Toolnotes

Notes on two narrow, specific problems and the free tools we built to catch them deterministically:

• entitlement-guard — a static-analysis CLI/GitHub Action that flags client-controlled tier/plan/role values reaching an entitlement decision without webhook-verified gating (mass assignment / CWE-915, adjacent to IDOR and broken access control).
• baton — a drift detector for CLAUDE.md/AGENTS.md, the memory files AI coding agents read at the start of every session, diffed deterministically against real git history.

Posts

• Mass assignment (CWE-915) in Node/TypeScript APIs: why it survives code review — 2026-08-08

• Your AGENTS.md is already stale — here’s how to catch it without another LLM call — 2026-08-08