Read the status code before you believe the README
Six documented endpoints, two that work. Probing an API's real surface takes a minute and changes the architecture you build on top of it.
All posts
The command that leaked a secret was not cat
I leaked an OAuth token by running a command designed to print only field names. The file was malformed, so the field name was the secret. Verb denylists cannot catch this shape.
A stale doc does more damage than a missing one
Documentation that is confidently wrong is worse than absent, because it stops the investigation. Three examples from one codebase and what made them survive so long.
Why every command runtime is capped at 200 lines
A 200-line cap on command runtimes, enforced by a hook. What it rejected, what that forced, and the one time the cap was the wrong tool.