techlist.io
KREN

Techlist.io - Korean Tech Blog Curator

cloudflare3 min readCurated summary

Announcing Claude Compliance API support with Cloudflare CASB

Cloudflare is adding Claude Compliance API support to CASB, giving security teams visibility into Claude usage without endpoint agents or inline traffic inspection. The integration scans Claude organizations, projects, conversations, files, and artifacts for sharing issues and sensitive data, then surfaces findings in the Cloudflare dashboard. It also connects those findings to Cloudflare Gateway policies so teams can move from detection to enforcement. ## The Security Challenge of Enterprise AI - AI adoption has outpaced governance, leaving organizations with limited visibility into sanctioned tools. - Traditional controls may block unauthorized applications but cannot inspect activity inside approved AI platforms. - AI-specific risks include: - Employees entering customer or confidential data into prompts - Developers exposing API keys - AI-generated content containing company secrets - Files and data being shared through persistent conversations and agent workflows - Effective protection must cover the full lifecycle of AI data, including API usage, content handling, and data stored within applications. ## Cloudflare’s Layered AI Security Model - **Cloudflare AI Gateway** monitors requests, token usage, and model performance while supporting rate limits, caching, and routing controls. - **Cloudflare Gateway and Data Loss Prevention** inspect AI traffic and can block prompts containing personally identifiable information or confidential material. - **Cloudflare Access with MCP server portals** protects connections between agents and corporate systems, with centralized access control and audit logging. - **Cloudflare CASB** scans data stored inside Claude for misconfigurations and sensitive content through API integrations. ## Claude Compliance API Findings Cloudflare CASB connects to Anthropic’s Compliance API and displays findings alongside those from applications such as Microsoft 365, Google Workspace, and Salesforce. - **Projects:** Detect projects shared with an organization or selected users and groups. - **Project attachments:** Identify files and documents violating DLP policies. - **Chat files:** Scan user-uploaded and provider-generated files. - **Chat messages:** Inspect prompts and provider responses for sensitive data. - **Artifacts:** Detect sensitive information in AI-generated documents and files. - Findings are categorized, prioritized by severity, and handled through existing triage, assignment, and remediation workflows. ## Coverage for Claude Enterprise and Platform - For **Claude Enterprise**, CASB retrieves information about organizations, projects, chats, roles, messages, and uploaded files using read-only endpoints. - For **Claude Platform**, it continues to monitor member and workspace changes, API key creation, and file creation or download events. - Support for the Claude Platform Activity Feed is planned for a future release. ## From Detection to Enforcement - A finding such as a sensitive file upload can be converted into a Cloudflare Gateway policy. - Administrators can: - Block uploads to Claude for specific users - Restrict access to Claude entirely - Limit application functionality until the issue is resolved - This combines CASB’s visibility into stored data with Cloudflare’s inline policy enforcement. ## Getting Started - Organizations need a Claude Enterprise account. - They must request Compliance API access from Anthropic. - Once access is granted, the integration can be connected through Cloudflare CASB. Cloudflare’s recommendation is to combine CASB monitoring with Gateway, DLP, AI Gateway, and Access controls to govern AI usage across both traffic and stored data.

Read original(opens in new tab)
Model Context ProtocolData Loss PreventionAnthropicCloudflare Ai Gateway+4
dropbox3 min readCurated summary

Introducing Nova, our internal platform for coding agents

Nova is Dropbox’s internal cloud platform for running coding agents across the software development lifecycle. Rather than building separate tools for coding, CI debugging, migrations, and operational tasks, Dropbox created a shared platform that supports interactive sessions and autonomous workflows within its monorepo and infrastructure. The platform grounds agent changes in real builds and tests, making AI assistance more reliable and easier to integrate into engineering workflows. ## The Case for a Shared Platform - Engineering work includes repetitive but important tasks such as: - Debugging CI failures - Updating dependencies - Improving test coverage - Fixing flaky tests - Managing migrations and operational work - Different tasks require different interaction models: - Interactive chat for developer-driven work - Asynchronous workflows for long-running remediation and automation - Dropbox’s environment has specialized requirements: - A large monorepo - Bazel for builds and tests - Caching and remote execution - On-premises infrastructure - Dropbox-specific validation workflows - Off-the-shelf coding agents were designed primarily for local development and did not naturally fit this environment. ## How Nova Runs Coding Sessions - Each session runs in an isolated environment using a specific snapshot of the codebase. - Callers provide: - The repository commit - A task description - Optional validation commands - Iteration limits and branch settings - Nova can run builds and tests after an agent proposes a change. - If validation fails, the results are sent back to the agent so it can continue troubleshooting. - This creates a feedback loop of: - Propose a change - Validate it in the real environment - Correct failures - Repeat as needed - Nova supports multiple coding agents behind a common interface. - Engineers can access it through: - A web interface - A command-line client - An API - Internal scripts and services - The platform also provides prompt evaluation, observability, feedback collection, skills, plugins, and MCP integrations for accessing systems such as logs and monitoring tools. ## Deterministic Code Publication - Nova keeps code publication outside the agent. - Each session is limited to a single branch. - This makes active work and publication status predictable. - It avoids the complexity of agents creating and managing multiple branches. - The deterministic model simplifies automation such as: - Running tests - Rebasing onto the main branch - Tracking which changes belong to each session ## Engineering Workflows Using Nova ### Developer-Driven Sessions - Engineers use Nova’s web interface for quick fixes and prototypes without disrupting local work. - Validation commands can use Bazel selectivity tools to target the relevant compile and test dependencies. - Slack discussions can be carried into Nova sessions, preserving context and reducing manual setup. ### Flaky Test Remediation - Dropbox built Deflaker, a durable workflow connected to Athena, its flaky-test detection system. - Deflaker gathers examples of a test passing and failing. - It sends the associated logs to Nova. - The agent analyzes the evidence, identifies a likely cause, and proposes a fix. - This demonstrates how Nova can combine investigation, context gathering, and code changes in a longer-running automated process. ## Practical Takeaway Dropbox’s experience suggests that coding agents are most useful when embedded in existing engineering systems rather than treated as isolated code-generation tools. A shared platform like Nova can support many workflows while preserving consistent execution, validation, context, and observability.

