Engineering essays.
Deep-dives on AI code review, multi-agent architecture, and the craft of shipping reliable software at speed.
July 25, 2026SecurityAuthorization Bypass via Missing req.user.id Check
Real PR catch: GET /documents/:id checks auth but not ownership. Every doc readable by every user. CWE-862 walkthrough with predicate fix.
8 min read· Mesrai Team
July 24, 2026SecurityMissing CSRF Token on State-Changing Endpoints
Real PR catch: POST endpoint with no CSRF guard. Why SameSite is not enough, the attacker form, and the double-submit fix. CWE-352.
8 min read· Mesrai Team
July 24, 2026SecurityInsecure Random in Token Generation: Math.random() → crypto
Real PR catch: `Math.random` for reset tokens — V8's xorshift state is recoverable. Migration to `crypto.randomBytes`. CWE-338.
8 min read· Mesrai Team
July 23, 2026SecurityWeak Password Hashing (MD5/SHA1): Mesrai's Argon2 Suggestion
Real PR catch: password hash with SHA-1 — crackable at 25 billion guesses per second. The Argon2id migration Mesrai recommends. CWE-916.
8 min read· Mesrai Team
July 23, 2026SecuritySession Fixation in Login Flows: A Mesrai Diff
Real PR catch: login handler not regenerating session id — session fixation. Walkthrough with attack chain + canonical regenerate fix. CWE-384.
8 min read· Mesrai Team
July 22, 2026SecurityMissing httpOnly + secure Cookie Flags: The Cookie Audit
Real PR walkthrough: session cookie set without security flags. Three attacks one line stops — XSS, MITM, CSRF. CWE-1004 + CWE-614.
8 min read· Mesrai Team
July 22, 2026SecurityJWT alg: "none" Vulnerability: How Mesrai Spots It
Real PR catch: `jwt.verify` without algorithms allowlist accepts `alg:none` forged tokens. Full attack + pinned-algorithm fix. CWE-347.
8 min read· Mesrai Team
July 21, 2026Technical Deep DiveRegex Catastrophic Backtracking: The 30s CPU Spike Mesrai Prevented
Real Mesrai catch on a nested-quantifier email regex — pathological input pins the event loop. CWE-1333 walkthrough with linear-time fix.
9 min read· Mesrai Team
July 20, 2026SecuritySSRF in Webhook Handlers: The Internal-IP Filter Mesrai Suggests
Real Mesrai catch on a webhook tester: server-side request forgery against cloud metadata + internal services. CWE-918 with attack + DNS-validation fix.
9 min read· Mesrai Team
July 19, 2026SecurityOpen Redirect via Unvalidated next Param: How Mesrai Catches It
Real PR: `res.redirect(req.query.next)` is open redirect. Protocol-relative URLs slip through. Three-line fix Mesrai suggests. CWE-601.
9 min read· Mesrai Team
July 19, 2026SecurityLDAP Injection in Auth Handlers: A Diff-by-Diff Walkthrough
Real Mesrai catch on an LDAP login flow: filter built via template literal — `*)(uid=*` bypasses auth. CWE-90 walkthrough with attack + canonical fix.
9 min read· Mesrai Team
July 18, 2026SecurityXXE Injection in XML Parsers: Mesrai's Default-Off Detection
Real PR walkthrough: enabling `noent` and `dtdload` on an XML parser opens XXE. Mesrai's catch, the file-read attack, the safe parser config. CWE-611.
9 min read· Mesrai Team