# my-api findings

Findings accumulated over time. Captured automatically during sessions and committed on exit.

<!-- Example entry:
## 2026-03-04
- The auth middleware runs before rate limiting: order matters in middleware stack
- `npm run dev` needs PORT set or it defaults to 3001, not 3000
-->
