Security Software Engineer

Menlo's investment in Fireworks: the runtime for specialized intelligence. July 16, 2026 AI inference is quickly becoming one of the largest markets in the world, and Fireworks is leading the expansion with its platform for specialized intelligence and low-cost token production. Today, Menlo is proud to be partnering with Fireworks in its $1.5 billion Series D. As the leading AI labs push the capability frontier forward, they are opening another massive market in parallel: a separate frontier for specialized intelligence, where speed, cost, and control matter as much as raw capability. This second front came into sharp focus in 2026, when models gained the ability to sustain long-running tasks without constant human attention. That shift unlocked entirely new classes of economically valuable work - and pushed one of computing's fastest-growing markets onto an even steeper trajectory. Inference demand didn't just grow; it broadened. Open-source usage on OpenRouter has expanded more than 10x since the start of the year. And while frontier models remain essential, the workloads they unlocked also created demand for a much wider range of inference shapes - models that are faster, more economical, or fine-tuned to a company's own data, workflows, and performance requirements. Fireworks is building the runtime for this world, where custom and open-source models increasingly work alongside frontier models in production. The platform's growth reflects the scale of this emerging production layer: Daily token volume has nearly tripled since late last year, from 15 trillion to 43 trillion, while annualized revenue recently reached $1 billion. The leading platform for open models. Fireworks begins before the first production token is served. The platform brings continued pretraining, supervised fine-tuning, and reinforcement learning onto the same stack as inference. Teams can start with an open model, adapt it to their proprietary data and product feedback, deploy it immediately, and continue improving it from real-world usage. Training and serving become one continuous loop. Once a model reaches production, inference is more than just weights in a box. Running a model in production requires specialized engineering across hundreds of thousands of possible combinations of hardware, quantization, sharding, speculative decoding, batching, and kernels. The right configuration changes with the workload - and with each customer's priorities across price, latency, and quality. Fireworks' proprietary FireAttention stack automates that search, extracting more performance and better economics than any other provider. The result is a single system for turning proprietary data into custom weights, and custom weights into production intelligence with the most efficient token delivery. Many of the AI applications with the largest, most sophisticated needs in the world choose Fireworks: Cursor trained Composer 2, its frontier-level coding model, on the platform. Vercel delivered 40x improvements in latency to v0 users by partnering with Fireworks on reinforcement fine-tuning and speculative decoding. And Factory is using Fireworks to give customers up to 15x more work for the same spend with open-source options. A world-class infrastructure team. Few teams are better suited to build this layer. CEO Lin Qiao previously led PyTorch at Meta, overseeing the development and productionization of the open-source framework that became foundational to modern AI. CTO Dmytro Dzhulgakov was one of PyTorch's core maintainers and a senior leader within Meta's AI organization. The rest of Fireworks' seven-person founding team is similarly formidable: former leaders of Meta's ads infrastructure, News Feed machine learning, PyTorch ranking systems and compiler development, alongside the former AI lead of Google Vertex. Collectively, they helped build the infrastructure supporting some of the world's largest AI systems, from the kernel layer up. More recently, Fireworks added to its leadership president George Hu, who previously helped scale Salesforce 50x to $5 billion, before leading Twilio's 10x growth journey. His arrival gives Fireworks the operating muscle to match the size of its ambitions. Building in the token path. The AI infrastructure stack is reorganizing around the token path: the compute, data, and orchestration that turn intelligence into a product. At Menlo, we believe AI's most enduring infrastructure companies will be built along this value chain. Our portfolio reflects that conviction: from Anthropic at the capability frontier, to OpenRouter in routing, Gimlet and Modal in compute, Neon and Pinecone in databases, and Unstructured in data infrastructure - with more to be announced soon, as we are actively partnering with founders building the defining building blocks of the emerging AI stack. Fireworks sits at the center of our thesis. We could not be more excited to partner with Lin, Dmytro, George, and the entire Fireworks team as they expand and accelerate this market for the next generation of AI applications and developers.

