August 2026 Baseline monthly digest
Read about various happenings with Baseline during August 2026.
Cloudflare’s 2026 Annual Founders’ Letter
The Internet is changing more today than at any point since Cloudflare launched back on September 27, 2010. As automated traffic surpasses human activity, we reflect on the rise of AI agents, new creators, and how we can help build a fair, sustainable future for the web.
Replacing the old battery on rechargeable bike lights
Rusty thoughts on "Parse, don't validate"
Like many programmers, I find Alexis King's Parse, don't validate article fascinating, because it gives a name to an idiom that seems familiar and important - one I've observed and used in the past without naming it explicitly. This post is a review of the "Parse, don't validate" pattern applied to …
Agents can now set up your website’s security with Turnstile Spin
Misconfiguring Turnstile by skipping backend validation leaves sites exposed to bots. Turnstile Spin fixes incomplete setups by using your preferred AI coding agent to wire up server-side verification.
If we do not stop to help each other, what do we become?
Yesterday, I received this email as a response to You Can't Vibe Code Love . It's such a remarkable and powerful statement that I asked permission to share it here, in its entirety, with personal information redacted: Hey Jeff, Hope you and your family are doing well.
Improving site performance by shipping more CSS
A look at how a design system shipped major changes without breaking the world.
GitHub Copilot app for Beginners: How to build custom workflows with canvases
Describe the interface you need in plain English, then let the agent build a live surface you can both use and update—so you spend less time adapting to tools and more time getting work done.
Trading a Cloud Identity for Your Own: Workload Attestation on Managed Compute
State of agent skills
How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers
External security researchers at Accomplish identified a vulnerability in Cloudflare Containers that could expose residual disk data from previous workloads. We explain how the issue worked, how we investigated it, and the steps we took to remediate it.
When chat is the wrong UI
What is a developer to do when they need something more tangible than a chat box? Enter canvases.
AI-powered fuzzing with the GitHub Security Lab Taskflow Agent
In this blog post, I explain how to use the new fuzzing taskflow based on the GitHub Security Lab Taskflow Agent AI framework.
You Own the Outcome: Product Engineering in the Age of AI
Agents are great at producing code. The valuable work left for you is deciding what should exist, how it should behave, and what you're willing to trade for it.
Bringing Private Processing to Meta AI Glasses
We believe glasses are the best form factor for having AI help throughout your day. They can understand your personal context better than other kinds of devices and keep you present without picking up a mobile phone. Most of the time, glasses are helping you see well, protecting your eyes and complementing your look, and [...] Read More... The post Bringing Private Processing to Meta AI Glasses ap
The Vercel Bug Bounty Program is now publicly available
How Klaviyo shipped 356 internal apps in two weeks on Vercel
What Dropbox has learned from deploying AI at company scale
Learnings from deploying AI at company scale, and what organizations need to consider as they move from AI adoption to broader transformation.
Developers want more efficient software. Here’s what over 1000 GitHub users told us they need.
New research from GitHub and Yale Program on Climate Change Communication finds strong demand for tools, measurement, and practical guidance that can help developers reduce wasted compute.
Rendering huge pull requests in the GitHub Copilot app
How we rebuilt the diff surface in the GitHub Copilot app to open a million-line pull request with hundreds of inline review comments.
We just shipped support for the ugliest part of HTTP: Vary
Vary support is now available in Cache Rules on every plan. You can normalize known negotiation headers, pass exact values through to the origin when those small differences matter, or bypass cache when the variation is too unpredictable.
Introducing Worker Previews: isolated preview environments for every change your agent makes
Worker Previews gives every branch its own URL, configuration, state, and observability, so you and your agents can test changes in parallel without affecting production.
Scalefield v1.30.0: Meet the platform, and what's new
This blog talks about the latest Scalefield release in detail. Check it out, to know more.
Python Workers are now generally available
Python Workers allow developers to run Python web frameworks and AI orchestration libraries natively in the Cloudflare Workers runtime. You can seamlessly integrate with Cloudflare's ecosystem including D1, R2, and Workers AI without writing any JavaScript glue code.
Updating PostgreSQL with pg_squeeze installed
The most recent updates add a new configuration parameter output_plugin_libraries. If you have the pg_squeeze extension installed, please add pg_squeeze
Introducing Our New Dropbox API Documentation
Learn about the newly launched version of the Dropbox API documentation and its modern design and features.
Open-Sourcing Rebalancer: A Generic, High-Performance Library for Solving Assignment Problems
We’re open-sourcing Rebalancer, the assignment-problem solver that has been used to solve resource allocation problems throughout Meta for over nine years. Rebalancer separates several related concerns: how to specify an assignment problem, how to store it efficiently in memory, how to solve it, and how to debug it. This separation of concerns is crucial to [...] Read More... The post Open-Sourcin
Inside Petal: Building the World’s First Petabit-Class Transoceanic Subsea Cable
Petal, the next step in Meta’s subsea innovation, will be the first subsea cable to deliver petabit capacity at transoceanic distances, connecting France and the United States over approximately 7,000 km (4,300 mi). Expected to enter service in 2029, it will be the first subsea cable system to deploy multi-core fiber technology at scale, doubling [...] Read More... The post Inside Petal: Building
Notes on discrete-time Fourier series and transform
The following are my notes on discrete-time Fourier series (DTFS), as well as the discrete-time Fourier transform (DTFT). These topics serve as an important theoretical underpinning to the digital processing of signals by computers using the DFT (which will be covered in a future post). For discrete-time signals, we use …
Saving another 100TB of RAM with math (and Rust)
Cloudflare's global network is immense but not limitless. As we look for small ways to trim our resource usage, we sometimes get lucky and we can cut significantly more. Here’s how we reduced one of our Pingora-based service's RAM usage with statistics.
