Engineering essays.
Deep-dives on AI code review, multi-agent architecture, and the craft of shipping reliable software at speed.
July 19, 2026SecurityOpen Redirect via Unvalidated next Param: How Mesrai Catches It
Real PR: `res.redirect(req.query.next)` is open redirect. Protocol-relative URLs slip through. Three-line fix Mesrai suggests. CWE-601.
9 min read· Mesrai Team
July 19, 2026SecurityLDAP Injection in Auth Handlers: A Diff-by-Diff Walkthrough
Real Mesrai catch on an LDAP login flow: filter built via template literal — `*)(uid=*` bypasses auth. CWE-90 walkthrough with attack + canonical fix.
9 min read· Mesrai Team
July 18, 2026SecurityXXE Injection in XML Parsers: Mesrai's Default-Off Detection
Real PR walkthrough: enabling `noent` and `dtdload` on an XML parser opens XXE. Mesrai's catch, the file-read attack, the safe parser config. CWE-611.
9 min read· Mesrai Team
July 18, 2026SecurityPath Traversal in File Uploads: The ../../etc/passwd Diff Mesrai Flagged
Real PR: `path.join` does not prevent traversal. Mesrai's catch, the `../../etc/passwd` attack, and the basename + containment fix. CWE-22.
9 min read· Mesrai Team
July 17, 2026SecurityCommand Injection via child_process.exec: A Mesrai Catch
Real PR catch: `child_process.exec` runs through /bin/sh — shell metacharacters in user input mean RCE. Mesrai's flag, the attack, the execFile fix. CWE-78.
9 min read· Mesrai Team
July 17, 2026SecurityNoSQL Injection in MongoDB Queries: How Mesrai Spots $where Abuse
Real PR walkthrough: MongoDB `$where` with user input is server-side JS execution. Mesrai's review comment, the attack, the fix — CWE-943 in detail.
9 min read· Mesrai Team
July 14, 2026SecurityRBI Data Localisation + AI Tools: Compliance Checklist
RBI data localisation + AI tools — the compliance checklist financial services teams need before signing any AI code review provider in India.
9 min read· Mesrai Team
July 12, 2026SecurityAI Code Review Tools That Support Indian Data Residency
AI code review tools that support Indian data residency — DPDP Act, sectoral regulators, and the providers that actually deliver in 2026.
9 min read· Mesrai Team
July 6, 2026SecurityZero-Data-Retention AI Code Review Tools Compared
Zero-data-retention AI code review tools compared — which providers actually deliver, what the trade-offs are, and where Mesrai stands.
9 min read· Mesrai Team
July 6, 2026SecurityPII Detection in Pull Requests via AI: How It Works
How AI tools detect PII in pull requests — pattern matching plus context. What gets caught, what gets missed, and how Mesrai handles it.
8 min read· Mesrai Team
July 5, 2026SecurityGDPR + AI Code Review: What Changes for EU Teams
GDPR + AI code review — what changes for EU teams in 2026. Data Processing Agreements, sub-processor lists, and the EU-only deployment option.
8 min read· Mesrai Team
July 5, 2026SecurityIndia Data Residency for AI Code Review: What CTOs Need to Know
India data residency for AI code review — DPDP Act, RBI rules, sector-specific. What CTOs need to know before signing.
8 min read· Mesrai Team