Corrections and revision history

Tool fixes: Password Generator bias, SQL Formatter joins, article tables

2026-10-23

The Password Generator picked characters with a plain modulo of a 32-bit random value, so with 70 characters, 46 of them were slightly more likely than the other 24 (by about 1.6 in 100 million). It now uses rejection sampling, which makes every character equally likely, and its strength display shows the entropy formula it uses instead of an unexplained label.

The SQL Formatter split multi-word clauses such as LEFT JOIN across two lines. Multi-word keywords are now kept together, with tests covering the join types, GROUP BY, ORDER BY and UNION ALL.

Tables in nine articles were displayed as raw Markdown text because the article renderer did not support table syntax. They now render as tables.

Overlapping and thin articles merged

2026-10-23

Five short articles that overlapped with longer ones were merged into them, and their URLs now redirect to the article that covers the topic. One off-topic article, the Hex/RGB color converter and a two-item case-studies page were removed and return 410 Gone. The shadow-API article was rewritten as a longer guide to API inventory and gateway boundaries. Three old redirects that pointed at unrelated pages now return 410 Gone instead.

40 legacy URLs retired

2026-10-22

Forty old URLs (33 articles and 7 small tools) had been hidden from search results and the sitemap but were still reachable. They were taken down: 34 now return 410 Gone and 6 redirect to a retained page on the same topic. Some of the removed articles contained incident narratives that could not be traced to a primary source, which this site does not publish. The complete list is in config/retired-urls.json in the repository.

JWT Decoder: time claims were misjudged

2026-10-13

The JWT Decoder treated iat and nbf like exp, so a normal token whose iat or nbf lay in the past could be reported as expired. Now only an exp in the past marks a token as expired; an nbf in the future is shown as not yet valid; iat and auth_time are shown as times only, with a possible-clock-skew note if they lie in the future. Out-of-range timestamp values no longer cause an error and are shown as-is. The decoder still does not verify signatures.

The same change fixed several gaps in the Safe-to-Share Sanitizer: partially masked values were treated as already redacted, multi-line YAML block values and quoted values were only partly redacted, and some key formats (including OpenAI, Anthropic, Slack and GitLab tokens and private key blocks) were not recognized. The sanitizer remains a heuristic that can miss data.

Unsupported and invented claims replaced

2026-07 to 2026-08

A review of existing articles found claims without sources. The affected articles were rewritten around primary sources:

• 2026-07-15: an article on OAuth token revocation contained invented security claims; replaced.
• 2026-08-08: unsupported claims in an article on broken object-level authorization; replaced.
• 2026-08-10: invented CI/CD token incidents in an article on token leakage; replaced.
• Between 2026-07-13 and 2026-08-20: further articles on CVEs, request smuggling, mass assignment, OAuth redirects, GraphQL and API rate limiting were corrected.

On 2026-07-24 a repository check was added that blocks CVE articles without review metadata and an official source (see the editorial policy).

Tool fixes

2026-07 to 2026-09

Fixes to tool behavior, as recorded in the repository history: webhook signature verification semantics and sanitizer hardening (2026-07-24), Unix timestamp unit handling (2026-08-02), browser-side UUID generation (2026-08-03), and SQL formatter dialect syntax (2026-09-07).

Launch and early cleanup

2026-03

The site launched on 2026-03-11 and published a large number of articles in a short time. Within two weeks, on 2026-03-21 and 2026-03-22, duplicate articles were consolidated with redirects and 14 placeholder or very short articles were removed. Later entries on this page cover the content that still fell short of the standards in the editorial policy.