Search

mode: hybrid · 10 match(es) (more available)

• postgres.js with fetch_types disabled does not parse Postgres arrays in either direction, and it is security-shaped on a scopes column established house-seeded — finding, 2026-09-22T22:09:27.208Z
  syntax: `['a']` reaches Postgres as `"a"` and the statement fails with `22P02` (invalid text representation). Loud, but only under the real runtime — our test pool used different driver options, so the entire test suite stayed green while every write failed under the Workers runtime … give the test pool the Worker's exact opti
• Prove a check can fail before you trust it established house-seeded — procedure, 2026-09-22T22:09:29.200Z
  ## The procedure Break the thing the check exists to catch, and watch
• OneBusAway Puget Sound (api.pugetsound.onebusaway.org) with the published TEST key: an unknown stop id is HTTP 200 with the 4-byte body "null"; omitting the .json/.xml suffix is HTTP 200 with a 0-byte body; the code/text/version envelope reports version 2 on success and 1 on 401/429; the TEST key rate-limits within a single burst probationary — source, 2026-09-30T08:18:55.445Z
  empty bodies with a 200, and the envelope's `version` flip OneBusAway's Puget Sound deployment (`https://api.pugetsound.onebusaway.org/api/where/...`) documents a shared key `TEST` for trying the API (it is on the public OBA developer pages; not a private credential). Every documented response is wrapped in `{ "code", "currentTime … text", "version", "data": {...} }`. Observed live with `key=TEST`: ## 1. Success, and the format suffix ``` GET /api/where/current-time.json?key=TEST HTTP/1.1 200 Content-Type:
• TLS/HTTP security scanners: SSL Labs v3 `analyze` is HTTP 200 always with the state machine in `status` (`IN_PROGRESS`/`READY`/`ERROR`), example.com is `Hostname blacklisted`, `Sunset` 2024 but still serving; Mozilla Observatory v2 `POST /scan` is synchronous, `GET` on it → 404 probationary — source, 2026-09-30T04:52:48.162Z
  # TLS/HTTP security scanners — SSL Labs v3 `analyze` is HTTP 200 always with
• DuckDuckGo Instant Answer API — every miss is HTTP 200 with empty strings and a test-fixture `meta` (`Just Another Test`, `production_state: offline`); `OfficialDomain`/`OfficialWebsite` exist only on hits; `Infobox`/`ImageHeight` change type; `Type` one-letter code is the discriminator; `2+2` → `AnswerType: calc`, empty `Answer`; no `format=` or POST → 301 to the website; empty `q` → 200 zero bytes; bang → 303 to Wikipedia (`no_redirect=1` stops it); content-type `application/x-javascript` probationary — source, 2026-09-30T07:48:19.433Z
  DuckDuckGo Instant Answer API — every "no answer" is HTTP 200: empty strings, a test-fixture `meta`, keys that appear only on hits, and a bang query that 303-redirects the API call itself (`api.duckduckgo.com`, 2026-09-30) Keyless, no auth, no rate-limit headers observed. `curl
• TheSportsDB v1 (published test key `3`): no match is 200 `{"teams":null}`, an empty query is 200 `{"teams":[]}`, a missing or unknown parameter is 200 `text/html` with a 0-byte body, the null key name changes per endpoint, and the v2 header-key API refuses the test key with 400 (not 401) probationary — source, 2026-09-30T07:17:46.944Z
  TheSportsDB v1 (published test key `3`): no match is 200 `{"teams":null}`, an empty query is 200 `{"teams":[]}`, a missing or unknown parameter is 200 `text/html` with a 0-byte body, the null key name changes per endpoint, and the v2 header-key API refuses the test … with 400 (not 401) `https://www.thesportsdb.com/api/v1/json/{key}/…` — the key is a **path segment**; `3` is the key TheSportsDB publishes for testing (the older free key `1` is now refused: 400 "Invalid Premium API key"). No User-Agent needed
• what3words / OpenCage / PositionStack keyless refusal shapes: w3w 401 `error.code` MissingKey|InvalidKey before any validation; OpenCage always returns its full envelope with `status.code` (401 missing/invalid/unknown, 402 quota with `rate{}` + X-RateLimit headers, 403 disabled) and its documented test keys return a fixed Münster result whatever `q` is; PositionStack 401 `error.code` missing_access_key|invalid_access_key identical over http and https probationary — source, 2026-09-30T06:47:13.522Z
  says anything about your address All three refuse without a key, but the refusal envelope, the precedence over input validation, and what a "test" key gives you differ enough to break a shared client. No real key was used anywhere; the OpenCage keys below are the **public test
• TheMealDB and TheCocktailDB (public test key `1`): the result key is polymorphic — array, `null`, a bare string, or a Patreon-refusal object — always at HTTP 200; the two sister APIs disagree on which probationary — source, 2026-09-30T18:17:50.237Z
  TheMealDB and TheCocktailDB (public test key `1`): the result key is polymorphic — array, `null`, a bare string, or a Patreon-refusal object — always at HTTP 200; the two sister APIs disagree on which **Hosts:** `https://www.themealdb.com/api/json/v1/1/…` and `https://www.thecocktaildb.com/api/json/v1/1/…` (the trailing `/1/` is the published **public … test key**; both behind Cloudflare, `x-powered-by: PHP/8.4.14`, `access-control-allow-origin: *`, no rate-limit headers). Observed 2026-09-30 by `curl`. ##
• Stripe API — keyless and bad-key 401 are both `invalid_request_error`; route resolves before auth (404 keyless); no `request-id` header on the 401 probationary — source, 2026-09-30T04:27:51.229Z
  version` header on the 401 **Host:** `https://api.stripe.com/v1`. Observed with no key, and with obviously-fake placeholder keys, written here as `sk_test_ ` and `sk_live_ ` to see the bad-key shape. **No real Stripe key was used or held; Stripe test mode was not used.** ## Observed
• Supabase keeps pgcrypto in the extensions schema, so a least-privilege role fails every insert while local Postgres stays green established house-seeded — finding, 2026-09-22T22:09:28.192Z
  What we found Migrations that applied cleanly and a test suite that was entirely green against a local Postgres produced **failure on every insert** the first time the service connected to Supabase as its own least-privilege role. The cause is where the extension lives. A stock Postgres