Unpacking Next.js 16: Solving modern web development bottlenecks. July 16, 2026 Next.js 16 is here, bringing performance-first updates, AI-integrated workflows, and streamlined server-side execution. Discover how these features solve real-world architectural headaches. Next.js new features: A comprehensive guide to the Version 16 evolution. In the rapidly evolving landscape of modern web development, the release of Next.js 16 marks a significant leap forward in framework architecture. By prioritizing developer experience (DX), runtime efficiency, and intelligent streaming, Vercel has introduced a suite of Next.js new features designed to handle the demands of enterprise-grade applications. Understanding these updates is essential for developers aiming to optimize performance metrics and maintain a competitive edge in today's high-traffic web environments. 1. Enhanced Server Actions and granular revalidation. Next.js new features in version 16 introduce refined Server Actions, allowing developers to execute server-side logic directly from client components with enhanced precision. These updates enable developers to perform surgical cache invalidation using revalidateTag and revalidatePath, ensuring data freshness without the overhead of full-page reloads. Server Actions serve as the primary method for handling form submissions and data mutations in Next.js 16, allowing for a seamless transition between the client and server. By utilizing granular revalidation, developers can instruct the framework to update only specific segments of the cache, significantly reducing server load and improving application responsiveness. * Solving the Waterfall Problem: Previous iterations often suffered from unnecessary re-renders during complex form submissions, which contributed to increased latency. * Granular Cache Control: Version 16 allows for targeted cache purging. You can now update specific data segments while maintaining the static integrity of the surrounding page layout. // Example of optimized Server Action usage in Next.js 16 'use server'; import {revalidateTag} from 'next/cache'; export async function updateUserData(data) {// Perform database mutation await db.user.update({ where: { id: data.id}, data}); // Targeted revalidation triggers only the specific cache tag // This minimizes unnecessary server-side processing revalidateTag('user-profile');} 2. Partial Prerendering (PPR): Solving the static-dynamic conflict. Partial Prerendering (PPR) is a breakthrough architectural feature in Next.js 16 that enables the delivery of an instant static shell while streaming dynamic content into placeholders. This hybrid approach utilizes Static Site Generation (SSG) for the base layout, while injecting personalized data - such as user dashboards or real-time feeds - via asynchronous streaming chunks. According to performance benchmarks documented by Vercel, implementing PPR effectively optimizes Largest Contentful Paint (LCP) metrics, a primary signal for search engine rankings. By decoupling the static shell from dynamic logic, developers achieve the speed of a static site with the interactivity of a complex dynamic application. How PPR improves web performance: * Instant Loading: The static shell is served immediately, satisfying the initial request requirements for search engine crawlers. * Efficient Streaming: Dynamic components are wrapped in React Suspense boundaries, which allow the server to stream data chunks as they become available. * Reduced Time to Interactive (TTI): By offloading non-critical dynamic parts to the background, the main thread remains free to handle user interactions. 3. Production-Ready Turbopack integration. Historically, large-scale React applications have struggled with slow cold starts and lengthy build times. Next.js 16 brings Turbopack - an incremental build engine written in Rust - to full production stability, effectively replacing traditional Webpack configurations. Turbopack acts as an optimized replacement for Webpack, leveraging high-performance Rust to accelerate the bundling process. Studies on build performance suggest that switching to optimized build engines can reduce development feedback loops by up to 80% in large-scale repositories [1]. Key advantages of adopting the Turbopack engine include: * Drastically Reduced Build Latency: Local server startup times are up to 10x faster compared to legacy Webpack-based workflows. * Incremental Compilation: Turbopack intelligently compiles only the affected modules during the development cycle, ensuring consistent performance even as the codebase grows significantly in complexity. 4. AI-First infrastructure and streaming APIs. The rise of Generative AI has necessitated a standard for managing LLM (Large Language Model) streaming tokens. Next.js new features include updated streaming APIs specifically engineered to mitigate timeout issues often associated with long-running serverless functions. By providing native support for non-blocking asynchronous chunks, Next.js 16 empowers developers to build responsive AI interfaces that stream content to the user in real-time. This reduces the "Time to First Token" and allows applications to match the high-performance expectations set by modern chat-based interfaces. When building AI apps, these APIs ensure that the server-to-client communication remains stable even during high-latency LLM responses. 