FormatStack https://formatstack.tech/blog/ Build notes, opinions and practical security writing on developer tooling. en Mon, 21 Sep 2026 00:00:00 GMT Where Developer Data Actually Leaks https://formatstack.tech/blog/where-developer-data-leaks/ https://formatstack.tech/blog/where-developer-data-leaks/ Mon, 21 Sep 2026 00:00:00 GMT Production data rarely escapes through a breach. It escapes through pastebins, online formatters, AI chat windows, screenshots, error trackers and git history. Nine channels, what makes each one invisible, and how to close it. Client-Side Tools Are a Security Decision, Not a Performance One https://formatstack.tech/blog/client-side-is-a-security-decision/ https://formatstack.tech/blog/client-side-is-a-security-decision/ Mon, 21 Sep 2026 00:00:00 GMT Pasting an API response into an online formatter is a data disclosure, not a convenience. How to verify what a tool really does, and the honest limits of the client-side claim. Building a JSONPath Tester That Does One Thing Differently https://formatstack.tech/blog/building-a-jsonpath-tester/ https://formatstack.tech/blog/building-a-jsonpath-tester/ Mon, 21 Sep 2026 00:00:00 GMT Why every result carries the path it was found at, why the filters refuse to coerce types, and the recursive-descent bug that took longer to find than the parser took to write.