Engineering notes from the trenches.
Reverse-engineering APIs, automation that survives production, security research, and honest takes on the tools I ship with.
Sort
73 posts
FeaturedSecurity Research
The Certificate Row Is Not the Certificate: A Revocation Bypass in Lemur
A newly disclosed Lemur flaw lets a low-privileged user create a duplicate certificate record and use it to revoke the real certificate at its issuing CA. The problem is a subtle but serious authorization mistake: trusting local row ownership instead of the CA-side certificate identity.
Aug 19, 20269 min read#certificate-management #authorization #api-security
Read post
Read post
Industry
The API Contract Your AI Users Already Believe Exists
An AI generated a polished demo for an API endpoint that did not exist, then its creators shipped compatibility routes instead of arguing with the model. The lesson is bigger than one text-erasure API: generated code is now a form of product telemetry.
Aug 17, 2026 · 11 min
Security
One SSRF Control Is Not Enough: The Budibase Automation Bypass
A newly disclosed Budibase SSRF issue shows why outbound HTTP protection cannot live in one integration while automation steps call fetch directly. The real failure is architectural: security controls that are opt-in, inconsistent, and easy for new features to bypass.
Aug 15, 2026 · 9 min
More posts
SecurityA Leaked Cookie Signing Key Is an Auth Failure, Not a Configuration Bug
CVE-2026-72793 exposes sensitive SiYuan configuration data through an API endpoint available to anonymous or publish-reader users. If you run SiYuan before v3.7.4, treat this as a potential authentication compromise and patch accordingly.
Aug 14, 2026 · 10 min
Field NotesBringing the Open Web Back: The Robot.villas RSS-to-Mastodon Bridge
robot.villas is a collection of bot accounts that mirror public RSS and Atom feeds into Mastodon. Here's why this simple bridge matters more than ever for the open web.
Aug 9, 2026 · 8 min
CraftBefore You Ration Anything, Price It
A Kaggle quota reading 100.47% looked like a resource war, but actually the pool was 87% empty. The real mistake was building a priority table without ever measuring what anything cost.
Aug 7, 2026 · 11 min
SecurityThree Ways WebKit Leaks Your Real IP Through Proxies — Even With iCloud Private Relay
Mysk found three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — that bypass proxy configurations on iOS and macOS, exposing users' real IP addresses and DNS queries, even with iCloud Private Relay. A deep-dive into the leaks and what they mean for privacy.
Aug 5, 2026 · 10 min
IndustryThe Alignment Illusion: Real-World Hacks Against OpenAI and Anthropic Show We've Been Training for the Wrong Thing
Zvi Mowshowitz's new piece details how both OpenAI and Anthropic's deployed models have been successfully hacked, revealing deep failures in alignment training and lack of meaningful supervision. Here's what that says about the industry's safety approach.
Aug 3, 2026 · 9 min
IndustryThe $20M Bet That Insurance APIs Are Harder Than They Look
Terminal just raised $20M to connect insurance and fleet software with telematics data. The API is the easy part — the real challenge is in the messy, legacy-ridden world the data flows through.
Aug 1, 2026 · 9 min
IndustryMCP Connected Everything to Everything—Except to a Brake Pedal
The Model Context Protocol standardized how AI agents talk to tools, but left a massive governance gap. One developer's frantic build reveals a future we all need to see.
Jul 30, 2026 · 8 min
SecuritySell Digital Products "Securely" — Unless Someone Submits a Coupon Code
The Premium Packages plugin for WordPress lets unauthenticated attackers dump your database through a coupon code field. Here's how the SQL injection works and why REST API endpoints keep getting this wrong.
Jul 28, 2026 · 8 min
IndustryOpen Models, Closed Strategies: What China's AI Outreach Really Means
China's push to distribute open AI models and train developers in emerging economies isn't just altruism—it's soft power with a compile flag. A look at the quiet battle for AI sovereignty and what it means for engineers everywhere.
Jul 26, 2026 · 10 min
AutomationThe Real Lesson of Automating Your Job Search (It’s Not About the Jobs)
When a cloud engineer open-sourced a Python pipeline that scrapes, filters, and ranks job listings, they got more than interviews. The real takeaway is a masterclass in selfish automation—and why the best tools are the ones you build for yourself.
Jul 24, 2026 · 9 min
SecurityCVE-2026-3854: A CVSS 8.7 RCE in GitHub Enterprise Server — What It Means and What to Do Right Now
A critical remote code execution vulnerability targeting GitHub Enterprise Server surfaced today. No need to panic, but you do need to act. Here's the breakdown of what's known and the immediate steps every GHES admin should take.
Jul 23, 2026 · 9 min
SecuritySurrealDB’s Cross-Tenant Custom Route Bug: When the URL Becomes a Master Key
CVE-2026-63735 reveals a critical authorization bypass in SurrealDB’s custom API routes. Attackers with any valid credential can jump namespaces and databases just by tweaking the URL — a classic multi-tenant scope validation failure. Here’s how it works and how to spot the same pattern in your own code.
Jul 22, 2026 · 9 min