hi hn !

i hit my antigravity quota again and wanted a dumb-simple way to track usage. so i installed the most popular "cockpit/quota" extension, logged in with google, and moved on. then i got curious about what i just authorized and where it was storing my auth.

what i found is pretty alarming. this extension persists google oauth credentials to disk in plaintext json, including a refresh token, and it requests the very broad cloud-platform scope. it completely ignores the built-in SecretStorage API that uses the OS keychain. instead, it just dumps the accounts object straight to a hidden folder in your home directory using a basic writeFileSync call. it also uses a hardcoded oauth client id to perform the flow.

the threat model here isn't a stranger browsing your home folder. the risk is anything running under your user account. that includes malware, compromised extensions, random helper tooling, and backup agents syncing dotfolders. once that refresh token escapes, an attacker doesn't need your machine anymore because they can keep refreshing. the practical blast radius becomes anything your IAM already allows across google cloud, which is huge for a tool that's basically just showing you usage.

if you installed it, deleting the local folder isn't enough.

> first, you need to revoke access on google's end, which is the real kill switch. go to your google account security settings, find third-party access, and remove the antigravity app.

> next, uninstall the extension and fully quit the IDE so the extension host dies. after that, you can do a local purge by running a standard rm -rf on the .antigravity_cockpit folder in your home directory.

> finally, it's a good idea to check your gcp cloud audit logs for any unusual resource creation or IAM changes.

ofc : i'm not a security expert, just a guy who likes tinkering and wanted to share what i found. So if there is a mistake or whatever, please, don't hesitate to comment !

the whole post here :

https://www.reddit.com/r/google_antigravity/comments/1rbqs1t/security_alert_why_you_should_ditch_antigravity/

Mechanical Galloping (2013)

Buyers Bought Xpeng EV Van Carrying Personal Aircraft

The Ur-"Conspiracy": History of a Pseudoconcept

Show HN: Find Markdown files in your repo that aren't linked from the README

Show HN: Bibabo – Gamified AI-first coding education

Show HN: Skalp – An intent-driven hardware language with clock domains as types

Abilene Paradox

Haber process serves as the "detonator of the [human] population explosion"

Show HN: Sira,reinventing fligh booking experience (travelwithsira.com)

Sam Altman Turned $1T Non-Binding Commitments into a $100B Round

Tell HN: npm download stats are broken

Is Anthropic releasing a new CLI tool?

Can advanced AI lead to negative economic growth?

Show HN: Mobile IPs for AI agents that keep getting blocked

Bit-Field Layout

Private equity logjam hits record as firms struggle to sell

Nobody Rips Out the Plumbing

The Garden and the Stream: A Technopastoral (2015)

Upstreaming of the AAEON UP board IO expansion Linux kernel driver

OpenClaw Partners with VirusTotal for Skill Security

IDE extension 'Antigravity Cockpit' stores GCP refresh tokens in plaintext

Genetic underpinnings of chills from art and music

OpenAI researcher speaks on why she resigned [video]

Show HN: Aussie Meme Boss Rush – 1 day Vibe Coded WebGL single file HTML game

Keeping Up with PRs in an Agentic World

Why there isn't another archive.today (blog of archive.today)

Scientists are homing in on 100 ET signals enthusiasts found with home computers

Code is not being read anymore, right?

Ask HN: Have you ever cloned a cat?

NullClaw: the smallest fully autonomous AI assistant infrastructure

Ask HN: Are you running production workloads in Pytorch eager mode?