Read original(opens in new tab)
ObservabilityCI/CDModel Context ProtocolSlack+4
kakao3 min readCurated summary

Stress Testing Know-How for Messaging Servers and How AI Lightened the Load

Kakao’s messaging platform team uses a continuously available stress-testing environment to identify scalability limits, failure points, and recovery behavior before production incidents occur. The setup mirrors production hardware, generates realistic traffic patterns with Locust, and tests both routine and extreme scenarios. The central lesson is that performance testing must examine not only application throughput, but also observability, infrastructure, framework choices, and domain-specific traffic behavior. ## Continuous Stress-Testing Environment - The environment has two main components: - Target servers using the same JVM heap, CPU, memory, and network specifications as production. - Load-generating clients built primarily with Locust, with workers scaled to hundreds of pods when necessary. - Client capacity is deliberately oversized so that the load generators do not become the bottleneck. - JMH may also be used for focused benchmarking. - Traffic scenarios are maintained according to realistic production ratios rather than simply generating large volumes of identical requests. - Typical scenarios include: - Normal midday traffic. - New Year’s midnight bursts, when message sending increases sharply. - Scenarios are built from configurable settings, allowing new traffic patterns to be created without rewriting load-generation code. ## What the Team Stress-Tests ### Observability and Logging Infrastructure - New or modified components such as Logstash, Fluent Bit, OpenTelemetry, and Vector are tested under production-like load. - The team checks: - Application throughput and elapsed time. - CPU, memory, and network overhead. - Delays in metrics collection and alerting. - Previous increases in application load caused by metric collection intervals demonstrated why monitoring infrastructure must also be performance-tested. ### Protocol and Framework Benchmarks - Server protocols and frameworks are benchmarked before changing business logic. - Tests isolate I/O behavior and compare alternatives such as WebFlux or virtual threads using real worker-count changes and system metrics. - CPU-bound work and I/O wait are increased separately to understand how each affects: - Requests per second. - Latency. - CPU utilization and other system resources. - During the C++-to-Kotlin migration, stress tests exposed system-metric differences and supported additional garbage-collection tuning. ### Operating-System and Security Changes - Host OS migrations and the addition of antivirus, monitoring, or security agents are tested under high load. - Stress tests have revealed issues such as slab-memory leaks and resource spikes caused by security software. - Components that appear harmless under normal traffic can materially affect high-throughput applications. ### Domain-Specific User Scenarios - Messaging systems have distinctive worst-case patterns, including: - Many users writing simultaneously in one chat room. - Midnight message bursts. - Entering group chats with hundreds of members. - These cases are reproduced by adjusting configurable load settings. - New features are stress-tested to locate bottlenecks before launch. ## Interpreting Test Metrics ### Endpoint-Level Metrics - **RPS:** Increase workers gradually to find saturation, or hold worker count constant to verify that throughput remains stable. - Unexpectedly low saturation points or sharply fluctuating RPS indicate a problem requiring deeper investigation. - **Latency:** P50 represents typical user experience, while P95 and P99 expose worst-case behavior. - Sudden P95/P99 increases may indicate internal capacity limits. - A degraded P50 can signal broader performance regression. - **Error rate:** Analyze 5xx errors, timeouts, and business errors separately. - 5xx responses may indicate server capacity exhaustion. - Timeouts may result from insufficient client resources. - 400-level errors can indicate broken test data or business logic. - Nonlinear changes in RPS or latency, or any unexpected errors, are signals to investigate lower-level system metrics. ## Practical Recommendation Maintain a production-like, always-available stress-testing environment with configurable realistic scenarios. Validate every major application, framework, observability, infrastructure, and feature change under both normal and worst-case traffic, then diagnose problems from endpoint metrics down through system resources.

