Bitwarden

LastPass's third breach notice didn't come from its own servers. A vendor called Klue — a CRM-attached "market intelligence" platform for sales teams — got compromised, exposing LastPass customer names, phone numbers, emails, and physical addresses. Encrypted vaults were untouched.

On HN the pile-on was instant. But the sharpest comment cut the other way: a security engineer noted every sales org has a dozen of these tools wired in, and the only surprise is that this kind of breach doesn't happen far more often.

This month: build-your-own-x (514k-star programming curriculum), yt-dlp (video downloader forced to add a Deno dependency), bitwarden/server and bitwarden/clients (password manager appearing twice after a licensing scare), and NangoHQ/nango (AI integration platform from YC W23).

The list's throughline isn't AI hype — it's platform anxiety. YouTube tightened its defenses, Bitwarden briefly went proprietary (then reversed), and a Chinese lab shipped a Whisper alternative that claims 170x realtime speed. Developers starred the escape hatches.