
the craziest part of the Brotli bug isn't the bug. the fix was sitting in Brotli's code since February. nobody realised it was a security hole, so no new version shipped. for 8 months, every app built on the last official release still had it. Node.js, Bun, proxies like Envoy. it took, AI-assisted security testing to connect the dots.
