Telexed

AI news through a solo-operator lens — only what changes your day30 of 412

FILTER[All][Agents & tools][Models & API][Generative media][Infra & SaaS][ASO & growth][Indie business][Idea signals][Other][★6+ high-signal]

clear filters

Yesterday1 dispatches

#0412
#0412Infra & SaaS RevenueCat Blog23 hours ago
`RevenueCat` Adds Flexible Discounts for Web Billing
60radar
RevenueCatSubscription billing infra — unified app and web subscriptions
Web subscriptions can now use percentage discounts, promo codes, and win-back offers. Useful for churn recovery and price testing without wiring discount logic yourself.
- Percentage-off discounts and promo codes now apply to RevenueCat web subscribers, reducing custom billing work.
- Win-back offers target cancelled or lapsed users. That gives churn recovery a built-in path instead of ad hoc email-only campaigns.
- The scope is web billing, not App Store pricing. Best fit is a paid web checkout where discount tests can move quickly.
Source: www.revenuecat.com/blog/company/flexible-discounts-web-bRead original →
FIG-4121:1
60radar
FIG-4121:1

Sun, May 171 dispatches

#0411
#0411Infra & SaaS GeekNews3 days ago
`Stripe Link CLI` Lets AI Agents Pay on a User's Behalf
70radar
Stripe Link CLIPayment CLI — one-time credentials from a Link wallet
Agents can receive one-time payment credentials from a Link wallet without storing raw card data. Useful for agentic commerce experiments; production value depends on merchant support.
- Issues one-time credentials from a Link wallet, so agents can complete purchases without keeping actual card details.
- Supports two credential types: broadly usable virtual card PAN and an S... option based on Machine Payment Protocols.
- This is payment infrastructure, not just automation. It opens tests for delegated checkout, procurement bots, and agent-run SaaS workflows.
Source: news.hada.io/topic?id=29579Read original →
FIG-4111:1
70radar
FIG-4111:1

Fri, May 152 dispatches

#0410
#0410Infra & SaaS vercel_blog5 days ago
`AI Gateway` adds request-time provider ranking controls
80radar
AI GatewayAI routing service — failover across model providers
Routing can now optimize on price, first-token latency, or throughput at request time instead of Vercel's blended default. Useful when one model has many providers and the cheapest or fastest route materially changes margin or UX.
- Set sort on providerOptions.gateway to 'cost', 'ttft', or 'tps' depending on whether margin, snappiness, or long-output speed matters most.
- Ranking is computed at request time, so newly added providers, price changes, and observed latency shifts flow through without code changes.
- Fallback is strict: providers are attempted in sorted order, and the next one is used only if the higher-ranked provider is unavailable.
- sort works with Zero Data Retention filtering and with order; pinned providers stay first, then the rest follow the chosen ranking.
- Each response exposes routing metadata with a sort block showing candidates, metric values, attempt order, and health-based deprioritization for debugging.
Source: vercel.com/changelog/sort-providers-by-cost-latency-or-tRead original →
FIG-4101:1
80radar
FIG-4101:1
#0409
#0409Infra & SaaS vercel_blog5 days ago
`Vercel CLI` adds native `curl` syntax
50radar
Protected deployments can now be hit with plain curl-style requests using your Vercel auth. It removes header and token boilerplate for preview smoke tests, so updating the CLI is worth it.
- vercel curl now accepts full URLs, bare hostnames, and the --url flag, so existing curl habits mostly transfer over.
- Vercel auth is reused to bypass Deployment Protection, which cuts the usual preview-token and header setup.
- Linked projects can pass just a path instead of a full URL, making repeated endpoint checks much faster.
- This is a small feature, but it sharpens local-to-preview debugging loops where protected environments slow teams down.
Source: vercel.com/changelog/use-native-curl-syntax-with-vercel-Read original →
FIG-4091:1
50radar
FIG-4091:1