Read original(opens in new tab)
ObservabilityKotlinOpen TelemetryPerformance Testing+4
grammarly2 min readCurated summary

How to Acknowledge an Email Professionally, With Examples

An acknowledgment email briefly confirms that a message was received when a complete reply is not yet possible. The most effective versions identify the specific document or request and provide a next step or response timeframe. Sending one promptly builds trust, prevents unnecessary follow-ups, and keeps work moving. ## Purpose of an Acknowledgment Email - Confirms receipt of an email, document, proposal, or request. - Differs from a full reply because it does not need to answer the underlying request. - Reassures the sender that their message is being handled. ## How to Write One - Keep the original subject line with “Re:” when replying in an existing thread. - Use a descriptive subject for a new thread, such as “Receipt confirmation: Q3 budget proposal.” - Clearly confirm receipt and reference the specific content. - Vague: “Got it, thanks.” - Specific: “Thank you for sending the signed vendor agreement. I’ve received it and will review it this afternoon.” - Set expectations with a deadline or next step, such as “I’ll follow up with feedback by Friday.” - Match the closing and tone to the relationship: - Internal: “Best” or “Thanks” - Formal or client-facing: “Best regards” or “Thank you” ## When to Send One - You received a document, proposal, invoice, contract, or formal request. - The matter is time-sensitive. - You are communicating with a new contact or client. - Someone needs your response before they can proceed. ## When to Skip One - You can provide a complete reply immediately. - The message is low-stakes or purely informational. - You were copied only for awareness and no response is expected. ## Useful Templates - **Simple:** “Got it, I’ll take a look and follow up by [Day]. Thanks.” - **Professional:** Confirm receipt of the document or topic, state when you’ll review it, and mention that you’ll follow up with questions. - **Formal request:** Name the document, confirm the receipt date, and provide a specific review timeframe. - **Job application:** Confirm the application was received and explain when candidates can expect next steps. - **Client or high-stakes matter:** Confirm receipt, identify the team or department handling it, and commit to a specific follow-up date. Send a short, specific acknowledgment whenever a full response will be delayed but the sender needs reassurance. When possible, provide a realistic deadline and meet it.

Read original(opens in new tab)
GrammarlyEmail CommunicationProfessional WritingBusiness Communication
discord2 min readCurated summary

Making It Easier Than Ever to Connect with Friends in League & VAL!

Discord and Riot are introducing account linking to make it easier to play League of Legends and VALORANT with Discord friends. Once linked, players can find friends, invite them to parties, share join links, and view game activity without switching between clients. The integration is available in regions where both services are supported and can be disconnected at any time. ## Faster Party Invites Through Discord - Linked accounts let players see which Discord friends play League or VALORANT directly in the in-game friends list. - Players can invite Discord friends to their party from the game. - Party join links can be shared in Discord servers, direct messages, or elsewhere. - Discord displays friends’ game status, including match duration and party size. ## Linking Riot and Discord Accounts - In Discord, open **User Settings → Connections**. - Select the Riot Games connection, possibly through **View More**. - Review the requested permissions and follow the authorization prompts. - Accounts can also be linked through Riot’s in-game client account-management pages. ## Data Sharing and Availability - The integration shares only information needed for its features, such as Riot ID, Discord account details, and game status. - Depending on authorization, it can access friends lists, manage friend connections, update activity status, and send or receive game invites. - A permissions screen appears before linking, and users can unlink their accounts from Discord settings. - Features are available where both Riot and Discord services are supported. Players who regularly coordinate League or VALORANT sessions should link their accounts to reduce the friction of finding and inviting friends.

Read original(opens in new tab)
DiscordAccount LinkingLeague Of LegendsValorant+2
gitlab2 min readCurated summary

