Engineering essays.
Deep-dives on AI code review, multi-agent architecture, and the craft of shipping reliable software at speed.
September 28, 2026SecurityPrototype Pollution in Object Merge Utilities: A Caught Pattern
Real Mesrai catch on a homebrew merge utility — `__proto__` keys mutate Object.prototype for the whole process. CWE-1321 walkthrough with safe-merge fix.
9 min read· Mesrai Team
September 20, 2026SecurityThe Hardcoded API Key Mesrai Found in a Test Fixture
Real PR catch: a Stripe live key hardcoded in a test fixture. Mesrai's flag, the rotation procedure, and the pre-commit hook that closes the class. CWE-798.
8 min read· Mesrai Team
July 26, 2026SecurityOAuth State Parameter Missing: How Mesrai Prevents CSRF on Callback
Real PR catch: OAuth callback without `state` verification. The session-binding attack and the generate-store-verify fix. CWE-352.
8 min read· Mesrai Team
July 25, 2026SecurityIDOR in REST Endpoints: The /users/:id Diff Mesrai Caught
Real PR catch: `/users/:id` with no ownership check — sequential ids let any user scrape the entire user table. CWE-639 walkthrough.
8 min read· Mesrai Team
July 25, 2026SecurityAuthorization Bypass via Missing req.user.id Check
Real PR catch: GET /documents/:id checks auth but not ownership. Every doc readable by every user. CWE-862 walkthrough with predicate fix.
8 min read· Mesrai Team
July 24, 2026SecurityMissing CSRF Token on State-Changing Endpoints
Real PR catch: POST endpoint with no CSRF guard. Why SameSite is not enough, the attacker form, and the double-submit fix. CWE-352.
8 min read· Mesrai Team
July 24, 2026SecurityInsecure Random in Token Generation: Math.random() → crypto
Real PR catch: `Math.random` for reset tokens — V8's xorshift state is recoverable. Migration to `crypto.randomBytes`. CWE-338.
8 min read· Mesrai Team
July 23, 2026SecurityWeak Password Hashing (MD5/SHA1): Mesrai's Argon2 Suggestion
Real PR catch: password hash with SHA-1 — crackable at 25 billion guesses per second. The Argon2id migration Mesrai recommends. CWE-916.
8 min read· Mesrai Team
July 23, 2026SecuritySession Fixation in Login Flows: A Mesrai Diff
Real PR catch: login handler not regenerating session id — session fixation. Walkthrough with attack chain + canonical regenerate fix. CWE-384.
8 min read· Mesrai Team
July 22, 2026SecurityMissing httpOnly + secure Cookie Flags: The Cookie Audit
Real PR walkthrough: session cookie set without security flags. Three attacks one line stops — XSS, MITM, CSRF. CWE-1004 + CWE-614.
8 min read· Mesrai Team
July 22, 2026SecurityJWT alg: "none" Vulnerability: How Mesrai Spots It
Real PR catch: `jwt.verify` without algorithms allowlist accepts `alg:none` forged tokens. Full attack + pinned-algorithm fix. CWE-347.
8 min read· Mesrai Team
July 20, 2026SecuritySSRF in Webhook Handlers: The Internal-IP Filter Mesrai Suggests
Real Mesrai catch on a webhook tester: server-side request forgery against cloud metadata + internal services. CWE-918 with attack + DNS-validation fix.
9 min read· Mesrai Team