Thu, May 144 dispatches

#0408
#0408Infra & SaaS Simon Willison5 days ago
`datasette-ip-rate-limit` `0.1a0`, path-level IP throttling for crawler abuse
50radar
datasette-ip-rate-limitDatasette plugin — path-level IP throttling rules
Bad crawlers hitting hot paths can now be blocked with 60 req/60s per-rule limits. Path-specific throttling in datasette.yml makes this a practical low-cost ops guardrail.
- Production config reads Fly-Client-IP and sets max_keys to 10000. It fits proxy-based deployments without extra app logic.
- Exemptions for /static/* and /-/turnstile* keep assets and bot checks flowing while narrowing protection to expensive routes.
- The example rule targets /global-power-plants/* and /legislators/*: 60 requests per 60s, then 20s blocked.
- Still an alpha at 0.1a0, but the config surface is small enough to copy into lightweight self-hosted services quickly.
Source: simonwillison.net/2026/May/14/datasette-ip-rate-limit/#aRead original →
50radar
PHOTO
FIG-4081:1
#0407
#0407Infra & SaaS vercel_blog6 days ago
`Vercel` adds `Protected Source Maps` for production-only debugging
70radar
Protected Source MapsDeployment security feature — hides browser source maps behind auth
Production source maps can now stay accessible to your team while returning 404 to everyone else. It removes a common tradeoff between readable stack traces and leaking original frontend code, so existing projects should turn it on now.
- Browser .map files now sit behind Vercel Authentication, letting internal users fetch them while blocking public access with 404 responses.
- New projects get the setting enabled by default, which lowers the chance of accidentally exposing source maps on fresh launches.
- Existing projects can enable it in Settings -> Deployment Protection with no redeploy, so rollout cost is near zero.
- This keeps production debugging intact with real filenames and line numbers, without leaving unminified source structure open to anyone scraping assets.
Source: vercel.com/changelog/protected-source-maps-ship-browser-Read original →
FIG-4071:1
70radar
FIG-4071:1
#0406
#0406Infra & SaaS trends_vc6 days ago
AI Gateways Turn Model Choice Into Infrastructure
50radar
Routing is becoming its own layer above model APIs. OpenRouter scale shows provider lock-in is weakening, but this is more strategy signal than immediate tooling change.
- OpenRouter handles 20T+ tokens per week; no single provider owns over 23% of volume, so demand is already multi-model.
- Gateways add switching, routing, and caching above APIs. The moat shifts from model access to traffic control and cache hit rate.
- Vertical gateways are the practical angle: wrappers for coding, support, agents, or media can optimize cost and reliability per workflow.
- Hyperscaler bundling is the counter-pressure. Standalone gateway margins get squeezed if cloud platforms bundle routing into existing infra.
Source: trends.vc/ai-gateways-cache-as-moat-vertical-gateways-hyRead original →
FIG-4061:1
50radar
FIG-4061:1
#0405
#0405Infra & SaaS Hacker News · Show HN AI6 days ago
`Ardent` launches Postgres sandboxes for coding agents without DB migration
60radar
ArdentDB sandbox — prod-like branches without migration
Production-like DB branches spin up in under 6s without moving off your current hosted Postgres. Useful if agent-written schema or data changes need realistic testing before they touch prod.
- It uses logical replication plus DDL triggers instead of physical replication, so existing hosted Postgres setups can adopt it without a platform move.
- The stack fans replication through Kafka and uses Neon-style branching, targeting sub-6-second clones even at TB scale.
- A proxy layer issues custom Postgres URLs, adds finer-grained clone access control, and reduces raw credential exposure.
- Pre-return SQL hooks support anonymization and branch mutation, which makes PII redaction part of the sandbox flow instead of a separate step.
Source: www.tryardent.com/Read original →
FIG-4051:1
60radar
FIG-4051:1