Transform MRs from manual tasks to an automated workflow

GitLab 19.0 expands Developer Flow from generating merge requests to managing much of their entire lifecycle. Its AI agent can respond to reviews, investigate codebases, resolve conflicts, and split oversized MRs, while automation handles rebasing and merging. The result is less manual effort between opening and merging an MR, with developers supervising rather than executing every step. ## Developer Flow Across the MR Lifecycle - Can be triggered from: - An issue via **Generate MR** - An issue or MR assigned to the **Duo Developer** service account - Any issue or MR discussion using the new **@mention** trigger - Continues working on the same MR instead of creating separate changes to reconcile. - Handles: - Multiple rounds of reviewer feedback - Merge conflicts on long-running branches - Codebase research and technical evaluations - Oversized MR splitting - New feature implementation - Uses a single agentic loop with tools such as `read`, `grep`, file editing, and command execution. - Reads `AGENTS.md` for project conventions and operational guidance. - Uses `agent-config.yml` to configure dependencies, tooling, tests, and pre-commit hooks. These capabilities are available through GitLab Duo Agent Platform on Premium and Ultimate plans. ## Autonomous Merge Conflict Resolution - The beta **Resolve with Duo** button is available on the MR conflict page and merge checks widget. - The agent: - Reviews the MR’s intent and both branches - Selects a resolution strategy - Edits conflicting files - Commits and pushes the resolution - It leaves a summary comment explaining the conflict and resolution path. - If it cannot resolve the conflict safely, it reports that rather than guessing. ## One-Click Rebase and Merge - The beta feature combines rebasing and merging into one action. - It is designed for teams using semi-linear or fast-forward merge methods. - It is available on Free, Premium, and Ultimate tiers. ## Reducing Manual MR Work GitLab distinguishes between AI-driven judgment and mechanical automation: - AI handles code changes, reviewer feedback, and conflict resolution. - Automation handles tasks such as rebasing before merge. - Together, these features reduce the time developers spend on repetitive MR maintenance while preserving human oversight for steering, reviewing, and final decisions. Developers can try Developer Flow through a GitLab Duo Agent Platform trial. Existing Premium and Ultimate users with the platform can use it on merge requests, while older GitLab versions may require manually configuring the mention trigger.

Read original(opens in new tab)
AI AgentsCI/CDGitlabDevSecOps+4
gitlab2 min readCurated summary

More AI models for GitLab Duo Agent Platform Self-Hosted

GitLab 19.0 expands open source model support for Duo Agent Platform Self-Hosted, giving regulated and air-gapped teams more capable AI options without sending source code to external APIs. The update supports selecting different models for different workflows and enables both fully on-premises and hybrid deployments. GitLab’s goal is to reduce the capability gap between isolated environments and cloud-based AI services. ## Challenges for Regulated and Air-Gapped Teams - Data residency, compliance rules, and network isolation often prohibit third-party AI APIs. - Air-gapped environments must run inference locally because they have no internet or external connectivity. - Teams have traditionally faced a trade-off between using an underpowered model and deploying an unnecessarily large model for routine tasks. - These constraints have limited AI productivity gains in highly regulated environments. ## Expanded Open Source Model Support GitLab evaluated models for: - Multi-step tool use - Instruction adherence - Code generation - Reasoning across large diffs and multi-file codebases Newly supported models include: - Mistral Devstral 2 123B - GLM-5.1 - Kimi-K2.6 - MiniMax-M2.7 ## Deployment Options - The recommended setup uses on-premises hardware with vLLM for model serving. - Organizations can also deploy models on GPU-enabled virtual machines in private clouds. - Both approaches keep data within the organization’s controlled environment. - Fully air-gapped teams should use locally hosted models and consult hardware requirements for each model. - Hybrid deployments can combine self-hosted and GitLab-managed models on a per-feature basis. ## Availability and Licensing - Offline-license customers need the GitLab Duo Agent Platform Self-Hosted add-on. - Online-license customers can use usage-based models and combine self-hosted and GitLab-managed models. GitLab recommends choosing models and infrastructure based on network isolation, compliance requirements, hardware availability, and workflow needs. The expanded support makes self-hosted AI a more practical option for organizations that require strict control over their code and data.

Read original(opens in new tab)
Gitlab Duo Agent PlatformVllmGpu InferenceSelf Hosted Ai+3
gitlab3 min readCurated summary

