#trust

The cdnjs migration post earns its proof not from self-reported throughput but from two public platform ceilings the migration forced Cloudflare to raise for every customer — a receipt any reader can check in the live limits docs.

A vendor benchmark that prints its own false-positive breakdown — 1.12% alert rate, 48% of alerts from one noisy rule, a middling F1 it admits to — on a public dataset anyone can rerun, making the headline finding believable instead of dismissible.

Cloudflare moved cdnjs — 9 billion requests a day — onto its own Developer Platform; the copyable part isn't the migration, it's the two public limits the exercise forced it to raise for every customer.

HeimWall's secret-scan post ran on a public dataset anyone can rerun, showed which rule produced half its alerts, and printed its own mediocre benchmark scores — a copyable template for content that survives a developer's fact-check.

Cloudflare published how it rebuilt cdnjs — 108,000 requests per second, 9 billion a day, a 98.6% cache hit rate — entirely on its own R2, Workers, Workflows, Queues and Durable Objects stack, replacing a fragmented GCP-Functions-and-VMs setup. The migration completed on 2026-06-23 and raised a public platform ceiling on the way: subrequests now go up to 10M on paid plans.

GitHub shipped npm publish-time malware scanning, extended Dependabot malicious-package alerts across more ecosystems via the OpenSSF malicious-packages feed, and started holding Actions workflows it flags as potentially malicious for manual approval. It landed one day after a researcher post documenting thousands of discoverable malware repos — deleted post-hoc, with no lasting filter — reached the Hacker News front page.