Wed, May 134 dispatches

#0404
#0404Infra & SaaS vercel_blog7 days ago
`Vercel` adds `Trusted Sources` to Deployment Protection
70radar
Trusted SourcesDeployment protection feature — accepts short-lived `OIDC` tokens
Short-lived OIDC tokens can now replace shared bypass secrets for protected deployments. Safer CI and cross-project calls with less secret sprawl; worth adopting now.
- Requests now pass an OIDC token in x-vercel-trusted-oidc-idp-token; Vercel verifies signature, claims, and env match before allowing access.
- A project can access its own deployments by default, and same-team cross-project access is allowed by adding explicit source rules.
- Rules are configurable per from / environment pair, so preview, staging, and production access can be split cleanly.
- External identity providers are supported too, including GitHub Actions; one-off automation no longer needs a long-lived shared bypass secret.
Source: vercel.com/changelog/trusted-sources-for-deployment-protRead original →
FIG-4041:1
70radar
FIG-4041:1
#0403
#0403Infra & SaaS r/ClaudeAI7 days ago
Built a Live Election Dashboard in 2 Days With `Claude` and Cloudflare’s Free Tier
50radar
CloudflareEdge platform — CDN and KV for free-tier global delivery
A laptop scraper plus Cloudflare KV and CDN handled 430K requests without paid hosting, DB, or a domain. The useful takeaway is the architecture: push precomputed snapshots to the edge and keep the browser dumb when traffic spikes.
- The stack stayed extremely lean: a Python scraper pulled 234 result pages, merged them, and wrote snapshots to Cloudflare KV for global delivery.
- Traffic stress was real, not hypothetical: 24K visitors, 430K requests, 8.7 GB bandwidth, and 24 countries on election day.
- Write volume hit 997 in a day against a 1,000 free-tier limit, which shows this pattern works but has almost no headroom for more frequent refreshes.
- Feature velocity mattered as much as infra: requests like close races and counted percentage shipped in minutes, with 60+ commits during the live event.
Source: www.reddit.com/r/ClaudeAI/comments/1tbges5/i_used_claudeRead original →
FIG-4031:1
50radar
FIG-4031:1
#0402
#0402Infra & SaaS r/SideProject7 days ago
Free election dashboard stack: laptop scraper + `Cloudflare KV` survived a one-day traffic spike
60radar
Cloudflare KVEdge key-value store — pairs well with CDN-heavy reads
The useful part is the architecture, not the Claude flex: scrape on a laptop, push static snapshots to Cloudflare KV, let the CDN absorb reads. It handled a real spike on free tier limits, so this pattern is worth copying for short-lived live dashboards.
- Data flow stayed minimal: a Python scraper pulled 234 raw HTML result pages, merged them, and published snapshots every 30 seconds with no DB or paid hosting.
- Traffic was non-trivial: 24K visitors, 430K requests, and 8.7 GB bandwidth from 24 countries, which validates the static-distribution approach under bursty demand.
- The sharp edge was write quota, not reads: 997 writes in a day against a 1,000 free-tier cap. This works, but only if update frequency is tightly controlled.
- Feature iteration stayed fast during the event: 60+ commits in one day and new requests shipped within minutes. AI helped with output speed; product judgment still sat with the builder.
Source: www.reddit.com/r/SideProject/comments/1tbg0lq/i_used_claRead original →
60radar
PHOTO
FIG-4021:1
#0401
#0401Infra & SaaS vercel_blog7 days ago
`Vercel Firewall` can generate WAF custom rules from natural language
70radar
Writing edge security rules just got much less manual. If you already ship on Vercel, this cuts setup friction enough to try now.
- The dashboard now turns plain-English intent into WAF rules, reducing the need to hand-write match logic.
- Generated rules can log, block, challenge, rate limit, or redirect traffic based on IP, path, country, user agent, and more.
- Examples are immediately practical: protect /api/webhook, block /wp-admin, or challenge non-US traffic on /checkout.
- Vercel CLI support matters because rule creation can fit existing deploy and ops workflows instead of staying dashboard-only.
Source: vercel.com/changelog/create-vercel-waf-custom-rules-usinRead original →
FIG-4011:1
70radar
FIG-4011:1