Manage CI/CD credentials with GitLab Secrets Manager

GitLab Secrets Manager, entering public beta with GitLab 19.0, provides a native way to manage CI/CD credentials without storing them in broadly scoped variables or configuration files. Built on OpenBao and integrated with GitLab’s existing permissions, environments, branches, and audit trails, it aims to reduce credential exposure and simplify incident response. The post recommends trying it in existing GitLab projects and pipelines, especially where least-privilege access is difficult to enforce. ## Where CI/CD Secrets Commonly Go Wrong - Developers often store credentials in: - Project- or group-level CI/CD variables - Configuration files - Accidentally committed `.env` files - Masked CI/CD variables may still be exposed to every job and anyone with pipeline access. - Standalone vaults improve separation but introduce: - A second authentication system - Separate permission models - Additional audit logs and operational overhead ## Using GitLab Secrets Manager - Secrets are stored within GitLab’s existing project and group structure. - Pipelines reference secrets with the `secrets:` keyword in `.gitlab-ci.yml`. - By default, GitLab writes the secret to a temporary file and exposes its path to the job. - Passing a file path instead of the raw value can reduce exposure in: - Subprocesses - Crash dumps - Telemetry systems ## GitLab-Based Access Controls - Secrets use GitLab’s existing users, groups, projects, and roles. - Permissions can be assigned for reading, creating, updating, and deleting secrets. - Group-level secrets are inherited by nested projects, allowing common credentials to be defined once. - Removing someone from a project or group immediately removes their access to its secrets. - This avoids maintaining a separate access hierarchy that could drift from GitLab’s permissions. ## Job-Level Secret Scoping - Each secret can be restricted based on: - Target environment - Branch - Whether the branch is protected - Wildcards such as `production/*` simplify environment and branch rules. - Multiple conditions can be combined, such as requiring both a protected branch and a production environment. - At runtime, the backend verifies the job’s identity and scope before returning the secret. - Secrets are discarded when the job ends, and job logs are masked. - Narrow scopes reduce the systems affected if a dependency or pipeline is compromised. ## Auditing Secret Usage - Secret creation, updates, and deletions appear in GitLab’s existing audit trail. - Pipeline secret reads include the originating pipeline and job IDs. - Responders can trace where a credential was used without correlating separate systems manually. - Audit logging is available for self-managed deployments; GitLab.com support is expected during the beta. ## Public Beta Availability - The beta is available to Premium and Ultimate users on GitLab.com and self-managed deployments. - GitLab Dedicated support is planned. - The feature is free during beta and will later become a paid GitLab Credits feature. - Existing integrations with HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, and Google Cloud Secret Manager remain available. GitLab Secrets Manager is best suited for teams that want least-privilege CI/CD credentials while keeping access control and auditing within GitLab. Teams can adopt it incrementally alongside existing external secrets platforms.

Read original(opens in new tab)
CI/CDAccess ControlSecrets ManagementAudit Logging+3
gitlab4 min readCurated summary

GitLab 19.0 | GitLab Docs

GitLab 19.0, released May 21, 2026, expands AI-assisted development, work-item customization, secrets management, and dependency security. Major changes include group-level Duo review instructions, configurable work-item types, open beta access to GitLab Secrets Manager, and generally available SBOM-based dependency scanning. GitLab also introduces usage-based billing for Duo Core and adds new agent, search, model, and workflow capabilities. ## Customization and Project Management ### Group-level custom review instructions for GitLab Duo - Premium and Ultimate feature for GitLab.com, Self-Managed, and Dedicated. - Groups and subgroups can share review guidance through: ```text .gitlab/duo/mr-review-instructions.yaml ``` - A project in the group serves as the template. - Group instructions are combined with project-specific instructions. - Supported by both Code Review Flow and GitLab Duo Code Review. ### Configurable work item types - Projects can define custom types such as User Story, Bug, or Maintenance instead of using only Issues and Tasks. - Each type has its own name and icon. - Types support custom fields, status lifecycles, saved views, and issue boards. - Configuration at the top-level group or organization cascades to projects. - Administrators can enable or disable types globally or allow project-level control. - Disabling a type does not affect existing work items. ## Security and Dependency Management ### GitLab Secrets Manager enters open beta - Available to Premium and Ultimate customers on GitLab.com and GitLab Self-Managed. - Project and group Owners can store and reference CI/CD secrets in GitLab. - Secrets are scoped to projects or groups and available only to jobs that explicitly request them. - The feature remains subject to beta support policies and may not be production-ready. ### SBOM-based dependency scanning becomes generally available - Available for Ultimate customers across GitLab offerings. - Maven, Gradle, and Python projects receive visibility into transitive dependencies and their vulnerabilities. - Automatic dependency resolution runs when no lockfile or dependency graph is available. - If resolution is unavailable, manifest scanning examines direct dependencies in files such as: - `pom.xml` - `requirements.txt` - `build.gradle` - `build.gradle.kts` - Manifest scanning is enabled by default, while full transitive coverage requires dependency resolution, a lockfile, or a manually supplied dependency graph. ## GitLab Duo and Agentic Development ### Duo Developer enhancements - GitLab Duo Developer can be triggered by: - Assigning it to an issue - Selecting **Generate MR** - Mentioning it with `@mention` in an issue or merge request discussion - It can turn feedback, to-do items, and design questions into code changes, follow-up merge requests, or research summaries. - With `AGENTS.md` and `agent-config.yml`, it can run tests and checks before committing. - Administrators can enable mention and assignment triggers for eligible projects. ### Duo Core adopts usage-based billing - Code Suggestions in the Web IDE and desktop IDEs now consume GitLab Credits. - Duo Chat becomes agentic for Duo Core users and runs on the GitLab Duo Agent Platform. - Administrators must enable the Agent Platform for the instance or top-level group to use Chat in GitLab or desktop IDEs. ### New agent and search capabilities - Exact code search supports repository filtering with the `repo:` syntax: ```text def authenticate repo:my-group/my-project ``` - Flows and external agents can trigger when a draft merge request is marked ready for review. - The merge request ready trigger is controlled by the `merge_request_ready_flow_trigger` feature flag and is disabled by default. - Claude Opus 4.7 is available in the Duo Agent Platform for complex, multistep tasks involving code review, CI/CD, and vulnerability resolution. - GitLab Duo Agent Platform Self-Hosted adds compatibility with Gemini models and supports multiple flows, including Code Review Flow and SAST vulnerability workflows. GitLab 19.0 is particularly significant for teams adopting AI agents and centralized development governance. Organizations should review Duo’s new billing model, test Secrets Manager carefully during its beta period, and enable dependency resolution to obtain comprehensive vulnerability coverage.

