Think Before You Click

In the modern development workflow, our greatest tools are also our greatest vulnerabilities. We trust our Browser Extensions, IDEs, our package managers, and now our AI agents but how often do we audit that trust?

This session breaks down the "hidden" threat vectors that target developers daily. We will explore:

1. The "Coffee Break" vulnerability: How 30 seconds of physical access can compromise your shell.

2. The Extension Trap: Why that helpful browser plugin might be a silent session-stealer.

3. Supply Chain Sabotage: How npm install becomes a gateway for root access and environment theft.

4. The AI Frontier: The emerging risks of Model Context Protocol (MCP) servers and backdoored code.

Attendees will leave with a practical "Security-First" checklist to harden their local environments without slowing down their velocity. This isn't just about high-level theory; it’s about the simple, overlooked actions that keep your credentials and your company's code safe.

This talk is designed to be highly relatable, moving away from "scare tactics" and toward actionable habits for engineers. I utilize real-world scenarios like the unattended laptop at a coffee shop or the quick installation of a developer tool to demonstrate how easily sophisticated attacks can be executed.

The content covers a range of security levels, from basic physical security to modern supply chain and AI-integrated tool risks (MCP), making it suitable for both junior developers and seasoned architects. The goal is to foster a culture of mindful clicking and proactive auditing within the engineering community.

https://github.com/side-projects-overkill/demo-think-before-you-click