Tue, May 125 dispatches

#0400
#0400Infra & SaaS vercel_bloglast week
`AI Gateway` adds fast mode for `Claude Opus 4.7`
80radar
AI GatewayLLM gateway — unified routing across model providers
Latency drops hard without stepping down model quality: output generation is about 2.5x faster. The tradeoff is brutal at 6x standard Opus pricing, so this is for premium paths only.
- Output token generation is roughly 2.5x faster while keeping full Opus 4.7 intelligence; useful when response time is the product constraint.
- Enable it via speed: 'fast' in anthropic provider options with anthropic/claude-opus-4.7, so rollout is a config change, not a model swap.
- Pricing jumps from $5/$25 per 1M input/output tokens to $30/$150. Speed gains are real, but margins get hit immediately.
- Claude Code can use it through AI Gateway with CLAUDE_CODE_SKIP_FAST_MODE_ORG_CHECK, CLAUDE_CODE_ENABLE_OPUS_4_7_FAST_MODE, or ~/.claude/settings.json.
- Prompt caching and other standard multipliers still stack on top, so heavy agent loops can get expensive fast.
Source: vercel.com/changelog/fast-mode-for-opus-4-7-available-onRead original →
FIG-4001:1
80radar
FIG-4001:1
#0399
#0399Infra & SaaS vercel_bloglast week
Manage `Vercel Firewall` Rules from the `CLI`
70radar
Vercel FirewallSecurity feature — controls traffic rules for Vercel apps
Security rollout moves closer to deploy workflows instead of dashboard clicks. Teams using vercel can script rule changes, test safer rollouts, and hand more of this to agents now.
- The vercel firewall command now covers custom rules, IP blocks, system bypasses, attack mode, and system mitigation settings.
- This closes a real ops gap: firewall changes can live in terminal workflows alongside deploys, scripts, and incident response.
- Vercel Firewall also gets an agent-facing skill with guidance for safer rule rollout, which lowers the chance of locking out good traffic.
- Setup friction is low: update the CLI, run vercel firewall, and the feature is immediately reachable from existing Vercel workflows.
Source: vercel.com/changelog/manage-vercel-firewall-in-the-cliRead original →
FIG-3991:1
70radar
FIG-3991:1
#0398
#0398Infra & SaaS vercel_bloglast week
`AI Gateway` production index: spend goes to `Anthropic`, volume to `Google`
50radar
AI GatewayAI gateway — routes many models behind one API
Production traffic splits cleanly by risk tolerance, not by one winner. Route premium reasoning to Claude and bulk cheap calls to Gemini Flash; single-provider bets now look expensive.
- April 2026 spend share was 61% `Anthropic`, 21% `Google`, 12% `OpenAI`. Money is flowing to high-stakes calls, not raw traffic.
- Token volume flipped the ranking: 38% `Google`, 26% `Anthropic`, 13% `OpenAI`, 10% `xAI`. Cheap models are absorbing mass-market workloads.
- Within the same customer base, premium reasoning lands on Claude Opus while low-cost throughput lands on Gemini Flash. Model routing is becoming the default stack design.
- B2B tokens cost roughly 2x B2C per token. If mistakes create legal or operational risk, the savings from cheaper models disappear fast.
- Anthropic held 71% token share in back-office workloads but only 7% in consumer. Google concentrated in consumer with Gemini Flash at 28% of tokens and 15% of cost.
Source: vercel.com/blog/ai-gateway-production-indexRead original →
FIG-3981:1
50radar
FIG-3981:1
#0397
#0397Infra & SaaS GeekNewslast week
`zero-native`: Build desktop and mobile apps with `Zig` and web UI
50radar
zero-nativeApp framework — native shell with system WebView
A tiny native shell can wrap a web frontend into desktop apps without bundling a browser runtime when using the system WebView. That cuts binary size and startup cost, but teams that need pixel-perfect rendering will still trade up to Chromium.
- Using the system WebView avoids shipping a full browser engine, so binaries stay small and launch faster.
- The stack targets macOS, Windows, and Linux from one web UI, which lowers the cost of turning an existing SaaS frontend into an installable app.
- Zig at the shell layer suggests tighter native control than Electron-style wrappers, with less runtime overhead.
- If rendering consistency matters more than footprint, the Chromium path is still on the table; the value depends on whether size or parity is the bigger constraint.
Source: news.hada.io/topic?id=29409Read original →
FIG-3971:1
50radar
FIG-3971:1
#0396
#0396Infra & SaaS vercel_bloglast week
`Vercel Sandbox` adds `Node.js 26.x` support
50radar
Vercel SandboxCloud sandbox runtime — fast isolated code execution
Sandbox runtime options just moved up a generation. Upgrading @vercel/sandbox unlocks Node 26 testing, making version-parity checks easier before shipping.
- Vercel Sandbox now supports Node 26, so newer runtime APIs can be validated without leaving Vercel's execution environment.
- To use it, upgrade @vercel/sandbox to 1.10.2+ or 2.0.0-beta.19+ for v2, then set runtime to node26.
- This is a small but practical update if your app, workers, or tooling need strict Node-version alignment across local and hosted runs.
Source: vercel.com/changelog/node-js-26-x-now-available-on-verceRead original →
FIG-3961:1
50radar
FIG-3961:1