Read original(opens in new tab)
CI/CDGitlabPythonGitlab Duo+4
gitlab2 min readCurated summary

Track CI component usage across your organization

GitLab 19.0 adds Components Analytics to the CI/CD Catalog, giving organizations visibility into how shared CI/CD components are adopted and which versions projects use. All tiers provide high-level usage counts, while GitLab Ultimate offers project-level version tracking and outdated-version identification. The feature helps platform teams respond to security issues, manage upgrades, and govern increasingly AI-generated pipelines. ## The Visibility Gap in Shared CI - The CI/CD Catalog centralizes versioned, reusable pipeline components. - Previously, maintainers could not easily determine: - Whether components were being used - Which projects depended on them - Which versions were still active - Security fixes did not automatically reach projects using older component versions, making organizational exposure difficult to measure. ## High-Level Adoption Analytics - Available across all GitLab tiers, including Free; introduced in GitLab 18.9. - Found under **Explore > CI/CD Catalog > Analytics**. - Shows, for each maintained catalog resource: - The latest released version - The number of unique projects using it in the past 30 days - Components available in that version - Helps teams prioritize maintenance, plan deprecations, and assess investment in shared CI infrastructure. ## Component Usage Detail in Ultimate - GitLab Ultimate provides per-component drill-down analytics. - Maintainers can see: - Which projects used each component in the past 30 days - The version used by each project - Whether each project is up to date or outdated - This makes it easier to respond to vulnerabilities, notify project owners, open merge requests, and assess the impact of refactors or deprecations. ## Native Governance Compared with Other Platforms - GitHub Actions lacks native organization-wide catalog analytics for reusable workflows. - CircleCI Insights focuses on pipeline performance rather than orb adoption and versions. - Jenkins Shared Libraries require custom tooling to track usage. - GitLab combines a governed component catalog with built-in adoption and version visibility. ## Supporting AI-Generated Pipelines - The catalog establishes standardized CI practices, while analytics verifies whether those standards are actually used. - This is increasingly important as AI tools generate more production pipelines. - Self-Managed and Dedicated customers can mirror GitLab components and combine them with internally built components for regulated or air-gapped environments. Organizations maintaining CI/CD Catalog components can use adoption metrics immediately. Teams needing project-level version and remediation details require GitLab Ultimate.

Read original(opens in new tab)
CI/CDGitlabDevSecOpsYaml+3
github1 min readCurated summary

Investigating unauthorized access to GitHub-owned repositories

Alexis Wales is GitHub’s Chief Information Security Officer, responsible for protecting the platform, its products, and the open source community. With two decades of experience defending critical networks, she combines public- and private-sector expertise to address major cybersecurity challenges affecting modern technology. ## Leadership at GitHub - Leads a team of security professionals at GitHub. - Focuses on safeguarding GitHub’s platform and products. - Supports more than 150 million developers building and deploying software securely. - Helps protect the broader open source community. ## National Cybersecurity Experience - Has 20 years of experience defending critical national and private-sector networks. - Previously worked with the Department of Defense. - Served at the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA). ## Public-Private Collaboration - Her government experience shaped a strong interest in cooperation between public and private organizations. - Advocates collaboration to solve complex security threats affecting widely used technology. Overall, Wales’s work combines large-scale platform security with cross-sector cooperation to strengthen cybersecurity for developers and the broader technology ecosystem.

Read original(opens in new tab)
Open SourceCloud SecurityGithubCybersecurity+1
figma3 min readCurated summary

