I audited an AI-written billing service this week. 22 findings, 10 critical.
None of them crashed. All returned 200. Four that stuck with me: an auth check that silently lets anyone in when one env var is missing, SQL injection in the one query that wasn't parameterized, a broken permission boundary so anyone can attach a charge to a workspace that isn't theirs, and a Stripe retry that double-grants seats because there's no idempotency check anywhere.
I automated my site's indexing checks this month and hit a wall that surprised me. The Search Console API will inspect URLs, report coverage state and resubmit sitemaps. The separate Indexing API only accepts job postings and livestream pages. The one thing everyone actually wants, the Request Indexing button, has no API at all.
So my daily job does everything the API allows, inspects up to 160 URLs, resubmits the sitemap, then writes a shortlist of URLs stuck in Discovered or Crawled but not indexed. The last step is me clicking Request Indexing by hand off that list.
Has anyone found a legitimate way around this, or is the manual click just the toll Google charges?
It's the end of the month. Your client needs a performance report, so you open five tools, screenshot the numbers, paste them into Google Slides, and spend two hours making it look like you didn't just paste screenshots into Google Slides.
