Engineering notes from the trenches.
Reverse-engineering APIs, automation that survives production, security research, and honest takes on the tools I ship with.
Filtered by tag:#api×
Sort
6 posts ← reset filters
AutomationThe pkg.go.dev API Is Finally Official — Here's What You Can Actually Do With It
The Go team just shipped an official API for pkg.go.dev. Here's what it exposes, how to use it for automation, and why this matters for anyone building tooling around the Go ecosystem.
May 22, 2026 · 9 min- Security
How I got free cinema credit by ordering -2 popcorns
A missing input validation on M-Tix Cinema XXI's food ordering API let me increase my account balance by submitting negative quantities. No tools needed — just a browser.
May 19, 2026 · 6 min - API RE
5 things I check before trusting an API
Before I integrate with any API — official or reverse-engineered — I run through this checklist to avoid surprises later.
May 18, 2026 · 8 min - API RE
What your JWT tokens reveal about your backend
JWTs are meant to be opaque to users. They're not. Here's what I learn about your architecture just by decoding one.
May 18, 2026 · 8 min - Security
Common auth mistakes I find when reverse-engineering APIs
After years of poking at APIs that weren't meant to be poked at, these are the auth patterns that break most often — and why.
May 18, 2026 · 9 min - Security
How I analyze API security headers in 30 seconds
A quick checklist for reading HTTP response headers and spotting security misconfigurations before you even look at the response body.
May 18, 2026 · 7 min