Engineering essays.
Deep-dives on AI code review, multi-agent architecture, and the craft of shipping reliable software at speed.
July 22, 2026SecurityMissing httpOnly + secure Cookie Flags: The Cookie Audit
Real PR walkthrough: session cookie set without security flags. Three attacks one line stops — XSS, MITM, CSRF. CWE-1004 + CWE-614.
8 min read· Mesrai Team
July 22, 2026SecurityJWT alg: "none" Vulnerability: How Mesrai Spots It
Real PR catch: `jwt.verify` without algorithms allowlist accepts `alg:none` forged tokens. Full attack + pinned-algorithm fix. CWE-347.
8 min read· Mesrai Team
July 21, 2026Technical Deep DiveRegex Catastrophic Backtracking: The 30s CPU Spike Mesrai Prevented
Real Mesrai catch on a nested-quantifier email regex — pathological input pins the event loop. CWE-1333 walkthrough with linear-time fix.
9 min read· Mesrai Team
July 20, 2026SecuritySSRF in Webhook Handlers: The Internal-IP Filter Mesrai Suggests
Real Mesrai catch on a webhook tester: server-side request forgery against cloud metadata + internal services. CWE-918 with attack + DNS-validation fix.
9 min read· Mesrai Team
July 19, 2026SecurityOpen Redirect via Unvalidated next Param: How Mesrai Catches It
Real PR: `res.redirect(req.query.next)` is open redirect. Protocol-relative URLs slip through. Three-line fix Mesrai suggests. CWE-601.
9 min read· Mesrai Team
July 19, 2026SecurityLDAP Injection in Auth Handlers: A Diff-by-Diff Walkthrough
Real Mesrai catch on an LDAP login flow: filter built via template literal — `*)(uid=*` bypasses auth. CWE-90 walkthrough with attack + canonical fix.
9 min read· Mesrai Team
July 18, 2026SecurityXXE Injection in XML Parsers: Mesrai's Default-Off Detection
Real PR walkthrough: enabling `noent` and `dtdload` on an XML parser opens XXE. Mesrai's catch, the file-read attack, the safe parser config. CWE-611.
9 min read· Mesrai Team
July 18, 2026SecurityPath Traversal in File Uploads: The ../../etc/passwd Diff Mesrai Flagged
Real PR: `path.join` does not prevent traversal. Mesrai's catch, the `../../etc/passwd` attack, and the basename + containment fix. CWE-22.
9 min read· Mesrai Team
July 17, 2026SecurityCommand Injection via child_process.exec: A Mesrai Catch
Real PR catch: `child_process.exec` runs through /bin/sh — shell metacharacters in user input mean RCE. Mesrai's flag, the attack, the execFile fix. CWE-78.
9 min read· Mesrai Team
July 17, 2026SecurityNoSQL Injection in MongoDB Queries: How Mesrai Spots $where Abuse
Real PR walkthrough: MongoDB `$where` with user input is server-side JS execution. Mesrai's review comment, the attack, the fix — CWE-943 in detail.
9 min read· Mesrai Team
July 16, 2026Case StudiesMesrai at a US Series B: 6-Month Adoption Retrospective
Mesrai at a US Series B fintech — six-month adoption retrospective. What worked, what didn't, what they'd do differently.
9 min read· Mesrai Team
July 16, 2026Case StudiesFrom 30-Day Review Cycles to 4 Hours: A Healthcare Team's Story
Healthcare team's story: from 30-day review cycles to 4 hours with Mesrai — HIPAA-safe, BYOK on regional Anthropic, full case study.
9 min read· Mesrai Team