-by-step for that one is still the place to start. Google Cloud, AWS and ElevenLabs run programs too, and here's who qualifies for each.
Two app hosts got broken into by people hunting API keys. Railway, an app host that says millions of developers use it, says an attacker was inside its internal systems from October 20 to 22 looking for AI provider API keys. Railway thinks the goal was "distillation," which means training a copy of an AI model on another model's answers. Up to 1.85% of Railway workspaces, about 100,000, may have had stored keys and passwords exposed. Railway worked with GitHub, Anthropic, OpenAI, Stripe, SpaceXSI and others to cancel keys, and it's telling everyone who signed up before October 21 to replace theirs.
A week earlier, another app host called Zeabur reported that an attacker read 3,218,965 environment variables (the settings where apps keep their passwords and API keys), plus account details for 321,810 users. The way in was an admin key created in January 2024 with no expiry date, later saved in plain text.
For your business: if you host anything on Railway or Zeabur, replace every key and password stored there today, starting with AI keys and Stripe. Wherever you host, set a monthly spending limit on every AI account that offers one. A stolen key with no limit bills you for someone else's usage.
A PHP bug put most of the web on a patch deadline. PHP runs just under 70% of websites whose server language is known, according to W3Techs. Researchers at Calif and Google's Wiz used AI models to find two holes that let an attacker run their own code on a PHP server without logging in. Both are rated 9.2 out of 10. The PHP Foundation released the fixes on October 21, a day early, after details leaked, and the NSA told organizations to patch right away or take their servers offline. Amazon says it saw someone try the attack before it was public.
Chris Krebs, who used to run CISA, told CNBC that 3% of all critical vulnerabilities ever discovered were found in the last month.
For your business: WordPress runs on PHP. If your site is on WordPress, or a developer set up your server, send your host or developer one question today: "Is our PHP on 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer?" If you're on Shopify, Squarespace or Wix, they run the server for you.
Capcom lost 11.7 million account emails. The game company says attackers took 11,774,247 CAPCOM ID records: email addresses plus login details like the IP address of the last sign-in. It found no sign that passwords or card numbers were taken, though the attackers changed the passwords on 196 accounts.
If you have a CAPCOM ID: expect fake emails that look like Capcom. Go to the site directly instead of tapping a login link.
Use it this week: check your site or app for the same holes
About 10 minutes. It works in Claude, ChatGPT or Grok, and in coding agents like Claude Code or Cursor. If you have code, open the agent inside your project folder so it can read the files. If you don't, paste it into a normal chat and it'll ask you questions instead.
You're checking my website or app for security holes. This month hackers broke into two app hosting companies to steal API keys, and a PHP bug put millions of websites at risk, so look for those problems first.
If you can read my project files, go through all of them. If you can't, ask me questions one at a time about how my site is built and where it's hosted.
Check for:
1. API keys, passwords or tokens written into the code, saved in files that go to GitHub, or sent to the browser.
2. Keys that never expire or can do more than they need to.
3. Databases, admin pages or dashboards that anyone on the internet can open.
4. Login, signup, contact and payment forms with no limit on how many times someone can try, or that trust whatever a visitor types in.
5. Old software with known holes, including PHP older than the October 21, 2026 security release (8.2.35, 8.3.36, 8.4.27 or 8.5.12) and plugins that haven't been updated.
6. Business accounts without two-step login: hosting, domain, email, payments, GitHub and every AI provider.
Don't change anything yet, and never show me a full key or password. Give me a list, worst first. For each item, tell me what it is, where it is, what someone could do with it, and how to fix it in plain English. Then ask me which ones to fix.
Fix the top item first. If a key ever ended up in a file that went to GitHub, replace the key. Deleting the line won't help, because GitHub keeps the old version.
Hit reply and tell me what you're building or what the prompt found (no keys, please). I read every reply, and your answers decide what I cover on Friday.
Matt
P.S. The free library is still up, including both startup credits guides.