The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Back to feedPost
Endpoint Enumeration & Policy Analysis
The engagement began with black-box reconnaissance of the external API gateway. Requests routed through /v1/chat/completions accepted conversational payloads without enforcing strict per-identity rate controls or contextual session boundaries. Inspection of the HTTP handling revealed that incoming strings were directly interpolated into downstream runtime contexts without pre-execution sanitization or token-budget constraints.
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Related posts
Crenaly: a booking SaaS I designed and built end-to-end for appointment-based businesses in France: salons, barbers, beauty and wellness.
The core idea: when a client cancels, the freed slot is automatically offered to clients who asked for an earlier time. The first to accept gets it, their appointment moves in place, and the slot they leave is offered next. No double booking, no manual work.
Around it, a full product:
→ Branded booking page for each business, embeddable on their own site
→ Mobile-first booking flow, no account needed
→ Agenda, client management, team roles & permissions
→ Verified reviews, analytics, Stripe billing
Product, UX/UI, frontend and backend.
Next.js · TypeScript · NestJS · PostgreSQL · Redis
Automatically offering a cancelled slot to the next client is such a practical feature for salons and barbers. Designing and building Crenaly end to end must have made those flows much tighter.
Open thermodynamic multi-agent simulation and survival game in Python: mass-conserving chemistry, ecology grid, genetics, barter market. Playable Pygame/TUI plus headless runs for experiments.
A WhatsApp chatbot that automates tasks is NOT the same as a custom-built web application.
And honestly, I’ve noticed how much people love AI-powered WhatsApp bots lately.
As someone who develops AI workflows and custom websites, I personally believe that combining a well-built web application with AI puts you one step ahead.
Imagine having a custom interface, your own database, automated workflows, and an AI agent working together in one place.
That’s a completely different level of flexibility.
Don’t get me wrong: WhatsApp bots aren’t always the inferior option. They’re great for customer-facing interactions and quick communication.
But personally? I’d rather give customers a dedicated web experience whenever the project calls for it.
Are you Team WhatsApp Bot or Team Web Bot?
When the web app and the bot share one database, which side owns the conversation state: the n8n workflow or the app? That choice seems to decide whether a customer can switch between WhatsApp and the web view mid-request.