5 design skills to sharpen in the AI era
Our latest research highlights the skills designers need to meet the moment.
Vishal Kapoor’s 10 rules for building honest products with AI
Affirm SVP of Product Vishal Kapoor shares 10 non-negotiable rules for harnessing AI to build products that are clear, secure, and fundamentally honest.
The era of “AI as text” is over. Execution is the new interface.
AI is shifting from prompt-response interactions to programmable execution. See how the GitHub Copilot SDK enables agentic workflows directly inside your applications.
Examples for the tcpdump and dig man pages
Migrating to Workspaces and Nx
The interesting part of moving kentcdodds.com to npm workspaces was not the file moves. It was everything the file moves broke.
Building Dynamic Forms In React And Next.js — Smashing Magazine
Some forms stay UI, while others quietly become rule engines. Here’s why these two different approaches exist and how to choose between them.
Analyzing first-party fraud trends: Account, free trial, and refund abuse
From November 2025 to February 2026, our models detected 6.2x more abusive free trials. This is part of a shift toward first-party fraud, where users abuse policies by setting up multiple accounts, cycling through free trials, or exploiting refunds.
Active defense: introducing a stateful vulnerability scanner for APIs
Cloudflare’s new Web and API Vulnerability Scanner helps teams proactively find logic flaws. By using AI to build API call graphs, we identify vulnerabilities that standard defensive tools miss.
Fixing request smuggling vulnerabilities in Pingora OSS deployments
Today we’re disclosing request smuggling vulnerabilities when our open source Pingora service is deployed as an ingress proxy and how we’ve fixed them in Pingora 0.8.0.
Complexity is a choice. SASE migrations shouldn’t take years.
Discover how Cloudflare partners TachTech and Adapture are shattering the 18-month migration myth, deploying agile SASE for global enterprises in weeks by treating security as software.
The Value of z-index
How we look at the stacking order of our projects, how we choose z-index values, and more importantly, the implications of those choices.
Under the hood: Security architecture of GitHub Agentic Workflows
GitHub Agentic Workflows are built with isolation, constrained outputs, and comprehensive logging. Learn how our threat model and security architecture help teams run agents safely in GitHub Actions.
Offloading FFmpeg with Cloudflare
How I moved Call Kent podcast episode processing off my primary Fly.io app server and onto Cloudflare Queues and Containers: what broke, what I missed, and whether it was worth the complexity.
How Advanced Browsing Protection Works in Messenger
We’re sharing the technical details behind how Advanced Browsing Protection (ABP) in Messenger protects the privacy of the links clicked on within chats while still warning people about malicious links. We hope that this post has helped to illuminate some of the engineering challenges and infrastructure components involved for providing this feature for our users. […]
Persuasive Design: Ten Years Later — Smashing Magazine
Many product teams still lean on usability improvements and isolated behavioral tweaks to address weak activation, drop-offs, and low retention – only to see results plateau or slip into shallow gamification. Anders Toxboe updates persuasive design for today’s reality, clarifying what has actually held up over the last decade.
From the endpoint to the prompt: a unified data security vision in Cloudflare One
Cloudflare One unifies data security from endpoint to prompt: RDP clipboard controls, operation-mapped logs, on-device DLP, and Microsoft 365 Copilot scanning via API CASB.
How to scan for vulnerabilities with GitHub Security Lab’s open source AI-powered framework
GitHub Security Lab Taskflow Agent is very effective at finding Auth Bypasses, IDORs, Token Leaks, and other high-impact vulnerabilities.
Human Strategy In An AI-Accelerated Workflow — Smashing Magazine
UX design is entering a new phase, with designers shifting from makers of outputs to directors of intent. AI can now generate wireframes, prototypes, and even design systems in minutes, but UX has never been only about creating interfaces. It’s about navigating ambiguity, advocating for humans in systems optimised for efficiency, and solving their problems through thoughtful design.
How Automatic Return Routing solves IP overlap
Automatic Return Routing (ARR) solves the common enterprise challenge of overlapping private IP addresses by using stateful flow tracking instead of traditional routing tables. This userspace-driven approach ensures return traffic reaches the correct origin tunnel without manual NAT or VRF configuration.
Ending the "silent drop": how Dynamic Path MTU Discovery makes the Cloudflare One Client more resilient
The Cloudflare One Client now features the ability to actively probe and adjust packet sizes. This update eliminates the problems caused by tunnel layering and MTU differences, providing more stability and resiliency.
