Our $1 million hacker challenge for React2Shell

What this post added

This post details the implementation of a defense-in-depth strategy to protect against React Server Components vulnerabilities, specifically React2Shell. It describes the development of a compute-layer runtime mitigation that prevents code execution by denying access to the `constructor` property during React rendering. This mitigation was validated at scale and shared with other platform providers. The post also elaborates on specific bypass techniques discovered through a bug bounty program, such as recursive UTF-encoding and exploiting JavaScript's ReadableStream class, and how these were addressed by hardening the Seawall WAF with recursive decoding and improved pattern matching.