AI Weekly Malaysia

Beacon, a CRM provider serving 1,500+ charities, says an AWS access key likely exposed in public JavaScript build artifacts is the leading suspect in a July 27 breach. The attacker copied the entire customer database—including attachments—and probably downloaded it in readable form within 1 hour 27 minutes, despite data being encrypted at rest, because the compromised key allowed decryption. Beacon's logs cannot identify which specific records were exfiltrated.

Why: If you ship JavaScript bundles to browsers, scan your build artifacts for embedded cloud credentials before deployment—this incident shows that encryption at rest is meaningless when the access key that can decrypt it is sitting in a public JS file. Founders running SaaS on AWS should verify that IAM keys are never bundled into frontend assets and that CI/CD pipelines include secret-detection steps.

Chrome uses a JPEG decoding optimization where it avoids fully decompressing large JPEGs when rendering them at small sizes, instead leveraging the DCT frequency-domain data directly. This causes tiny JPEGs to look noticeably different in Chrome versus Firefox—often thicker or less faithful to the original—because high-frequency detail is handled differently during downscaling.

Why: If you ship small JPEG icons or logos (e.g., 15-20px), don't assume they render identically across browsers; Chrome's partial-decode optimization can alter appearance at small sizes. Switching to SVG for small icons avoids this entirely, as the author did.