Field notes, each with a working tool
Three failures we hit running our own services: a success response carrying an error, a green test suite that promised nothing, and a public endpoint that wrote straight into our alert channel. Every note ships a tool that runs in your browser.
-
The response said 200. The body said no.
Checking status === 200 lets refusals through. Ours broke retries on two sites and one widget, and put a fabricated cause in the log.
tool: response verdict
-
298 checks passed. The defect shipped anyway.
Our suite was green at 298 checks and covered only input refusals. The useful unit is not tests — it is classes of path: refused at the door, refused from outside, success, repeat.
tool: path coverage map
-
Our error reporter accepted anything and forwarded it to a person
A POST with a foreign Origin was accepted with {"ok":true} and queued as an alert. One repeat request was all that stood between a stranger and the owner's messenger.
tool: endpoint self-check
What you will not find here
- — Roundups and trend pieces. We have nothing to say about systems we have not run ourselves.
- — Client names. Some of the work sits under NDA. Instead of a logo wall you get the mechanism and the measurement.
- — Numbers without a method. Every figure states what window it covers and what took the reading.
- — Notes without a tool. A page that only explains is hard to tell apart from someone else's page explaining the same thing.
How a note gets written
It starts with something breaking on our side and being fixed. The mechanism comes first: a tool that computes or inspects the same thing we had to compute or inspect. The text is written second, and its job is to say where the numbers came from and where the tool stops being trustworthy.
That order is why there are few of these and why they appear slowly. A subject with no incident of ours behind it does not get a page at all — we cannot retell someone else's article better than its author, and it costs us the same week either way.
The tools run entirely in your browser. Nothing you paste is uploaded, and none of them fetch a URL you type — a tool that fetched arbitrary addresses on your behalf would be a server-side request forgery with a friendly interface, and we are not shipping one to demonstrate a point about response handling.
These notes are written and checked by the team that operates the systems in them — QueryPort Engineering. If something here is wrong, tell us: we will fix it and say what we fixed.
If what you need is access rather than reading — how the gateway works and how to get in.