A QUICker SASE client: re-building Proxy Mode
By transitioning the Cloudflare One Client to use QUIC streams for Proxy Mode, we eliminated the overhead of user-space TCP stacks, resulting in a 2x increase in throughput and significant latency reduction for end users.
The Different Ways to Select <html> in CSS
Sure, we can select the <html> element in CSS with, you know, a simple element selector, html. But what other (trivial and perhaps useless) ways can we do it?
Ideological Resistance to Patents, Followed by Reluctant Pragmatism
This article reflects on an ideological discomfort with software patents, a direct experience of patent aggression in the software industry, and the practical constraints faced by startups. It argues that while the patent system remains deeply flawed, defensive patenting can function as a shield in an asymmetric legal environment, especially for open-source innovators.
60 million Copilot code reviews and counting
How Copilot code review helps teams keep up with AI-accelerated code changes.
Scaling AI opportunity across the globe: Learnings from GitHub and Andela
Developers connected to Andela share how they’re learning AI tools inside real production workflows.
From idea to secure checkout in minutes with Stripe
You can now connect or import an existing Stripe account directly into your Vercel project, automatically configure environment variables, and move from Stripe Sandbox to production without manual key exchanges.
Always-on detections: eliminating the WAF “log versus block” trade-off
Cloudflare is introducing Attack Signature Detection and Full-Transaction Detection to provide continuous, high-fidelity security insights without the manual tuning of traditional WAFs. By correlating request payloads with server responses, we can now identify successful exploits and data exfiltration while minimizing false positives.
Defeating the deepfake: stopping laptop farms and insider threats
Cloudflare One is partnering with Nametag to combat laptop farms and AI-enhanced identity fraud by requiring identity verification during employee onboarding and via continuous authentication.
Moving from license plates to badges: the Gateway Authorization Proxy
Cloudflare’s Gateway Authorization Proxy adds support for identity-aware policies for clientless devices, securing virtual desktops, and guest networks without a device client.
Stop reacting to breaches and start preventing them with User Risk Scoring
Cloudflare One now incorporates dynamic User Risk Scores into Access policies to enable automated, adaptive security responses. This update allows teams to move beyond binary "allow/deny" rules by evaluating continuous behavior signals from both internal and third-party sources.
Mind the gap: new tools for continuous enforcement from boot to login
Cloudflare’s mandatory authentication and independent MFA protect organizations by ensuring continuous enforcement, from the moment a machine boots until sensitive resources are accessed.
3 ways product teams are building conviction faster with Figma Make
Product managers at ServiceNow, Ticketmaster, and Affirm are using Figma Make to prototype their way forward.
Introducing the 2026 Cloudflare Threat Report
There has been a fundamental shift toward industrialized cyber threats, highlighted by a record 31.4 Tbps DDoS attack and sophisticated session token theft. Our new report examines how nation-states and criminal actors have moved beyond traditional exploits to "living off the XaaS" within legitimate enterprise logic.
How Cloudy translates complex security into human action
Cloudy is our LLM-powered explanation layer built directly into Cloudflare One. Its explanations, now part of Phishnet and API CASB, can improve user decisions and SOC efficiency.
See risk, fix risk: introducing Remediation in Cloudflare CASB
Cloudflare CASB Remediation lets security teams go beyond visibility to fix risky file sharing in Microsoft 365 and Google Workspace directly from Cloudflare One, all in just a few clicks.
Our Config 2026 speakers on the biggest opportunities with AI
Here’s a first look at our speakers and how they’re interrogating craft, quality, and intention in an AI-powered world.
How we rebuilt the search architecture for high availability in GitHub Enterprise Server
Here’s how we made the search experience better, faster, and more resilient for GHES customers.
Join or host a GitHub Copilot Dev Days event near you
GitHub Copilot Dev Days is a global series of hands-on, in-person, community-led events designed to help developers explore real-world, AI-assisted coding.
Optimizing Recommendation Systems with JDK’s Vector API
By Harshad Sane
Now Shipping: Accessible UX Research, A New Smashing Book By Michele Williams — Smashing Magazine
Our newest Smashing Book, “Accessible UX Research” by Michele Williams, is finally shipping worldwide — and we couldn’t be happier! This book is about research, but you’ll also learn about assistive technology, different types of disability, and how to build accessibility into the entire design process. This thoughtful book will get you thinking about ways to make your UX research more inclusive a
Supporting additional payment methods for agentic commerce
Stripe is now the first and only provider that supports both agentic network tokens and buy now, pay later tokens in agentic commerce through a single primitive.
