-
One Stripe webhook needed two different idempotencies
Stripe promises at-least-once delivery and no order. A plan change survives both with a per-account watermark, because it is an absolute assignment. A credit grant is a delta, the watermark cannot see its replay at all, and the fix is a PRIMARY KEY on the Checkout Session id. Plus the boleto lesson: "checkout completed" is not "paid".
-
The four questions inside "validate this signature"
"Validate this signature" is four different questions wearing one phrase. Two are answered from the bytes alone: coverage since 1.0, the digest since 1.15.0, with a hand-written DER reader that refuses more than it parses. The two that need a network and a clock are declined, and the corpus said the declined half is not where real documents live anyway.
-
Every guardrail I checked reads a PDF as a string
Seven prompt-injection guardrails' docs, read on 2026-08-03 and re-read on 2026-08-25. Six accept only strings, and the seventh accepts the file but documents text screening. Extraction deletes the render mode, fill colour and glyph geometry that separate a visible sentence from a concealed one, and published benchmarks put text-only detectors at F1 0.125 to 0.390 on document-borne injection. What the file layer covers here, and the measured reason its flagship signal is not shipped: an undiscriminating concealed-text detector fires on 10.6% of 633 authentic PDFs.
-
ModDate ≠ CreationDate is not evidence
The first advice for "how to tell if a PDF was edited" says to compare the file's two date fields. Measured against honest populations, the inference collapses: 48 of 190 bank PDFs published by the banks themselves carry more than one revision, one of them 24, and when two of this engine's own signals made the equivalent leap, 83.4% and 88.6% of their firings landed on files written exactly once. The four date checks that survive measurement, and where the evidence of editing actually lives.
-
The report your agent reads is part of the attack surface
The MCP server returns report text straight into a model's context, so a family that quoted what it found would deliver the injection with a trusted label on it. The echo-back contract, the two leaks later reviews still found, and why the registry listing is hygiene rather than a growth bet.
-
Triage expands 9% of the bytes, and the URL fetch stays on your machine
Two releases for one caller, an agent deciding whether an untrusted document is worth ingesting. The cheap scope reproduces every structural family count-for-count at 9.18% of the decompression, and the MCP URL fetch ships with the SSRF guard an adversarial review proved it needed.
-
The revision chain stops being a total
The engine has known what every revision of a PDF wrote since 1.20.0, and published only the sum. Engine 1.32.0 reports it per revision, because the sum failed two families in two different ways, and writing the test caught me double-counting page images.
-
Three ideas from pdfid, measured on 5,168 documents first
I took three detection ideas from Didier Stevens's keyword scanner and ran each through a false-positive measurement before assigning any severity. Two shipped. The third was killed by its own population: zero documents mention it.
-
A C2PA signature survives a PDF, and c2patool can’t see it
Anthropic started attaching C2PA credentials to generated .svg, .png and .jpg on 11 August. I put a signed image through nine PDF generators on my laptop: the JPEG credential survived 6 of 6 byte-identically, PNG and SVG survived none, and the official reader calls every one of those PDFs unsigned.
-
Inscribe says AI is under 5% of document fraud, AppZen 70.8%. Both are right.
One counted every fraudulent document a lending pipeline flagged; the other counted flagged fraudulent expense receipts. Two true numbers, and the denominators are the whole distance between them.
-
I measured my own false-positive rate on 1,728 documents nobody curated
Every corpus I had was one I picked. Two random populations put the engine’s not-low rate at 68.5% and 82.8%, and showed four signal families arguing with the parser standing next to them.
-
The black box in your PDF is a shape, not a delete key
Two ways to black out a name look identical on screen and are entirely different files. Here is how to tell which one you have.
-
Every court filing is structurally a modified document
I ran 360 US public documents through the engine to find its noise floor. The id-inconsistency signal fired on 240 of 255 court filings, because the filing system itself rewrites every document that passes through it.
-
What 190 published US bank PDFs actually look like inside
I downloaded 213 PDFs from 24 US banks to see whether an issuer leaves a structural fingerprint. Across 17 eligible profiles, zero agreed on the producer.
-
Everything Tamperlens detects, and exactly what defeats each one
A row for every signal family and a column for every evasion, measured on a bench, including the six cells this post first got wrong.