Urgent.News

What's breaking now, across thousands of outlets.

Tech

How I Mapped an Undocumented Vendor API in 2 Days With Claude Code

TL;DR A vendor handed us a sandbox key, a 6-page PDF, and no OpenAPI spec. I used Claude Code to turn ~40 exploratory requests into an inferred schema, a typed client, and a contract test suite in two days. The trick was never letting the agent write types from the docs — only from captured responses. Here's the loop, plus the three times it confidently made things up. The Problem We had to…

The challenge was integrating a partner's billing API using only a sandbox key, a 6-page PDF with example requests, and no OpenAPI spec or SDK. The PDF mentioned the amount field was an integer, but the real payloads contained string values in three endpoints. The invoice object had six fields according to the PDF, but thirty-one fields in practice.

To avoid issues where documented types and nullability didn't match actual responses, the author's solution required tracing every type, enum, and nullability decision back to actual HTTP responses observed during testing.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

Your Stripe key is on GitHub. Do this now, in this order.

Deleting the file doesn't help. The key is still live until you rotate it, and it's still readable in git history until you remove it from there too. Here's the order that actually matters.

  • Rotate Stripe secret key immediately in Stripe dashboard.
  • Remove key from Git history to prevent ongoing access.
  • Monitor for unusual activity; seek Stripe support if needed.

How I Found a postMessage Origin Bypass in an OAuth SDK

I spend a lot of time reading other people's code. Not because I enjoy it—though honestly, I kind of do—but because that's where the interesting bugs live.

  • Security researcher found postMessage bypass vulnerability in OAuth SDK
  • Lack of origin check allowed attackers to spoof messages from OAuth popup
  • Adding origin check to message event listener fixed the issue

More from Friday 28 August →