The Figma Design Agent is Here | Figma Blog

Figma introduces a design agent built directly into its canvas and left rail. Unlike external tools, it understands a team’s components, tokens, libraries, standards, and best practices, while preserving designers’ ability to manipulate files directly. The agent is intended to support exploration, iteration, collaboration, and repetitive production work without forcing a choice between AI speed and design precision. ## A Figma-native design agent - Works inside the same Figma file as the team, acting as a collaborative partner. - Can start from any design layer and generate or edit Figma layers. - Supports parallel prompting to explore multiple ideas simultaneously. - Lets designers continue making manual edits while the agent works. - Uses context from frequently and recently used components, with additional control through selected libraries and `@` mentions for tokens, variables, and components. - Is designed for direct manipulation and editing of Figma files, rather than simply producing external suggestions. ## How the agent works with MCP and Figma Make - The Figma agent is intended for canvas-based work and has deeper design-system context. - Figma’s MCP server and `use_figma` support movement between code and the canvas: - Pull code into Figma for iteration or design-system application. - Push designs back to code while maintaining fidelity. - Teams can begin in Figma Design, use the agent to clarify flows, states, copy, and structure, then send work to Figma Make to generate code layers. - Alternatively, teams can start in Figma Make, copy frames into Figma Design, refine them with the agent, and return them to Make. ## Exploring more design directions - The agent helps designers generate several approaches instead of settling for the first plausible result. - It can: - Produce distinct stylistic directions for the same design. - Compare checkout flows optimized for different business goals. - Generate alternative information architectures. - Create multiple screen or layout variations. - Example prompts include generating organic, modern, and retro style options, or producing image carousels with different title treatments. - Once a direction is selected, hands-on editing remains an efficient way to refine the design and reduce unnecessary prompting. ## Automating repetitive design work - The agent handles bulk operations that require both scale and design context. - Potential tasks include: - Renaming variables consistently. - Replacing components across many screens. - Applying padding changes throughout a flow. - Populating frames with realistic content. - Updating typography across a file. - Replacing placeholder text and imagery. - Setting chip components to active states. - Converting screens to dark mode with appropriate fill and contrast changes. - For design-system teams, it can help update library descriptions, tags, use cases, naming conventions, and component documentation. - This automation is designed to preserve momentum between AI-generated changes and precise manual adjustments. The practical recommendation is to use the Figma agent for broad exploration and context-heavy repetitive work, while retaining direct canvas manipulation for judgment, refinement, and final design decisions.

Read original(opens in new tab)
AIDesign SystemsGenerative AIModel Context Protocol+2
cloudflare3 min readCurated summary

Announcing Claude Managed Agents on Cloudflare

Cloudflare and Anthropic have integrated Claude Managed Agents with Cloudflare Sandboxes, separating Claude’s agent reasoning from the infrastructure that executes code. The integration adds customizable security controls, sandbox observability, private-service access, browser auditing, email, and custom tools. It supports both full microVMs for complex workloads and lightweight isolates for fast, large-scale execution. ## Claude Managed Agents and the “Brain vs. Hands” Model - Claude Managed Agents run on Anthropic’s platform and can: - Read and write files - Run commands and code - Browse the web - Use prompt caching, compaction, and agent-focused optimizations - The integration decouples: - **The brain:** Claude’s agent loop on Anthropic’s infrastructure - **The hands:** Code execution, tools, sandboxes, and connected services on Cloudflare - Self-managed execution gives organizations more control over security, compliance, infrastructure, and performance. ## Cloudflare-Based Agent Environments - A Workers-based control plane creates a sandbox for each Claude Agent session. - Sandboxes support: - Code execution and file operations - Application development and CLI tools - Persistent state across session sleeps - Developers can customize: - Sandbox instance sizes - Container images for VM-based sandboxes - Cloudflare provides detailed metrics and logs, dashboard monitoring, external log shipping to services such as Datadog or Splunk, and SSH access to running sandboxes. - A built-in UI helps track sandbox state and open interactive shell sessions. ## Scaling with Isolates and MicroVMs - Full microVMs are appropriate for agents that need Linux environments, developer tooling, or complete application stacks. - Cloudflare also offers lightweight V8 isolate sandboxes using Agents SDK, Dynamic Workers, and Codemode. - Isolates provide: - Millisecond-level startup - Lower infrastructure costs - File-system support and arbitrary code execution - Much higher concurrency than VM-based systems - Developers can select an “isolate” backend when configuring an agent. - Isolates are intended for workloads reaching tens of thousands of concurrent agents, while Cloudflare Containers provide microVM-based execution when stronger environment fidelity is required. ## Security and Agent Connectivity - The default deployment routes agent traffic through customizable outbound proxies. - Proxies can help: - Inject credentials outside the sandbox - Prevent agents from accessing raw secrets - Reduce data exfiltration risk - Monitor interactions with external services - Agents can connect to private internal services without exposing those services directly to the public Internet. - The integration also includes browser session controls, recordings, audit trails, and human-in-the-loop workflows. ## Built-In Agent Capabilities The deployment template includes several capabilities without requiring additional infrastructure: - Detailed sandbox metrics, logs, and SSH access - Custom sandbox images and resource sizing - Browser automation with observability - Individual email addresses and outbound email for agents - Custom tools implemented as functions and deployed directly - Flexible execution through either isolates or microVM-backed sandboxes Cloudflare’s recommendation is to use isolates for inexpensive, highly concurrent workloads and microVMs when agents require full Linux environments or complex development workflows. The integration is designed to let teams keep Claude’s reasoning on Anthropic while retaining control over execution, connectivity, security, and observability on Cloudflare.