Mon, May 113 dispatches

#0395
#0395Infra & SaaS GeekNewslast week
90-Day Disclosure Is Breaking Under AI-Speed Exploits
50radar
AI has compressed rediscovery and exploit creation enough that fixed 90-day disclosure windows no longer protect slow patching. If your app touches payments, shorten fix cycles and treat frontend patch diffs as attacker documentation.
- A critical payment-validation bug was independently reported by 11 people in 6 weeks, which means dangerous flaws now get rediscovered in parallel, fast.
- A React patch diff was turned into a working exploit in 30 minutes with AI help, so shipping partial client-side fixes buys very little time.
- The old 90-day norm assumed slower analysis and exploit development; that assumption no longer holds for high-value SaaS surfaces like checkout flows.
- Payment logic needs server-side enforcement and rapid rollout paths, because once a patch lands, attackers can reverse the fix almost immediately.
Source: news.hada.io/topic?id=29383Read original →
FIG-3951:1
50radar
FIG-3951:1
#0394
#0394Infra & SaaS vercel_bloglast week
`Vercel Flags` adds scheduled progressive rollouts
80radar
Vercel FlagsFeature flag service — plugs into Vercel release flow
Traffic can now ramp to a new variant by schedule instead of staying at a fixed split. That makes feature releases safer without building your own rollout logic, and it's usable now via dashboard or vercel flags rollout.
- Unlike a fixed 50/50 experiment split, each rollout stage has a target percentage plus duration, so exposure increases automatically.
- Catching regressions on a small slice first lowers blast radius before a bad release reaches everyone.
- Control is available in both the dashboard and the new vercel flags rollout CLI path, which matters for scripted releases.
Source: vercel.com/changelog/progressive-rollouts-in-vercel-flagRead original →
FIG-3941:1
80radar
FIG-3941:1
#0393
#0393Infra & SaaS vercel_bloglast week
`Vercel Sandbox firewall` adds proxy forwarding and request filtering in beta
50radar
Vercel SandboxSandbox runtime — isolated execution with network controls
Outbound sandbox calls can now pass through your own proxy with path, method, query, and header matching. Useful for logging and credential control, but immediate reach is limited because it's beta on Pro and Enterprise.
- You can set a forwardURL on an allowed domain, and matching HTTPS requests are relayed to your own proxy for logging, debugging, or response transforms.
- Matchers can scope forwarding and credential brokering by path, method, query string, or headers, so only sensitive routes need extra handling.
- The proxy receives source metadata headers plus a vercel-sandbox-oidc-token, enabling request authentication and sandbox/team/project attribution.
- Access is limited to Pro and Enterprise beta and requires the @vercel/sandbox@beta SDK, so this is practical only if you already depend on Sandbox.
Source: vercel.com/changelog/vercel-sandbox-firewall-now-supportRead original →
FIG-3931:1
50radar
FIG-3931:1

