Engineering notes
How BuildAPI works underneath, what we got wrong, and what we changed. Written by the people who broke it.
Security
What we log, and what we deliberately do not
A licensing gateway sees a lot of traffic. Most of it is none of our business.
Security
Domain verification is the product
Typing a domain into a field proves nothing. Proving you control it is the whole mechanism.
Security
Bot traffic is most of your traffic
On a small site with no audience, roughly half of what arrives is automated. Here is what that looks like and what to do.
Security
What an API key actually protects
A key is not a password. Understanding the difference is most of understanding how to secure an integration.