Cloudflare silently injects analytics beacon; developer's CSP blocks it at the edge

·1 views

A developer discovered that Cloudflare's Web Analytics feature automatically injects a tracking beacon script into HTML responses at the edge, without modifying the origin source files or build output. The script, beacon.min.js, is added by default when a site is connected to Cloudflare, and does not appear in any local templates, dependencies, or compiled files. The site's Content Security Policy blocked the script before it could execute, returning a status of -1 with zero bytes transferred. Rather than whitelisting the Cloudflare analytics host — which would have contradicted the site's stated privacy policy of running no analytics — the developer disabled Web Analytics directly from the Cloudflare dashboard. The developer also flagged an unresolved issue: Cloudflare's Network Error Logging headers still reference an external reporting endpoint, meaning some data may leave the browser even without the beacon script running.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

All-in-One WP Migration plugin flaw puts 5 million WordPress sites at risk

A critical second-order SQL injection vulnerability, tracked as CVE-2026-19949, has been discovered in the All-in-One WP Migration and Backup plugin version 7.109 and earlier, affecting over 5 million WordPress installations. Attackers can inject malicious payloads through public input vectors like trackbacks, which remain dormant in the database until an administrator triggers a backup restore or import operation. Once activated, the exploit can expose the site's secret key, enabling unauthenticated attackers to upload a malicious archive and achieve remote code execution. Developer ServMask released version 7.110 on August 20, 2026, to patch the flaw, but only around 35% of active installations had updated at the time of reporting. No large-scale active exploitation has been confirmed yet, and administrators are urged to update immediately, rotate secret keys, and audit past restore activity and database changes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How engineer promotions really work at Google, Meta, Amazon and Microsoft

Engineers at major tech companies often stall in promotions not due to lack of skill but because the promotion process itself is poorly understood. Each company uses a distinct system: Google relies on a formal committee that reviews written packets and peer feedback, while Meta evaluates candidates twice a year through a performance cycle where consistent visible output every six months is critical. Amazon requires a written narrative tied to its Leadership Principles, reviewed by external bar raisers who can block promotions if results appear too recent or unproven. Every major tech company also has a 'terminal level' — such as Google's L5 or Meta's E5 — where career progression becomes optional and the nature of the role fundamentally shifts from individual execution to broader organizational impact. Understanding which process applies to your company and optimizing accordingly can be the difference between advancing and cycling through the same feedback for years.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How git reflog can recover commits after an accidental git reset --hard

A developer accidentally ran 'git reset --hard HEAD~3' in the wrong repository window, instantly wiping three commits from the working tree. Because Git does not immediately delete unreferenced commit objects, the work was recoverable using 'git reflog', which logs every position HEAD has pointed to and survives a reset. By identifying the correct commit hash in the reflog and running another 'git reset --hard' to that hash, all three commits were fully restored within seconds. The reflog only tracks committed work, however, meaning genuinely uncommitted changes lost to a hard reset have no recovery path. The developer now rehearses destructive Git operations on a disposable repository clone before running them on any codebase they care about.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Nine categories EM interviewers score you on — and how to prepare for all of them

Engineering manager interviews are scored across nine distinct categories, ranging from performance management and conflict resolution to technical judgment and vision, meaning strong preparation in only a few areas is rarely enough. Unlike individual contributor loops that test depth in a narrow technical domain, EM loops sample broadly, and gaps in even two categories can cost a candidate the offer. Most behavioural questions ultimately probe four things: whether the candidate ran a structured process, can name a specific tradeoff, owns outcomes without deflecting, and is clearly identifiable as the decision-maker within their own story. A practical preparation method involves writing down eight to twelve real situations from the past two years, mapping each to the nine categories, and identifying which cells remain empty — those gaps represent the questions most likely to catch a candidate off guard. Each story should then be rehearsed aloud, not memorised, targeting roughly ninety seconds and always ending with a candid reflection on what the candidate would do differently.

0 comments Read more at DEV Community