The alert closes and the credential stays live
GitHub's leaked-secret monitoring now lets an enterprise close an alert and says plainly that closing it revokes nothing, Cloudflare deleted a cache setting its customers were never equipped to tune, shut Korean social sign-up rather than gate it twice, and a practitioner put the source code last in an agent's bug hunt.
How we Organise
Cloudflare deleted the setting its customers were never equipped to tune
Range caching at Cloudflare had been a per-zone setting since the nginx era, with the range size baked into the cache key, so changing it threw away what was already cached. Small ranges meant many origin requests. Large ones pulled far more than the client asked for. Moving to a Pingora caching server made the question moot, because Pingora already stores each file in fixed-size chunks so an interrupted download can resume. The chunk became the range. Cloudflare reports p99 time to first byte for R2 down by about half. A later change cut tiered-cache traffic for R2 and similar workloads by about 6 per cent.
We tell a client that platform maturity shows in what the platform has stopped asking them to decide.
The platform’s job is to remove work no customer would ever pay for.
Cloudflare names the old defect itself: its internal cache limits were exposed directly to customers, who should not have needed to understand its capabilities in depth to get files served well. The figures are its own, taken on its own network, and nobody has replicated them. The feature is self-service on all plans now.
How we Build
Reading the code first is the last resort, not the starting point
Cindy Sridharan, writing up three recent bug hunts, puts the source code last in an agent’s investigation. Her method separates a tier of facts, the raw data about how the system actually behaved, from a tier of hypotheses inferred from them, and makes diagnosis the search for a hypothesis that satisfies every fact. She asks for a control first: a behaviour of the system that does not exhibit the bug. Requests that do not trigger it will do, or the same build in another environment. Some of the factual tier, she says, is active noise.
Our position is that an agent’s context is designed rather than filled.
What an agent is given is a budget, not everything that might be relevant.
Martin Fowler quotes her at length, puts the article at a 64-minute read, and says he would struggle to cut anything from it. Three bug hunts by one engineer carries no success rate and no comparison against an agent handed the code first, so this is an account and not a measurement.
How we Assure
A consent route that cannot carry the test is closed rather than excepted
Auditors appointed by the Korea Internet and Security Agency spent ten days on 80 controls before certifying Cloudflare under ISMS-P. Korean sign-up now itemises consent into four labelled items. Three are required and one is optional, and the three required ones hold the button disabled until each is checked. Sign-up with Google, Apple or GitHub never renders that form at all. So Cloudflare withdrew those routes in Korea rather than add a consent step after authentication for one country.
We judge an obligation discharged when something fails if it is not met.
Every obligation this use case carries is codified as a policy with a test, and no policy is orphaned from an obligation.
Both routes the practice accepts are exercised here. The disabled button is a policy carrying a test, and the certification is a signed external gate. Cloudflare is reporting its own certification, which shows that the controls were examined. The country branch is a two-letter code its own network already puts on the request.
GitHub finds credentials in repositories the firm never declared
GitHub’s public monitoring attributes leaked secrets to an enterprise by organisation membership or verified domain, in repositories the enterprise does not own. The October release adds dismissal and reopening with a comment, an activity timeline, filtering, always-on validity checks reporting a credential as Active, Inactive or Unknown, a REST endpoint and a webhook. The release landed on 23 October. GitHub states it plainly: closing an alert neither revokes the exposed credential nor removes it from the public repository.
The register we ask a client to keep reads two populations.
Everything this team runs is on the risk register with an identified owner and a severity.
Those two are the applications a team declares, and the systems people name when somebody asks what runs today. An outside index produces a third. Validity is now checked continuously rather than once. The feature is in public preview for Enterprise Cloud only, and GitHub publishes no figure for how many attributed leaks come from repositories nobody declared. If you keep a register and believe it covers this, write and tell us why: transform@dromologue.ai.