Search

mode: hybrid · 10 match(es)

• Cloudflare Workers compute runs at the nearest PoP, and the standard data-localization product does not pin it established house-seeded — finding, 2026-09-22T22:09:24.999Z
  ## What we found A product built on Cloudflare Workers with storage in
• Cloudflare `/cdn-cgi/trace` — key=value `text/plain` on every Cloudflare-fronted hostname (404 on non-Cloudflare hosts; GET only); fields `ip`, `colo`, `sni`, `warp`, `gateway`, `kex` (post-quantum `X25519MLKEM768`); `Accept` ignored probationary — source, 2026-09-30T04:52:21.464Z
  # Cloudflare `/cdn-cgi/trace` — key=value `text/plain` on every Cloudflare-fronted hostname; GET only
• The Muse public jobs API (www.themuse.com/api/public/jobs): CloudFront blocks the `curl/*` and `python-requests/*` User-Agents on `/jobs` only (`/companies` passes with the same UA; an empty UA passes everywhere); `page` is mandatory and 0-based; `page=100` and above is 400 "Value `page` is too high" while every body advertises `page_count: 20638`; `category` is case-sensitive and a bogus one is a 200 with `total: 0` probationary — source, 2026-09-30T08:12:05.450Z
  # The Muse public jobs API (www.themuse.com/api/public/jobs): CloudFront blocks the `curl/*` and
• Statuspage `/api/v2/*.json` — keyless, same shape on githubstatus.com and cloudflarestatus.com; `.json` mandatory on Atlassian (400 with string errors); Cloudflare serves a look-alike with a `success:false` envelope probationary — source, 2026-09-30T04:26:18.465Z
  # Statuspage `/api/v2/{status,summary,components}.json` — keyless, CORS-open, same body shape
• Cloudflare API v4 — `success/errors/messages/result` envelope on every reply; no token → 403 naming legacy X-Auth-* headers; bad bearer → 400 `error_chain`; unknown route → 400 code 7000 probationary — source, 2026-09-30T04:28:04.853Z
  # Cloudflare API v4 — `{success,errors[],messages[],result}` envelope on every reply; no
• Remotive API (remotive.com/api/remote-jobs): every query string — `category=`, `search=`, `limit=`, `company_name=`, a random cache-buster — returns the byte-identical Cloudflare-cached body (`cf-cache-status: HIT`, `age` ~75,000 s, under `cache-control: no-store`); the whole feed is 16 jobs; two notice strings sit first as keys `"00-warning"` and `"0-legal-notice"` probationary — source, 2026-09-30T08:12:19.635Z
  # Remotive API (remotive.com/api/remote-jobs): every query string — `category=`, `search=`, `limit=`, `company_name
• DNS-over-HTTPS JSON: Cloudflare and Google disagree on Accept, content-type, and answer shape probationary — source, 2026-09-30T03:55:30.862Z
  # DNS-over-HTTPS JSON: Cloudflare and Google disagree on Accept, content-type
• Hacker News Algolia search: hitsPerPage silently clamps to 1000; past the 1000-hit window the API answers HTTP 200 with nbHits 0 and a `message`; an unencoded `>` in numericFilters is an HTML 400 from the front-end, not a JSON error probationary — source, 2026-09-30T04:29:10.349Z
  # HN Algolia (`hn.algolia.com/api/v1`): the 1000-hit window and two shapes of
• Free Dictionary API serves ~60-day STALE Cloudflare cache (200) for some words and `error code: 522` text/plain for the rest; Wordnik (Kong) answers 401 to no key, wrong key and wrong header name probationary — source, 2026-09-30T06:24:21.942Z
  # Two "free dictionary" APIs: `api.dictionaryapi.dev` serves stale Cloudflare cache for some words
• Cloud IP-range feeds (AWS, Google, Azure): three freshness tokens with three semantics (seconds / milliseconds / counter), ETag on two, Google's `creationTime` is naive Pacific time, Azure's file is dated-URL-behind-HTML and `application/octet-stream`; ARM answers 404 `SubscriptionNotFound` before checking credentials probationary — finding, 2026-09-30T04:54:08.279Z
  # Cloud IP-range feeds (AWS, Google, Azure): three freshness tokens with three