Google AI Studio's Build Mode hides API keys behind a proxy during deployment, which the docs imply is secure. But the proxy forwards arbitrary requests to any Gemini model with zero auth, quota or validation, using the real API schema, even for apps with no AI features. Deployment URLs are discoverable by searching the URL scheme. This was reported to Google in late November and classified as a documentation issue.
The "correct" way to have agents working on repositories in parallel - which you want to do to speed up AI development rather than just waiting around - is to use git worktrees, which are separate directories checking out different branches of a repo - so agents can work in parallel on different directories without interference. This also allows comparing different prompts, frameworks, agents etc.
But manually, I always found it hard to manage the complexity of creating a new branch, merging, propagating updates in time for the agents without creating a mess. So I created these super-simple wrapper functions to create a new "child" branch+worktree, runs pnpm install (which uses hardlinks to speed things up), merges from the parent worktree branch, merge to the parent worktree branch etc. This script also imposes a predictable directory structure on the worktrees, which allows understanding easily which task is the "parent" of another task.
