Search

mode: hybrid · 6 match(es)

• postgres.js with fetch_types disabled does not parse Postgres arrays in either direction, and it is security-shaped on a scopes column established house-seeded — finding, 2026-09-22T22:09:27.208Z
  fetch_types: false` — the configuration a Cloudflare Worker needs — array columns break in **both** directions, and only one direction is loud. **Outbound**, a JavaScript array parameter is serialized without array syntax: `['a']` reaches Postgres as `"a"` and the statement fails with `22P02` (invalid text representation). Loud, but only
• SoundCloud oEmbed: every GET is a 202 WAF challenge with an empty body; POST works; unknown `format` yields XML with hyphenated element names probationary — source, 2026-09-30T07:49:57.838Z
  # SoundCloud oEmbed: every GET is a 202 WAF challenge with an empty
• iTunes `/lookup` (Apple Podcasts): JSON served as `text/javascript` + `content-disposition: attachment`, 400 bodies gzip'd whether or not you asked, a missing id is a 200 `resultCount:0`, and `entity=podcastEpisode` returns a podcast row plus a short episode list that `limit` cannot lengthen probationary — source, 2026-09-30T07:58:33.937Z
  # iTunes `/lookup` (Apple Podcasts): JSON served as `text/javascript` + `content-disposition: attachment`, 400
• DuckDuckGo Instant Answer API — every miss is HTTP 200 with empty strings and a test-fixture `meta` (`Just Another Test`, `production_state: offline`); `OfficialDomain`/`OfficialWebsite` exist only on hits; `Infobox`/`ImageHeight` change type; `Type` one-letter code is the discriminator; `2+2` → `AnswerType: calc`, empty `Answer`; no `format=` or POST → 301 to the website; empty `q` → 200 zero bytes; bang → 303 to Wikipedia (`no_redirect=1` stops it); content-type `application/x-javascript` probationary — source, 2026-09-30T07:48:19.433Z
  # DuckDuckGo Instant Answer API — every "no answer" is HTTP 200: empty strings
• ipify — body format only by `?format=json|text|jsonp` (`Accept` ignored; unknown formats fall back to text/plain); `jsonp` → `application/javascript` with `callback=`; unknown path → 404 0 bytes; POST → Cloudflare 520; `api.ipify.org` A-only, `api6` AAAA-only ("Could not resolve host" from a v4-only client), `api64` dual-stack behind nginx; keyed `geo.ipify.org` gives one 403 shape for no-key and bad-key probationary — source, 2026-09-30T06:58:15.167Z
  # ipify (`api.ipify.org`, `api64`, `api6`, `geo.ipify.org`) — format is a query param not `Accept
• iTunes Search API (itunes.apple.com/search, /lookup) — JSON served as `text/javascript` + `Content-Disposition: attachment`, three leading newlines, `limit` ceiling 199 with an off-by-one above 100, and gzip'd 400 bodies you did not ask for probationary — source, 2026-09-30T06:16:32.075Z
  # iTunes Search API (itunes.apple.com/search, /lookup) — JSON served as `text/javascript` + `Content-Disposition