A QR code that grants nothing
Candidates pay at a counter, not online. The QR code that joins the two carries no authority — and the guard lives in one function, not four screens.
Six of the twenty-nine are not fields
A camera field produces a file minutes before the form exists. Uploading it early inverts ownership, and the fence that puts it back.
Your editors are trusted. Sanitise anyway.
A tag allow-list cannot say an iframe must point at YouTube. The attribute filter that can, and the wrapper span that quietly bypassed it.
Buying a domain from Django
A 1990s XML protocol, an MD5-of-MD5 signature, a DOCTYPE you must not parse naively, and calls that debit an account. What the wrapper has to get right.
CORS for a write surface
Allow-Origin star is fine for a public feed and catastrophic for a write endpoint. A per-form allow-list, exact origin matching, and the preflight trap.
Certificates for domains that do not exist yet
Caddy issues a certificate at the first handshake for a name it has never seen. Without the right ask endpoint, that is a free certificate mint for anyone.
An MCP server in front of a business platform
Twenty-six typed tools instead of one query tool, two auth schemes, bounded results, and the authorisation rule that decides whether it is safe at all.