Sun, May 102 dispatches

#0392
#0392Infra & SaaS GeekNewslast week
`AWS` Virginia Outage Resolved After `US-East-1` Overheating Incident
40radar
US-East-1AWS region — its primary Northern Virginia region
A cooling-related failure in `US-East-1` hit major customer-facing services, not just internal AWS dashboards. If anything still depends on a single region, this is another reminder that multi-region failover is cheaper than surprise downtime.
- The trigger was data center overheating in US-East-1, turning a routine status alert into a real regional availability event.
- Named impact reached services like Coinbase and FanDuel, which shows the blast radius reached end-user transactions, not background jobs only.
- AWS marked recovery at 3:29 PM ET Friday. Even a resolved incident matters if your stack, auth, or webhooks are pinned to one region.
Source: news.hada.io/topic?id=29337Read original →
FIG-3921:1
40radar
FIG-3921:1
#0391
#0391Infra & SaaS GitHub Trending Weeklylast week
`InsForge`, open-source backend stack built for coding agents
60radar
InsForgeBackend stack — all-in-one backend layer for agents
Puts auth, Postgres, storage, functions, hosting, and an OpenAI-compatible gateway behind one agent-friendly control layer. Worth tracking if you want a self-hostable alternative to stitching together Supabase + Vercel + AI proxy logic.
- Agents can operate it through an MCP Server or CLI + Skills, so backend setup and debugging become callable tools instead of manual dashboard work.
- The product surface is broad: Authentication, Database, Storage, Model Gateway, Edge Functions, site deployment, plus private preview compute.
- The Model Gateway exposes an OpenAI-compatible API across multiple providers, which lowers switching cost for LLM-backed apps.
- Self-hosting starts with Docker Compose and Node.js, making local end-to-end backend testing possible before committing to a hosted stack.
Source: github.com/InsForge/InsForgeRead original →
FIG-3911:1
60radar
FIG-3911:1

