Field notes / 2022-present
Things I learned by looking closer.
Security findings, audit patterns, build logs, and personal notes. Sensitive source material is edited to keep the lesson without publishing private details.
2 notesNewest first
Security
Authorization belongs at the resolver
A GraphQL field can be perfectly typed and still expose data or mutations that the current user should never reach.
graphqlaccess controlapi security
Security
Empty inputs are still inputs
How an empty poll choice exposed a state-accounting gap, and what it taught me about validating transitions rather than shapes.
business logicrace conditionsruby