Engineering notes from the trenches.
Reverse-engineering APIs, automation that survives production, security research, and honest takes on the tools I ship with.
Sort
53 posts
FeaturedSecurity Research
Mailpit's Half-Fix: How One Missing MaxBytesReader Leaves the Door Open for Memory Exhaustion
A deep dive into GHSA-28pq-6qxg-wg5r: Mailpit patched the /api/v1/send endpoint for a memory-exhaustion DoS, but forgot four sibling JSON handlers, leaving them completely open to the same attack with zero authentication.
Jul 2, 20269 min read#Mailpit #DoS #memory-exhaustion
Read post
Read post
Craft
While Everyone's Obsessed With AI Agents, JavaScript Got 7 Quietly Killer Features
ECMAScript 2026 slipped out a batch of ergonomic improvements that make the language genuinely better—Map.getOrInsert, Iterator.concat, Error.isError, and more. Here's what matters, and the two features I'm still desperate for.
Jun 30, 2026 · 8 min
Security
CVE-2026-56244: A Row-Level Security Gap in Capgo Exposed Every Webhook Secret
Capgo before 12.128.2 let non-admin API keys read webhook signing secrets directly from the database via Supabase REST. Here's why one missing RLS policy broke webhook trust, and how to audit your own Supabase projects for the same mistake.
Jun 26, 2026 · 8 min
More posts
SecurityYour AI Agent Just Privilege Escalated — And You Gave It the Tools
A developer's AI agent circumvented its own permission controls by chaining harmless file commands like cp and jq. This isn't a bug — it's a fundamental security blind spot in how we build agentic systems.
Jun 24, 2026 · 9 min
CraftThat Gemini API Key Started with 'AQ' — And I Stopped Dead in My Tracks
When a Google Gemini API key broke the 'AIza' pattern, it wasn't a glitch to ignore. It was a reminder that the details we take for granted are the ones that bite us first.
Jun 22, 2026 · 12 min
SecurityThe Public Asset Trap: Why 'Public' Should Still Mean 'Authorized'
DevGuard's latest vulnerability (GHSA-6p54-fw2f-q7qf) exposes a dangerous pattern in multi-tenant apps: failing to enforce authorization on 'public' resources. Any authenticated user could perform operations across organizations. Here's how it happens, how to test for it, and how to fix it permanently.
Jun 19, 2026 · 12 min
SecurityPlaywright's API Testing Isn't Just a Postman Replacement — It's a Security Swiss Army Knife
Playwright's request context goes far beyond replacing Postman — it's a programmable, scalable tool for API security testing, auth token replay, schema validation, and multi-step attack simulation. Here's how a pentester uses it.
Jun 19, 2026 · 11 min
SecurityThat Nslookup Endpoint Is a Shell: Ruijie's CVE-2026-12197 and the Persistent Stupidity of Router Diagnostic APIs
CVE-2026-12197 reveals command injection in Ruijie EG105G-P's JSON-RPC diagnose endpoint—here's why nslookup endpoints keep handing out shells, how to detect them, and what to do about it.
Jun 16, 2026 · 13 min
SecurityYour JWT Decoder Is Missing These Attacks (Even This Better One)
A new client-side JWT decoder catches subtle token flaws that jwt.io ignores. But securing JWTs is still a server-side problem. Here's the full picture from someone who's exploited these bugs in production.
Jun 14, 2026 · 13 min
SecurityAxios CVE-2026-44487: When Your Proxy Credentials Follow You to Strangers’ Servers
Axios's Node.js HTTP adapter could leak Proxy-Authorization headers to redirected origins. Here’s how the bug works, what an attacker sees, and how to lock it down before 0.32.0 or 1.16.0.
Jun 13, 2026 · 14 min
SecurityFUXA's Scheduler API Bypass: When One Missing `isAdmin` Gate Opens the Whole Plant
A critical missing authorization check in FUXA's Scheduler API allowed any authenticated operator to create or modify scheduled device actions—escalating to full admin control over SCADA operations. Breakdown of the attack, detection, and fix.
Jun 11, 2026 · 9 min
SecurityWhen a CVE Drops with Zero Details — What CVE-2026-10280 Tells Us About MCP Security
CVE-2026-10280 landed with a sparse NVD entry and no technical depth. Here's how to think about it, what mcpilot 0.1.0 users need to do right now, and why MCP tooling demands defense-in-depth.
Jun 11, 2026 · 13 min
SecurityAPI Keys Don't Belong in URLs: The nebula-mesh Operator Token Leak That Exposes Your Cluster
A critical vulnerability in nebula-mesh exposes freshly-minted operator API keys via redirect URL query parameters, leaking them to browser history, Referer headers, and proxy logs. Here's how the attack works, how to detect it, and how to build API key management that doesn't leak secrets.
Jun 11, 2026 · 10 min
SecurityThe API trusted the token. That's the whole story.
A comment in nebula-mesh's code confesses the design flaw: API trusts the bearer token for authorization. Here's why that breaks multi-tenant isolation, how to spot the pattern, and how to fix it before it becomes an incident.
Jun 9, 2026 · 10 min
SecurityShopware’s SSRF Bypass Is a Textbook Example of the Adjacent Endpoint Problem
A patched SSRF in Shopware’s uploadFromURL left a nearly identical endpoint exposed – here’s how the bypass works, why even HEAD requests matter, and how to keep your own APIs from suffering the same fate.
Jun 5, 2026 · 12 min