Grok Bot, cloud agents, and keeping QUE honest

Main point: Grok Bot coordinates and Cursor cloud agents do the work to keep QUE running, and when a credential was exposed, that setup fixed it with zero downtime.

The connectors

• Vercel: deployments, environment variables, and checking what's actually live
• Supabase: QUE data, auth settings, and SQL I won't run blindly from chat
• Resend: transactional email and its DNS

So I can ask "why did sign-up mail stop?" and Grok traces it instead of me tab-hopping at midnight.

The Resend scare

A cloud agent found a Resend API credential exposed where it shouldn't be. It reported the finding, the impact and the likely source, without leaking the value. The cause was an old setting copied into Supabase Auth's custom SMTP. My engineer agent, Engi, made a new credential, updated Supabase, checked Vercel matched and sent a test. Users saw no outage.

Grok for the story and priorities, specialist agents for the work, humans for the final "yes, ship it".

The lesson

QUE follows the same pattern as Sandbox Studio: small team, shared codebase, and a high cost when a secret lands in the wrong place. If you build with agents, invest in the harness before chasing a smarter model. Incidents are rarely "the model hallucinated". They're "the model couldn't see the system that broke".

Related: QUE: taming the grid of doom