Ideas for building
better software.

Chat SDK now supports XChat

You can now build bots that hold end-to-end encrypted 1:1 and group conversations on XChat with the new for Chat SDK.XChat adapter The adapter handles all encryption, key management, and signature verification automatically. Bots can also message users first, as long as the user has encrypted chat set up and follows the bot. XChat has no markdown rendering, so the adapter falls back automatically: URLs and @mentions render as tappable links, tables as ASCII code blocks, and cards as text with a

This Week in Spring - August 25th, 2026

AI Search - Store larger custom metadata values in AI Search

AI Search supports larger custom metadata values within a shared 10 KiB metadata envelope for each vector. The envelope includes AI Search system metadata and JSON overhead, so it is not a per-field limit. The first 64 UTF-8 bytes of each indexed string remain filterable. For details, refer to Metadata attributes.

Durable Objects - Prevent Durable Object alarm retries when using `ctx.abort()`

By default, an alarm interrupted by ctx.abort() retries after the Durable Object resets. Pass { retryAlarm: false } when the alarm should stop instead: src/index.jsjs import { DurableObject } from "cloudflare:workers"; export class CleanupTask extends DurableObject { async alarm() { await this.ctx.storage.deleteAll(); this.ctx.abort("Cleanup complete", { retryAlarm: false }); } } src/index.tsts import { DurableObject } from "cloudflare:workers"; export class CleanupTask extends Dura

WAF - WAF Release - 2026-08-25

This release moves four new detections from Log to Block, merges the XSS, HTML Injection - Script Tag - Beta rule into the original rule, and adds a Generic Rules - Remote Code Execution rule in Block mode. Key Findings Four new detections move from Log to Block: HTTP/2 Request Smuggling - Request Body Anomaly and XSS - JavaScript Event Handler Coercion across Headers, Body, and URI. The XSS, HTML Injection - Script Tag - Beta rule is merged into the original rule. A Generic Rules - Remote Code

API Shield - Symmetric key support for JWT validation

API Shield JSON Web Token validation now supports symmetric keys that use the HS256, HS384, and HS512 algorithms. You can configure HMAC verification keys in the Cloudflare dashboard or with the Cloudflare API. Cloudflare never stores symmetric credentials in plaintext. API responses do not include the credential. Refer to Configure JWT validation via the API for supported key formats and credential requirements.

Why Are Your AI Automations Still Running on Your Laptop?

You wouldn’t run your SaaS off your laptop. So why are we doing it with AI? A lot of the AI automation I see right now still depends on a person sitting in the middle moving information around. Production throws an error. Someone checks AWS logs, drops them into Claude, figures out what happened and creates a Jira ticket. Another dev picks up the ticket and has an agent make the change. Someone reviews it. QA tests it. Maybe DevOps has Codex check the deployment logs over MCP. Information comes

DaDaScribe API: YouTube Multi-Language Transcript + SRT in One Request

Most transcription APIs still force you to do this: Download the YouTube video Extract the audio with yt-dlp + ffmpeg Upload the file Call the transcription endpoint Call a separate translation API Map generic speaker labels ("Speaker 0") to real names Generate SRT files yourself That’s a lot of moving parts for something that should be simple. The DaDaScribe API collapses most of that into a single request. You send a YouTube URL (or a direct audio/video link), specify the source language, opti