Fri, May 84 dispatches

#0390
#0390Infra & SaaS Supabase Blog2 weeks ago
`Supabase` becomes an official `ChatGPT` app
50radar
You can now operate Supabase projects through natural-language requests inside ChatGPT. It trims routine DB ops into chat and is worth testing now if Supabase already sits in your stack.
- The integration connects existing Supabase projects to ChatGPT, not a separate dashboard flow.
- The stated use case is managing database infrastructure by chat, which points to faster admin and maintenance loops.
- This is most useful when you already keep product, schema, and ops context in ChatGPT; otherwise the gain is smaller.
Source: supabase.com/blog/supabase-is-now-an-official-chatgpt-apRead original →
FIG-3901:1
50radar
FIG-3901:1
#0389
#0389Infra & SaaS vercel_blog2 weeks ago
`Vercel` `Chat SDK` adds `Messenger` adapter
60radar
Chat SDKChat app SDK — adapter-based support for messaging channels
Meta channel support just got easier: one adapter now covers messages, reactions, media downloads, postbacks, and DMs. Useful if you want to ship customer-facing agents on Messenger without building the transport layer yourself.
- The adapter supports core Messenger flows: messages, reactions, multimedia downloads, postback buttons, and direct conversations.
- Display names are fetched automatically from user profiles, removing one small but annoying identity-mapping step.
- Vercel points to three paths: use the docs, browse supported adapters, or build a custom adapter if your channel is missing.
- This came from community work in PR #461, which suggests the adapter surface is extensible rather than locked to first-party channels.
Source: vercel.com/changelog/chat-sdk-adds-messenger-adapterRead original →
FIG-3891:1
60radar
FIG-3891:1
#0388
#0388Infra & SaaS vercel_blog2 weeks ago
`Chat SDK` adds cross-platform conversation history
70radar
Chat SDKBot-building SDK — shared conversation state across channels
Message history can now persist across channels with transcripts and identity, instead of rebuilding memory per surface. If you run support or assistant bots on web and app together, this removes a common state-sync chore and is worth adopting now.
- transcripts and identity let one user keep the same history across every platform adapter, so web, app, and other bot surfaces stop fragmenting context.
- bot.transcripts exposes 4 methods: append, list, count, and delete. The API covers write, read, usage tracking, and reset without extra glue code.
- The feature sits on top of your existing state adapter, so you do not need a separate transcript store design if you already use the SDK's persistence layer.
- list returns entries chronologically with filters, which makes replay, debugging, and lightweight conversation analytics easier to ship.
- This mainly cuts backend plumbing rather than unlocking a new UX category, but that plumbing is exactly what slows small teams down.
Source: vercel.com/changelog/chat-sdk-conversation-historyRead original →
FIG-3881:1
70radar
FIG-3881:1
#0387
#0387Infra & SaaS vercel_blog2 weeks ago
`Chat SDK` adds a web adapter for browser chat UIs
60radar
Chat SDKChat UI SDK — connects server bots to browsers
Browser chat can now connect directly with a server-defined bot and stream replies live through useChat. This cuts setup for in-product support or assistant UIs and is practical if you already ship on Vercel's AI stack.
- The new web adapter connects browser-based chat UIs to a bot defined on your server, reducing glue code between frontend and backend.
- Replies stream live to the browser through the preconfigured @ai-sdk/react useChat hook, so a basic chat surface is faster to stand up.
- The target use cases are clear: in-product assistants, support agents, and other embedded browser chat experiences.
- Vercel also points to adapter docs and custom adapter guidance, so the release is not just a demo path but an integration surface.
Source: vercel.com/changelog/chat-sdk-adds-web-adapter-supportRead original →
FIG-3871:1
60radar
FIG-3871:1

Thu, May 72 dispatches

#0386
#0386Infra & SaaS vercel_blog2 weeks ago
`Next.js` security release patches 13 flaws; upgrade to `15.5.18` or `16.2.6`
90radar
This fixes 13 issues across auth bypass, DoS, SSRF, cache poisoning, and XSS, with no reliable WAF fallback. If you run middleware.js, Server Functions, Image Optimization, or RSC caching, this is an immediate patch cycle.
- Authorization paths are exposed in multiple ways: middleware.js/proxy.js apps are affected by segment-prefetch, i18n default-locale, and dynamic route injection bypasses.
- Runtime risk is broad, not edge-case: DoS hits React Server Components, Cache Components, and the Image Optimization API, so default framework features are in scope.
- WebSocket upgrade handling has an SSRF advisory. Any app bridging internal services through upgrade requests should treat this as perimeter-breaking.
- Caching setups need scrutiny twice: one advisory targets RSC response poisoning, another targets collisions in RSC cache-busting. CDN or reverse-proxy stacks are not neutral here.
- Fixed targets are explicit: upgrade Next.js 15.x to 15.5.18, 16.x to 16.2.6, and matching react-server-dom-* packages to 19.0.6 / 19.1.7 / 19.2.6.
Source: vercel.com/changelog/next-js-may-2026-security-releaseRead original →
FIG-3861:1
90radar
FIG-3861:1
#0385
#0385Infra & SaaS vercel_blog2 weeks ago
`Vercel Flags` now supports JSON values
70radar
Vercel FlagsFeature flag service — built to fit `Vercel` deployments
Related config can now live in one flag instead of being split across several. That makes model rollouts, A/B tests, and provider failover less brittle, so it is worth using if Vercel Flags is already in the stack.
- A single JSON flag can replace separate boolean, string, and number flags tied to the same feature config.
- The example is model experimentation: one ai_model object can hold settings that previously needed ai_model, ai_temperature, and ai_max_tokens.
- This fits progressive traffic routing to a new model, controlled A/B tests, and fast provider switching during outages.
Source: vercel.com/changelog/vercel-flags-now-supports-json-valuRead original →
FIG-3851:1
70radar
FIG-3851:1

