What the plumbing around a tool really decides

What we're tracking

• •A vendor that asks how the purchase went Most software relationships go quiet the moment money changes hands. SaaStr describes the opposite. Of more than thirty APIs it bought in a year, one asked how the integration actually went, and asked in a way that produced something useful: "Four sentences, from a real PM, timed off actual usage." [3] The phrase that matters there is timed off actual usage. The question arrived when the buyer had done enough to have a real opinion, not on day one when there was nothing to say.
• •Security that travels with the package, not the registry GitHub announced that its malware advisories now reach beyond a single package registry: "GitHub malware advisories no longer stop at npm." [2] The company wired an open dataset of known-malicious packages into its advisory database, widening the set of ecosystems its warnings cover.
• •Learning to drive the tool, not just talk to it GitHub also published a guide to slash commands in its Copilot app: "They'll help you plan, collaborate, automate, and customize your dev workflow." [1] The point behind it is quiet but real. Free-text chat is a slow and vague way to give a tool precise instructions. A named command is faster, and it does the same thing every time.
• •The compute bill behind the AI you buy TechCrunch reported a deal that most businesses will never touch directly but will feel indirectly. "Mirendil has signed a $100 million-plus Google Cloud partnership to expand its compute infrastructure, powering research into self-improving AI systems designed to accelerate scientific discovery and AI development." [4]
• •The thread, pulled tight What a tool can do is the easy part to assess, because it is what every demo is built to show. Whether you can steer it, whether you can trust its foundations, and whether you can count on the vendor after the sale are harder to see and matter more over time. Today's news touched each of those in turn — the vendor who followed up, the security net that widened, the commands that make a tool repeatable, and the compute bill underneath it all.