Research, experiments, and implementation notes filed under security.
Cloudflare Connects AI Vulnerability Hunting To Production Evidence
Cloudflare's Vulnerability Discovery and Remediation service is a useful pattern for AI security work: rank findings with production traffic, WAF context, validation, and human review.
OpenAI Agents SDK Makes Sandboxes A First-Class Boundary
OpenAI's Agents SDK update is a practical reminder that production agents need explicit workspaces, isolated compute, durable state, and credential boundaries.
Codex Turns Agent Runtime Into Platform Work
OpenAI's Codex platform post is a practical reminder that useful agents need runtime boundaries, product-owned context, streaming, and approval flows, not just a chat box.
Cloudflare BotBase Makes Bot Identity Operational
Cloudflare's BotBase for Operators is a practical reminder that agent and crawler teams need identity, behavior declarations, and verification before traffic gets blocked.
Cloudflare Shows Why Cache Layout Still Matters
Cloudflare's 1.1.1.1 DNS cache work is a practical reminder that high-cardinality systems need memory layout reviews, not just bigger machines.
GitHub Rule Insights Make Repository Governance Easier To See
GitHub's rule insights dashboard is now generally available at repository and organization levels, giving teams a faster way to audit ruleset failures, bypasses, and enforcement trends.
Cloudflare Bot Preference Sync Keeps AI Crawler Policy Honest
Cloudflare's Bot Preference Sync turns AI bot policy into a generated robots.txt block, reducing drift between what a site says to crawlers and what it enforces at the...
Docker Sandboxes Put CI Agents Behind a Smaller Boundary
Docker's GitHub Agentic Workflows integration gives coding agents a microVM sandbox with a private Docker daemon, making CI automation more useful without handing it the whole runner.
Cloudflare OAuth Makes Agent Permissions Less All-Or-Nothing
Cloudflare's optional OAuth scopes give agent and MCP builders a practical way to request broad capability while letting users approve a narrower task-based grant.
Cloudflare Workers Shows Why Isolation Needs Layers
Cloudflare's Workers Spectre reassessment is a practical reminder that isolate-based platforms need layered containment, not a single clever mitigation.
Coding Agent Allowlists Are Not A Security Boundary
A practical look at why trusted-command allowlists can fail for coding agents, and what teams should move into the sandbox boundary instead.
GitHub's License Data Update Makes SBOM Reviews Less Noisy
GitHub is prioritizing registry license metadata in the dependency graph, which should make SBOMs and dependency review checks easier to trust.
What MCP Traffic Detection Can—and Cannot—Protect
Where Cloudflare's MCP traffic detection helps, where it cannot, and which controls still belong at the server.