5. Advanced metadata management for SEO. Search Engine Optimization (SEO) in Next.js 16 is enhanced through a more predictable, asynchronous metadata API. This release effectively addresses the "metadata flicker" issue, where tags would intermittently fail to update during rapid client-side transitions, ensuring that search engine crawlers receive accurate, pre-rendered tags during every indexing event. Best practices for implementing metadata: * Dynamic Metadata: Leverage the generateMetadata function to fetch SEO-relevant data directly from headless CMS platforms or database backends. * Strategic Layout Propagation: Define foundational metadata in root layouts and selectively override or extend them in child page files to maintain a consistent branding and SEO hierarchy across the application. * Consistency: By ensuring metadata is statically generated where possible, you guarantee that social media scrapers and search bots receive the correct OpenGraph images and meta descriptions every time. Summary: strategic advantages of upgrading. Upgrading to Next.js 16 is a strategic imperative for organizations focused on technical scalability and reducing long-term maintenance debt. By leveraging Partial Prerendering, migrating to Turbopack, and utilizing the new streaming APIs, developers can significantly lower infrastructure overhead while drastically improving end-user experience metrics. For a comprehensive look at migration paths and breaking changes, consult the official Next.js documentation. Embracing these new features ensures your architecture remains resilient, high-performing, and prepared for the next generation of web development standards. [1] Source: Benchmarking performance metrics for modern JavaScript bundlers in large-scale enterprise web applications (Industry Report).

Next.js security release and its Next patch release. Vercel, Inc. invest in security at every stage of the Next.js lifecycle, from static analysis and scanning as code is authored, through auditable package publication, to close collaboration with researchers who responsibly disclose vulnerabilities. The React2Shell exploit disclosed last December is an example of that process working as intended, and Vercel, Inc. has continued to mature its security program since then. As part of that process, today Vercel, Inc. is formalizing a security release program for Next.js. The volume of vulnerability research across the industry is rising fast, driven by LLM-assisted discovery: Mozilla recently disclosed 271 issues in a single Firefox release, all surfaced by Anthropic's Mythos Preview. Vercel, Inc. run the same class of tooling against Next.js ourselves, through deepsec, its own researchers, and an expanded bug bounty scope, so more issues reach Vercel, Inc. before they are discovered by attackers. A predictable release schedule. Historically, the team has published ad-hoc patches for security fixes. These were infrequent, but came with no advance notice and caused disruption for its users. Today Vercel, Inc. is moving to a formal security release program, with updates that teams can plan around. This kind of scheduled, pre-announced security release has become standard practice for major open source projects, and Vercel, Inc. think it's the right model for Next.js at its current scale. What to expect. Here's what you can expect going forward: roughly once a month, Vercel, Inc.'ll publish advance notice of upcoming security releases here on the Next.js blog. Each announcement will include the expected release timeline and the highest anticipated severity among the vulnerabilities it covers. This lead time lets you plan your upgrades, and it lets Vercel, Inc. coordinate with hosting providers and other platform partners to deploy mitigations, such as firewall rules, that help protect applications that haven't been patched yet. For urgent disclosures that cannot wait, or vulnerabilities that are already being exploited in the wild, Vercel, Inc. will still publish ad-hoc patches. Vercel, Inc. remain committed to securing your code as quickly as possible. Information on those ad-hoc releases will be also be shared on this blog, as Vercel, Inc. did for React2Shell and other vulnerabilities Vercel, Inc. uncovered in the follow-up investigation. Upcoming July release. Its first scheduled security release will target a publication on July 20, 2026. It will include patch releases for Next.js 16.2 and 15.5, addressing multiple security issues. It includes fixes for 4 high and 5 medium severity vulnerabilities. Vercel, Inc. will publish a blog post containing the specifics of the update, including details of any CVEs, once the patch is available. Its security program. Vercel, Inc. work with a talented set of researchers to secure Next.js and other open source frameworks through Vercel's Open Source Bug Bounty. Anyone interested in contributing to the security of eligible frameworks is encouraged to participate there. Any questions or concerns regarding its security programs or vulnerability management can be sent to [email protected].