jchan7 reskins Mike as Bobby and wires in a dev-login shortcut

A wholesale rebrand of the codebase, plus a hardcoded backdoor login sitting in plain sight.

securitybranding

jchan7's fork renames every reference to "Mike" as "Bobby" across roughly 75 files - package names, system prompts, the landing URL, even the icon component. It's the kind of sweep someone does when they're spinning up a personal demo or an internal pilot under a different brand.

The more interesting move is buried in the login screen. A specific email-and-password combination skips the authentication service entirely and drops the user straight into the assistant as a fake "dev" account stored in the browser. The credentials are sitting in plaintext in the public repo. It's almost certainly a convenience for local development without a working auth backend, but it would survive into any deployed build of this fork - so it tells you something about how this fork is being used (solo demos, not production) and serves as a cautionary tale for anyone tempted to copy auth code from forks without reading it.

So what Worth a glance if you're tracking how individual developers spin Mike into private demos - and a reminder that fork code can ship with shortcuts that wouldn't survive a security review.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

2 commits from jchan7/mike, oldest first. Source extracted verbatim from the harvested git log.

SHA Subject Author Date
dbce928e setting up Jason Chan 2026-05-02 ↗ GitHub
fb270581 Create package-lock.json Jason Chan 2026-05-02 ↗ GitHub

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-105.md from inside the repo you want the changes in.

⬇ Download capture-thread-105.md