Translation

Policy Pulse – Issue #21 – Week of June 27, 2026

Policy Pulse Issue #21 covers the week of June 27, 2026, summarizing key policy developments, regulatory updates, and legislative activities relevant to cybersecurity and vulnerability disclosure.

Background

- Disclose.io is a cross-industry initiative (backed by Google, Microsoft, HackerOne, Bugcrowd) that standardizes "safe harbor" policies, protecting good-faith security researchers from lawsuits. - "Policy Pulse" is its regular newsletter tracking how organizations adopt vulnerability disclosure policies. Issue #21 covers late June 2026. - In 2024–2025, U.S. and EU cybersecurity laws began explicitly referencing safe-harbor protections for researchers; disclose.io is the de facto standard for implementing them. - The newsletter scores organizations (green/yellow/red) on whether they have a clear disclosure policy, a reporting channel, and a pledge not to sue researchers. - Readers follow this to gauge real-world policy adoption, spot companies that still threaten researchers, and track regulatory shifts.

RT Sean Bowe: Zcash's new formal verification efforts eliminate undetectable counterfeiting bugs from the new Ironwood pool.
6.0
Zcash's formal verification efforts have eliminated undetectable counterfeiting bugs from the new Ironwood pool, ruling out such vulnerabilities up to the underlying cryptographic assumptions, as part of Project Tachyon.
RT Dev 🧪: Zcash testnet is updating for Ironwood tomorrow! We have two independently developed consensus implementations of it. One by @valargroup,...
3.5
Zcash testnet is updating for Ironwood with two independently developed consensus implementations, one by Valar Group (in audit) and another by the Zcash Foundation. Users can try a desktop wallet fork with migration code, and Keystone dev device users can update firmware to test signing 11+ transactions with a single QR code.
The other kind of control flow guard check: The combined validate and call
0.5
Raymond Chen explains a specific type of Control Flow Guard (CFG) check that combines validation and function calling into a single operation, describing how this "combined validate and call" approach works as a two-in-one package within Windows security mechanisms.
June 2026 newsletter
0.5
Simon Willison's June 2026 sponsors-only newsletter is now available, covering topics such as Claude Fable 5, GPT-5.6, US export restrictions, GLM-5.2, Datasette Apps, and various model releases. The newsletter is accessible to GitHub sponsors, with a $10/month sponsorship option to stay a month ahead of the free copy.

Policy Pulse – Issue #21 – Week of June 27, 2026

Background

Related stories

RT Sean Bowe: Zcash's new formal verification efforts eliminate undetectable counterfeiting bugs from the new Ironwood pool.

RT Dev 🧪: Zcash testnet is updating for Ironwood tomorrow! We have two independently developed consensus implementations of it. One by @valargroup,...

The other kind of control flow guard check: The combined validate and call

June 2026 newsletter