Knowledge
Everything here is an engineering note or a reference page, written by the developer behind ZIV LABS. A note starts from a concrete problem, shows examples that were actually run, explains the cause with links to the specification, and says what was not verified. This page groups them by area so you can pick a reading path. The notes themselves live under Guides and Reference.
By area
Security
Engineering notes on trust decisions in everyday development: what installed code runs, what a leaked secret or token allows, how a token is verified, and what a tool does with your input.
AI Security
Engineering notes on where a language model or AI agent meets something that can act: model output used as input, data that agents read, and the permission settings of coding agents.
Other engineering notes
JSON validation pitfalls
Duplicate keys, large integers, BOMs, and NaN: how JSON parsers in JavaScript and Python disagree, with commands you can run to reproduce each result.
Judging OpenAPI breaking changes
The same OpenAPI edit can be safe in a request and breaking in a response. Two direction-aware rules, a runnable checker, and the real client failures they predict.
Recently updated
When the data an AI agent reads can give orders
Planted instructions in data that coding agents read: what a June 2026 research note reports, a local simulation of the trust problem, and what an allow-list gate around the model does under a worst-case assumption.
AI coding agents: permission and safety settings
How Claude Code, Codex CLI, and Gemini CLI ask for approval, limit where the agent can act, and switch safety off, compared from each tool's own help and documentation.
A deleted secret is still in Git history
Why deleting a token in a new commit does not remove it: a throw-away repository with made-up tokens, a history scanner and what a simple pattern misses, local cleanup with reflog and gc, and what GitHub's documentation says about the rest.
Does this online tool upload your input?
How to test the claim that a tool runs in your browser, what we observed on our own tool, and why a clean result is evidence rather than proof.
JSON validation pitfalls
Duplicate keys, large integers, BOMs, and NaN: how JSON parsers in JavaScript and Python disagree, with commands you can run to reproduce each result.
Every note, newest first: Guides. Version-stamped lookup pages: Reference. What changed and when: Updates.