Scaling redirects to infinity on Vercel
Redirects are trivial at a small scale, but at millions, latency and cost become real systems problems. This is the story of how Vercel implemented bulk redirects.
Beyond the blank slate: how Cloudflare accelerates your Zero Trust journey
Project Helix simplifies and accelerates the onboarding process for Cloudflare One. By using automation and Terraform templates, this tool allows customers to quickly deploy a comprehensive, best-practice configuration in minutes.
The truly programmable SASE platform
As the only SASE platform with a native developer stack, we’re giving you the tools to build custom, real-time security logic and integrations directly at the edge.
Modernizing with agile SASE: a Cloudflare One blog takeover
In 2026, agile SASE is the engine for modernization. Discover how Cloudflare One secures humans, devices, and AI agents on a single, programmable connectivity cloud.
GitHub for Beginners: Getting started with GitHub Issues and Projects
Learn how to get organized and collaborate more efficiently with this step-by-step tutorial.
FFmpeg at Meta: Media Processing at Scale
FFmpeg is truly a multi-tool for media processing. As an industry-standard tool it supports a wide variety of audio and video codecs and container formats. It can also orchestrate complex chains of filters for media editing and manipulation. For the people who use our apps, FFmpeg plays an important role in enabling new video experiences […]
Investing in Infrastructure: Meta’s Renewed Commitment to jemalloc
Meta recognizes the long-term benefits of jemalloc, a high-performance memory allocator, in its software infrastructure. We are renewing focus on jemalloc, aiming to reduce maintenance needs and modernize the codebase while continuing to evolve the allocator to adapt to the latest hardware and workloads. We are committed to continuing to develop jemalloc development with the […]
Getting Started With The Popover API — Smashing Magazine
What happens if you rebuild a single tooltip using the browser’s native model without the aid of a library? The Popover API turns tooltips from something you simulate into something the browser actually understands. Opening and closing, keyboard interaction, Escape handling, and much of the accessibility now come from the platform itself, not from ad-hoc JavaScript.
Can AI agents build real Stripe integrations? We built a benchmark to find out
State-of-the-art LLMs can solve many scoped coding tasks, but can they execute end-to-end software projects? To find out, we built the Stripe integration benchmark: an agentic test of real API integration work in a production-realistic environment.
Fresh Energy In March (2026 Wallpapers Edition) — Smashing Magazine
Do you need a little inspiration boost? Well, then our new batch of desktop wallpapers is for you. Designed by the community for the community, the wallpapers in this collection are the perfect opportunity to get your desktop ready for spring — and, who knows, maybe they’ll spark some new ideas, too. Enjoy!
Gamma builds design-first agents with Vercel
How Avalara turns pipe dreams into patent-pending with v0
The most-seen UI on the Internet? Redesigning Turnstile and Challenge Pages
We serve 7.6 billion challenges daily. Here’s how we used research, AAA accessibility standards, and a unified architecture to redesign the Internet’s most-seen user interface.
ASPA: making Internet routing more secure
ASPA is the cryptographic upgrade for BGP that helps prevent route leaks by verifying the path network traffic takes. New features in Cloudflare Radar make tracking its adoption easy.
We deserve a better streams API for JavaScript
The Web streams API has become ubiquitous in JavaScript runtimes but was designed for a different era. Here's what a modern streaming API could (should?) look like.
Bringing more transparency to post-quantum usage, encrypted messaging, and routing security
Cloudflare Radar has added new tools for monitoring PQ adoption, KT logs for messaging, and ASPA routing records to track the Internet's migration toward more secure encryption and routing standards.
Toxic combinations: when small signals add up to a security incident
Minor misconfigurations or request anomalies often seem harmless in isolation. But when these small signals converge, they can trigger a security incident known as a toxic combination. Here’s how to spot the signs.
Yet Another Way to Center an (Absolute) Element
TL;DR: We can center absolute-positioned elements in three lines of CSS. And it works on all browsers!
What’s !important #6: :heading, border-shape, Truncating Text From the Middle, and More
Despite what’s been a sleepy couple of weeks for new Web Platform Features, we have an issue of What’s !important that’s prrrretty jam-packed. The web community had a lot to say, it seems, so fasten your seatbelts!