There's no point at which turning your brain off will work
In early 2025, I started seeing people turn off their brain as they use LLMs 1 . They would have an LLM take an action (summarize text, write some code, etc.), and just assume that it worked 2 . This generally didn't work in early 2025 and the result was often quite silly. As LLMs have gotten better, I've seen more of this. Sometimes, people will try to get the LLM to write some code for them and
Should you read the code, is RAG dead, and did Skills kill MCP?
We dive into these questions and other AI hot takes on the latest episode of the GitHub Podcast.
Leave the Class Path in the Rearview Mirror
How I Vibed a Proof of Conway’s Conjecture
You can just prove things, apparently.
Jev is the fastest-adopted model in AI Gateway history
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
Find features to support for Interop 2027 with your coding agent
Learn how you can use your coding agent to find Interop 2027 proposals to upvote, or find features to propose.
Migrating the GitHub Copilot runtime to Rust, using Copilot
A rewrite this size wasn't affordable before agents. Here's what porting the Copilot agent runtime to 800,000 lines of production Rust actually took.
Open-weight models take 56% of token volume, Astra doubles Fable 5.1 spend
When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
A modern storefront can look healthy while malicious JavaScript quietly siphons revenue, hijacks clicks, or rewrites analytics. See how Cloudflare's machine learning models surface evasive client-side attacks for analyst investigation.
Stop Treating CSS Container Queries Like Traditional Media Queries
Despite broad browser support, container queries remain surprisingly underused and frequently misunderstood. Let’s look at how they differ from media queries, when to reach for each, and how container queries help reusable components respond naturally to the contexts in which they appear. - CSS - Tools - Techniques
AI Changed How Spotify Builds. What We Learned (and Fixed) About Quality at Higher Velocity
Quality and reliability have always been a point of pride for Spotify. We run an extraordinarily complex...
Have it both ways: stay discoverable in search while disallowing AI training
Cloudflare is giving site owners a way to stay discoverable while disallowing AI training. New controls and an Accountable designation establish a shared model with Apple, Google, and Microsoft.
Give every teammate and agent the right level of access to your Workers
You can now scope access to individual Workers and assign narrower Developer Platform roles, so teammates, CI tokens, and agents get only the access they need to debug, deploy, or monitor safely.
What's new in CYPEX v2.0.0: tenancy moves from the query to the catalog
This blog highlights the details of CYPEX 2.0, with each feature being explained in detail. Read to know more.
How Delphi ships 100 times a day with its Python backend on Vercel
Introducing automatic remediation policies with Cloudflare CASB
Cloudflare CASB policies introduce a native automation engine built directly on the Cloudflare developer platform to remediate SaaS risks automatically. Security teams can now design event-driven logic to revoke risky file shares and send webhooks without manual intervention.
Marketing ops as code: Automating events from planning to follow-up on GitHub
If you can write down how you do your work, you can automate it. Here's what I did to support GitHub's APAC marketing team.
Building A UX ROI Case That Survives The Boardroom
Strong UX ideas do not secure investment on their own. Through a worked example, Alex Williams breaks down how to define business value, calculate costs, test causality, and build a credible case for the return on a design initiative. - UX - Design - Business
How Featured's users make 100K media pitches per month on Vercel
How Tailscale built a customer-facing model router on AI Gateway
1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
1.1.1.1 now validates DNSSEC signatures using NIST’s post-quantum ML-DSA-44 algorithm. Here is how we manage 2,420-byte signatures and downgrade risks at scale.
GitHub availability report: August 2026
In August, we experienced five incidents that resulted in degraded performance across GitHub services.
GitHub Copilot app for Beginners: Using the diff, terminal, and browser
Checking agent-generated code usually means hopping between tabs. Learn how to view diffs, run terminal commands, and preview web apps side by side in the GitHub Copilot app.
How we cut CDN metadata lookup latency by 91%
How we rebuilt Cloudflare Workers’ module registry for Node.js compatibility
Workers now enables Node.js compatibility by default, supports applications up to 64 mebibytes, and adds a URL-based module registry with import.meta, lazy compilation, shared code caches, and clearer errors.
The Death Of The Button: Why The Best Interface Is No Interface
TThe web is evolving beyond menus, forms, and endless clicks toward experiences shaped around human intent. For UX designers, understanding this shift means re-evaluating their role, moving from designing visible interfaces to guiding transparent, intent-driven AI experiences.
Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)
Automatic Key Exchange probes TLS 1.3-capable customer origins to learn which key agreement algorithms they support. We then lead with the most secure algorithm when connecting to the origin, preferring post-quantum connections wherever the origin supports it.
The Default Deny Dilemma: A Practical Guide to Kubernetes Network Policies
This blog is a deep walkthrough about network policies in Kubernetes, read to know more.
Introducing Kody: Your Personal Software Factory
Kody turns the good answer into a package you keep.