Wed, May 62 dispatches

#0384
#0384Infra & SaaS Supabase Blog2 weeks ago
`@supabase/server` bundles server auth, `RLS` scope, and `CORS`
50radar
Server auth, RLS-scoped clients, and CORS are packaged together. Clear boilerplate reduction if most of your data access lives on the server.
- Stateless auth is built in, which lowers session-handling glue in server-heavy flows.
- RLS-scoped clients on the server keep permission boundaries closer to the query path.
- CORS handling ships with the package, so custom middleware and repeated setup shrink.
Source: supabase.com/blog/introducing-supabase-serverRead original →
FIG-3841:1
50radar
FIG-3841:1
#0383
#0383Infra & SaaS vercel_blog2 weeks ago
`Vercel` adds production-only access for Marketplace credentials
50radar
Marketplace credentials can now be locked to Production, cutting off dashboard and CLI reads outside prod. Useful guardrail if preview or dev projects should never touch live secrets.
- Turning on Allowed Environments -> Production only removes non-production access and protects secret values from dashboard and CLI reads.
- After the switch, existing Development and Preview connections are removed, and any connection without a Production target is disconnected.
- New non-production connections are blocked going forward, so accidental secret exposure from test projects gets shut down at the platform layer.
- Rolling this back needs Owner permissions, may trigger MFA, and Vercel recommends rotating the integration secrets after enabling it.
Source: vercel.com/changelog/secure-marketplace-credentials-withRead original →
FIG-3831:1
50radar
FIG-3831:1

`RevenueCat` Adds Flexible Discounts for Web Billing

`Stripe Link CLI` Lets AI Agents Pay on a User's Behalf

`AI Gateway` adds request-time provider ranking controls

`Vercel CLI` adds native `curl` syntax

`datasette-ip-rate-limit` `0.1a0`, path-level IP throttling for crawler abuse

`Vercel` adds `Protected Source Maps` for production-only debugging

AI Gateways Turn Model Choice Into Infrastructure

`Ardent` launches Postgres sandboxes for coding agents without DB migration

`Vercel` adds `Trusted Sources` to Deployment Protection

Built a Live Election Dashboard in 2 Days With `Claude` and Cloudflare’s Free Tier

Free election dashboard stack: laptop scraper + `Cloudflare KV` survived a one-day traffic spike

`Vercel Firewall` can generate WAF custom rules from natural language

`AI Gateway` adds fast mode for `Claude Opus 4.7`

Manage `Vercel Firewall` Rules from the `CLI`

`AI Gateway` production index: spend goes to `Anthropic`, volume to `Google`

`zero-native`: Build desktop and mobile apps with `Zig` and web UI

`Vercel Sandbox` adds `Node.js 26.x` support

90-Day Disclosure Is Breaking Under AI-Speed Exploits

`Vercel Flags` adds scheduled progressive rollouts

`Vercel Sandbox firewall` adds proxy forwarding and request filtering in beta

`AWS` Virginia Outage Resolved After `US-East-1` Overheating Incident

`InsForge`, open-source backend stack built for coding agents

`Supabase` becomes an official `ChatGPT` app

`Vercel` `Chat SDK` adds `Messenger` adapter

`Chat SDK` adds cross-platform conversation history

`Chat SDK` adds a web adapter for browser chat UIs

`Next.js` security release patches 13 flaws; upgrade to `15.5.18` or `16.2.6`

`Vercel Flags` now supports JSON values

`@supabase/server` bundles server auth, `RLS` scope, and `CORS`

`Vercel` adds production-only access for Marketplace credentials