Find published research by company, product, platform or technology.
Showing 1–20 of 187 dossiers
Request-only WAF rules cannot always tell whether an exploit succeeded. Cloudflare now correlates requests with origin responses, adds managed response blocking and permits three custom response rules.
GitHub’s credential-response story now has both discovery and containment: enterprise owners can export SSH keys, PATs, OAuth and GitHub App tokens with ownership, scope and last-use metadata, then use selective revocation rather than invalidating every credential a user holds.
Retailers can now submit warranty duration as structured product-feed data, but the new Google field does not replace Quebec's mandatory near-price disclosures or the underlying free repair guarantee.
AI image and social-app developers face clearer moderation and review obligations; hiding features can threaten an entire developer account.
A new GitHub ruleset can stop unapproved dependency licences at merge time, and agents can check packages before recommending them.
Apple’s EU payment rules are operational, not future-tense. RevenueCat reduces transaction reporting work for eligible alternative checkouts; the fees, App Review, 12-month commitment and uncertain in-app-sheet rollout remain.
Woodpecker's agent labels were self-reported and unsuitable for authorization. Version 3.19 adds server-held filters and patches a clone-step environment-variable leak; administrators should verify their worker policies.
The useful change is where enforcement happens. Teams can now make unresolved leaked credentials a branch-policy failure, with organization and enterprise rollout plus API configuration for large repository fleets.
Go 1.27 automatically drains up to 256 KiB or 50 ms after an HTTP/1 response body is closed, enabling reuse without custom drain code.
New AI-search data highlight the value of original product information while showing why one-size-fits-all GEO advice is risky.
The migration is now much safer for background-only and bulk-installed apps: a timed-out direct conversion no longer automatically strands the store. The retry window is bounded and can end earlier after the issued pair is refreshed or another token acquisition supersedes it.
YouTube’s 2027 YPP restructuring changes entry, ongoing Shorts earnings and channel-activity rules. Since August 24, public views count from the first frame, while earnings and eligibility still depend on engaged or qualified views.
A small but foundational JavaScript HTTP framework has reached v2 with a web-standards rewrite. Builders must test route wildcards, forwarded-header trust and explicit response returns before migrating.
Cloud CDN can now honor CDN-Cache-Control separately from browser-facing Cache-Control. That gives builders a standards-based way to set shared-cache behavior at the edge while preserving different client-side caching rules.
The Assistants API shutdown date has passed. OpenAI’s deprecation documentation lists August 26, 2026 as the removal date and directs developers to Responses and Conversations for replacement workloads.
Financial advertisers in the US and Canada face a new Google Ads verification gate in 2027. Google will announce accepted registries and onboarding details before enforcement; it is not a current blanket ad ban.
A hard shutdown date makes this more than a hosting refresh: unmigrated Codeberg Pages sites will go offline, and the replacement changes deployment and URL behaviour.
SQLite 3.54 is a compatibility release worth checking: standalone sqlite3_analyzer is deprecated, CLI behavior shifts, authorizer checks expand and Windows XP builds are no longer supported.
Linux app developers no longer face an outright AI-generated-code exclusion, but they must identify affected code and documentation, write manifests without AI assistance and keep agents out of the submission workflow.
GitHub Actions now has enforceable actor and event rules before a workflow starts, plus a coming default block for a trigger that can expose repository secrets to untrusted fork code.