Research, experiments, and implementation notes filed under cloudflare.
Targeted Rebuilds Beat Full Recomputes—If You Can Prove Them Safe
Cloudflare cut DNS Zone Builder peak memory by 85% by planning the smallest safe rebuild, merging queued work, and proving targeted output against full recomputation.
Cloudflare's Brotli WAF Rules Start in Log Mode for a Reason
Cloudflare added emergency WAF detections for Brotli request bodies and the Next.js image endpoint, but operators should audit inherited overrides before changing either rule from Log to Block....
Protected Quick Tunnels Make Agent Previews Less Risky
Cloudflare added free email protection to accountless Quick Tunnels, giving local agent previews a lightweight access gate without creating a Cloudflare app.
Dynamic Workers Make Agent Sandboxes Cheaper To Throw Away
Cloudflare Dynamic Workers move agent code execution into short-lived isolates, which is a practical shape for sandboxing generated JavaScript with narrow capabilities.
Cloudflare Workers Access Can Now Be Scoped Per App
Cloudflare added resource-level roles for Workers, giving teams a cleaner way to give CI systems, teammates, and coding agents only the access one application needs.
Cloudflare 1.1.1.1 Makes Post-Quantum DNSSEC Practical to Test
Cloudflare's 1.1.1.1 resolver now validates ML-DSA-44 DNSSEC signatures, exposing the real migration work: large packets, TCP fallback, downgrade policy, and parent-chain adoption.
Cloudflare Workers Gets Closer To Real Node Module Semantics
Cloudflare rebuilt the Workers module registry around URL-based resolution, lazy compilation, shared code caches, import.meta support, and better Node.js compatibility.
Cloudflare Automatic Key Exchange Makes Post-Quantum Origin TLS Less Manual
Cloudflare's Automatic Key Exchange measures each origin's TLS 1.3 key agreement support, then leads with the strongest safe key share, including X25519MLKEM768 where origins support it.
Cloudflare Connects AI Vulnerability Hunting To Production Evidence
Cloudflare's Vulnerability Discovery and Remediation service is a useful pattern for AI security work: rank findings with production traffic, WAF context, validation, and human review.
Cloudflare BotBase Makes Bot Identity Operational
Cloudflare's BotBase for Operators is a practical reminder that agent and crawler teams need identity, behavior declarations, and verification before traffic gets blocked.
Cloudflare Shows Why Cache Layout Still Matters
Cloudflare's 1.1.1.1 DNS cache work is a practical reminder that high-cardinality systems need memory layout reviews, not just bigger machines.
WebMCP Makes Websites Easier For Agents To Use
Cloudflare's WebMCP preview can add browser-discoverable tools to a site at the edge, giving agents a structured path through web apps instead of fragile click automation.
Cloudflare Bot Preference Sync Keeps AI Crawler Policy Honest
Cloudflare's Bot Preference Sync turns AI bot policy into a generated robots.txt block, reducing drift between what a site says to crawlers and what it enforces at the...
Cloudflare OAuth Makes Agent Permissions Less All-Or-Nothing
Cloudflare's optional OAuth scopes give agent and MCP builders a practical way to request broad capability while letting users approve a narrower task-based grant.
Cloudflare Workers Shows Why Isolation Needs Layers
Cloudflare's Workers Spectre reassessment is a practical reminder that isolate-based platforms need layered containment, not a single clever mitigation.
What MCP Traffic Detection Can—and Cannot—Protect
Where Cloudflare's MCP traffic detection helps, where it cannot, and which controls still belong at the server.