Engineering notes
Notes on problems that come up in everyday development work, written by the developer behind ZIV LABS. Each note starts from a concrete problem, shows examples that were actually run, explains the cause with links to the specification, and says what was not verified. We publish few notes and update them when something changes.
Data formats
JSON validation pitfalls
Duplicate keys, large integers, BOMs, and NaN: how JSON parsers in JavaScript and Python disagree, with commands you can run to reproduce each result.
Security
JWT verification mistakes
Four tokens a flawed JWT verifier accepts and a strict one rejects: alg none, RS256-to-HS256 confusion, and unchecked claims, reproduced with runnable Node.js code.
APIs
Judging OpenAPI breaking changes
The same OpenAPI edit can be safe in a request and breaking in a response. Two direction-aware rules, a runnable checker, and the real client failures they predict.