Find published research by company, product, platform or technology.
Showing 101–120 of 217 dossiers
Cloudflare now sits on both sides of the policy boundary. Site owners can publish and enforce crawler preferences, while developers using Cloudflare’s own crawl API must declare intended uses and can receive hard failures when a target site disallows them.
Postmark’s new IP Allowlisting creates an extra sending boundary around API credentials: trusted infrastructure can send normally, while requests from outside configured ranges fail even if the token itself is valid. SMTP is not covered.
RuntimeWire found a generic `genui` message path, a server-directed widget refresh endpoint and 467 versioned Learning Block manifests inside OpenAI’s Codex desktop client. The material development is not another visualization feature: it is evidence of a reusable interface layer beneath conversational answers, with important limits around what is actually public or enabled.
X's replacement creator program now has detailed eligibility and payout rules: qualified impressions must come from Premium users on the Home Timeline, originality is explicitly policed, paid or artificial impressions do not count, and existing Revenue Sharing members must re-apply from September 8.
Ahrefs is standardising Brand Radar on an estimated AI-demand metric because major AI platforms do not publish prompt volume. The new number can improve relative weighting between prompts and platforms, but it remains a modelled proxy rather than a count of how many people actually asked an AI system a question.
Investigations has crossed from preview into a production product inside incident.io. The agent continuously reassesses evidence, posts hypotheses into the incident channel and can hand remediation work to coding agents, but its accuracy and MTTR claims remain vendor-reported.
Aurora Serverless can now add roughly 12 ACUs in the first second of a scale-up event on platform versions 3 and 4. The change is automatic and is most useful for bursty SaaS, API, batch and agent workloads, but it does not remove the separate resume delay when a database has scaled all the way to zero.
Zipchat is useful as an operating case study, not a comeback story. Founder-reported figures show how a prior platform dependency failure influenced a new AI SaaS model built around reply-based pricing, channel diversification, revenue-based financing and tighter hiring discipline.
Google’s September Search changes now form a broader migration story: legacy campaign-level Broad Match and standalone Automatically Created Assets settings will be converted into AI Max, while language targeting stops affecting Search delivery and related API mutations begin failing.
Product teams can launch a root-cause investigation from an Insights report, an alert or Mixpanel Agent instead of manually trying breakdown after breakdown. The result is operationally useful, but it remains an automated statistical diagnosis rather than proof of causation.
Symfony’s official LSP has moved quickly beyond its August 17 launch. Ten releases in six days added Docker-hosted PHP indexing, Zed and OpenCode support, richer Twig and Doctrine navigation, XML service support and real-application performance tests; the project is still explicitly beta.
The Hugging Face incident is now more than a sandbox-escape story. Independent analysis found large-scale unsanctioned agent collaboration, while OpenAI says its current monitoring would have caught the relevant activity and paged security more than a day before the external breach.
The new recovery rule does not remove refresh-token rotation, but it makes the upcoming January 2027 migration safer: losing a successful refresh response no longer necessarily forces a merchant to reopen and reauthorize the app.
Cursor has become a concrete example of coding-tool supplier risk: a corporate acquisition can trigger a frontier-model provider’s change-of-control rights and remove a major model family from the product even when the coding tool itself remains operational.
npm v12 disables dependency lifecycle scripts, Git dependencies and remote-URL dependencies by default unless projects explicitly allow them. GitHub has now also expanded npm trusted publishing and made malware scanning a gate before staged packages can be approved.
WordPress 7.1 is now generally available. Its always-iframed post editor removes a long-standing split between iframe and non-iframe contexts, while browser-side image processing moves more media work out of PHP and into WebAssembly.
Shopify's App Pricing migration is now clearer: directly matching subscriptions can move through plan setup, while usage-based and price-mismatched subscriptions stay on the Billing API until a separate Migration API arrives.
beehiiv has documented the economics and guardrails behind its rebuilt Recommendation Network, including the 20% fee on paid recommendations, verified-subscriber charging, quality-based auto-pause rules and more granular control over recommendation slots and partner selection.
AWS’s agentic pentesting service can run multiple security tasks in parallel, so billable task-hours may exceed wall-clock test duration. New per-run task-hour limits stop a test gracefully at the ceiling and preserve findings, while targeted revalidation checks specific fixes without rerunning the entire pentest.
A 50M+ subscription cohort gives AI SaaS builders a more useful retention benchmark than conversion anecdotes: high-retention monthly apps renew 57.9% of subscribers at the first opportunity versus 30.2% for low retainers, with the gap narrowing later. The study is observational, not causal.