Blog

Writing

Long-form from our team. Engineering, product, and company posts.

  • Product

    Your Webhooks Shouldn't Trust the URL They Were Given

    A webhook is the one feature where a customer types an address and your servers go and call it. What we built for Kookee's webhooks and its Slack, GitHub and Jira integrations, and eight things a webhook sender has to get right.

  • oauth

    Your MCP Server Shouldn't Make People Paste a Token

    Our MCP server worked well with personal tokens, as long as you lived in a terminal. Claude's chat apps and ChatGPT connect by signing in instead. What we shipped so they can, and the seven decisions that took longer than the code.

  • security

    Your Invite Link Is a Password You Pasted in Slack

    Send someone an invite link and you have handed out a credential that works for anyone who ever sees it. Here is what that link has to carry before it is safe to paste into a channel, and the decisions behind ours.