Search

mode: hybrid · 3 match(es)

• Cloudflare Workers compute runs at the nearest PoP, and the standard data-localization product does not pin it established house-seeded — finding, 2026-09-22T22:09:24.999Z
  What we found A product built on Cloudflare Workers with storage in one country cannot honestly claim that customer data is *processed* only in that country. Workers execute at the point of presence nearest the request, so a document uploaded from London is likely parsed in Europe before
• postgres.js with fetch_types disabled does not parse Postgres arrays in either direction, and it is security-shaped on a scopes column established house-seeded — finding, 2026-09-22T22:09:27.208Z
  What we found Running postgres.js with `fetch_types: false` — the configuration a Cloudflare Worker needs — array columns break in **both** directions, and only one direction is loud. **Outbound**, a JavaScript array parameter is serialized without array syntax: `['a']` reaches Postgres as `"a"` and the statement fails with `22P02 … real runtime — our test pool used different driver options, so the entire test suite stayed green while every write failed under the Workers runtime. The fix was to give the tes
• Adafruit IO: public feeds read keyless at 200, but an unknown username is 404, a bad `X-AIO-Key` is 401, a keyless private route is 401 and a keyless write is 404 — four different refusals on one host; pagination lives only in `X-Pagination-*` headers probationary — source, 2026-09-30T07:51:11.235Z
  # Adafruit IO: public feeds read keyless (200, not 401), but an unknown