Read original(opens in new tab)
Cloudflare WorkersZero Trust SecurityCloudflare SandboxesAgent Sdk+3
google2 min readCurated summary

Empirical Research Assistance (ERA): From Nature publication to catalyzing Computational Discovery

Empirical Research Assistance (ERA) is a Google AI system designed to help scientists develop expert-level computational models. Using Gemini, it searches literature, generates and evaluates code, and explores thousands of possible solutions through tree search. A Nature paper reports strong performance across scientific benchmarks, while new applications suggest ERA can accelerate research in health, climate, energy, and economics. ## How ERA Supports Scientific Coding - ERA starts with a scientific problem and a success metric. - It searches relevant research, combines methods, writes code, and iteratively tests and improves solutions. - Its tree-search process evaluates thousands of alternatives to optimize the resulting model. - Benchmarks in genomics, public health, satellite imagery, neuroscience, time-series forecasting, and mathematics showed expert-level performance. ## Applications to Open Scientific Problems - **Epidemiological forecasting** - Predicted U.S. hospital admissions up to four weeks ahead for flu, COVID-19, and RSV. - Forecasts ranked at or near the top of CDC leaderboards. - The techniques can potentially be adapted to other countries and diseases. - **California water-supply forecasting** - Produced seasonal runoff predictions for snow-fed river basins. - Delivered more accurate early forecasts than California’s official Bulletin 120 outlook. - Improved predictions could support water management and agriculture. - **Atmospheric carbon dioxide monitoring** - Combined geostationary weather-satellite data with other inputs to estimate CO₂ concentrations every 10 minutes across broad areas. - Captured urban emissions, plant-driven daytime absorption, and other atmospheric cycles. - Provides higher spatial and temporal coverage than measurements from satellites such as Orbiting Carbon Observatory-2. - **Solar-energy design** - Combined ERA with Google Antigravity to optimize three-dimensional solar-panel geometries. - Identified a 500-triangle volumetric fan design that could capture scattered radiation without backward shading. - **Retail forecasting** - Used economic indicators, Google Trends, historical patterns, and consumer sentiment. - Matched or exceeded commercial consensus forecasts and the Chicago Fed’s monthly retail forecast. ## Computational Discovery - Google is gradually opening access to Computational Discovery through a trusted tester program in Google Labs. - The system combines ERA with AlphaEvolve to support computational scientific investigation. - It complements other Gemini for Science experiments: - **Hypothesis Generation**, built with AI Co-Scientist, supports developing scientific hypotheses. - **Literature Insights** supports research and literature analysis. ERA’s demonstrated value lies in automating the labor-intensive cycle of designing, testing, and refining scientific software. Its expanding applications indicate that AI-assisted computational research could broaden access to advanced modeling while helping experts investigate complex scientific problems more quickly.

Read original(opens in new tab)
AIMachine LearningGeminiTime Series Forecasting+4
figma2 min readCurated summary

Friends of Figma’s Brand Refresh Tells the Story of a Global Community | Figma Blog

Friends of Figma has introduced a refreshed brand identity to represent its rapidly growing, globally diverse community. The redesign aims to remain recognizably connected to Figma while giving local chapters freedom to express their own cities, cultures, and members. Its central idea is a flexible, community-owned design system built around shared principles rather than uniform results. ## Friends of Figma’s Global Community - Friends of Figma is Figma’s official user group program for connecting, learning, and sharing inspiration. - The program includes more than 250 chapters across 82 countries. - In the previous year, chapters hosted over 900 events, including: - Workshops and webinars - Craft talks and watch parties - Casual meetups and social events - The program began in 2020 after communities had already been organizing meetups since 2018. - Figma says community is especially important as AI rapidly changes the design industry. ## A Brand That Is Globally Local - The new identity had two primary goals: - Stay connected to the Figma brand so chapters can attract members and sponsors. - Give chapters enough flexibility to reflect their own regions and cultures. - Rather than forcing every chapter to look identical, the system is designed to be shared, owned, and shaped by local organizers. - Figma describes this as a “democratic design system” connected by a common spirit. ## Reworking the Figma Shapes - The redesigned Friends of Figma logo separates the basic shapes of the original Figma mark. - These shapes become building blocks for new compositions. - Their coming together symbolizes individual chapters forming a larger global community. - The identity extends across: - Color guidelines - Chapter badges - Stickers - Event materials - Photography ## Flexible Guidelines for Chapter Creativity - The toolkit provides enough structure to create consistency without limiting local expression. - Chapters share a core color system but can select six additional colors from an approved palette. - Sticker templates offer basic shapes and guidance, while chapters decide what imagery and content to place inside them. - The visual system focuses on real people, local places, and in-person events rather than abstract corporate branding. - New photo guidelines encourage a street-level perspective rooted in what local communities recognize and understand. The refresh positions Friends of Figma as a shared global framework with strong local ownership. Chapters can use the common identity to feel connected to Figma while still creating a brand presence that genuinely reflects their own communities.

Read original(opens in new tab)
FigmaDesign SystemsBrandingVisual Identity+1