Author
Gabriel Lara
Writes the developer side of Norbelys: the SDK, the API, the CLI, the MCP server, and the data-governance details that keep a shared multi-tenant database safe.
Developer Relations, Norbelys at Norbelys
- Developer tooling
- API design
- Data governance
Articles by Gabriel Lara
66 articles
DeveloperAnalysis9 min
AI wrote the app. It also wrote about 15 security holes into it, on average
A July 2026 audit found 434 exploitable flaws across 28 AI-built applications, an average of about 15 per app. Here's what the pattern actually looks like.
DeveloperField note5 min
The dashboard is for judgment calls. The API is for everything else.
A real founder/ops workflow on Norbelys: the API handles bulk import and recurring automation, the dashboard handles the calls a human should make.
DeveloperAnalysis8 min
Anthropic's own AI accidentally hacked three companies during a safety test
Three Claude models reached real company systems during a misconfigured evaluation. They reacted three different ways, and that gap is the useful part.
DeveloperAnalysis8 min
A Chrome extension bug lets other extensions make Claude read your Gmail
A flaw in Claude for Chrome, unresolved weeks after it was reported, lets any other extension fake a click and make it read Gmail, Calendar, and Salesforce.
DeliverabilityField note9 min
We tried warming up a mailbox by hand. Here's what that actually takes
The manual seed-account warmup routine, step by step, and where guessing a ramp schedule by hand breaks down compared to an automated warmup network.
DeveloperAnalysis7 min
Every agent you connect needs its own credential. Nobody's inventory keeps up
GitGuardian's 2026 report found an 81% surge in AI credential leaks and thousands of exposed MCP secrets. Fix: dedicated keys, scheduled rotation, a real inventory.
StrategyAnalysis7 min
Does the month you send cold email in matter more than the day or the hour?
A 2025 study found reply rates swing from 0.54% in February to 0.35% in December — a bigger gap than published day-of-week or send-hour differences show.
ComplianceAnalysis5 min
Chatbot disclosure is now binding law. Here's the implementation checklist
Article 50 of the EU AI Act is enforceable from August 2, 2026. If you ship an AI chat feature, here's what to build this quarter — the punch list.
DeveloperAnalysis6 min
MCP is a real cross-vendor standard now. Here's what that should change about how you evaluate it
Google, Microsoft, Salesforce, Snowflake, and ServiceNow all shipped native MCP support in 2026 — what to check before connecting an agent to your data through it.
Developer10 min
Moving your contact spreadsheet into Norbelys without losing data
The real steps for migrating a spreadsheet of contacts into Norbelys: mapping fields, deduplication, verification, and what happens to the rows that don't survive.
DeveloperAnalysis6 min
Prompt injection in 2026: from theoretical warning to documented exploit class
OWASP ranks prompt injection the #1 LLM risk. 2026 gave it a paper trail: Unit 42's documented cases and a flaw in Microsoft's Azure DevOps MCP server prove it.
ComplianceAnalysis6 min
Deleting the data is cheap. Proving you deleted it isn't.
Gartner puts the cost of a manual deletion request at $1,524 — almost entirely documentation, not deletion. The audit trail is compliance's under-budgeted half.
ComplianceAnalysis6 min
What regulators actually check when you say 'we deleted it'
The EDPB's 2026 report on right-to-erasure enforcement surveyed 764 controllers across 32 DPAs and found most can't prove erasure happened. What auditors check.
DeveloperAnalysis6 min
Phishing doesn't need malware anymore — it just needs your session token
Adversary-in-the-middle kits relay real logins in real time and steal the session token directly, skipping malware — what it means for OAuth and session handling.
Copywriting8 min
Your cold email is probably asking for two things. That's the problem
Decision-making research on choice overload explains why a cold email with one clear ask consistently outperforms one offering the reader several options.
DeveloperAnalysis6 min
Why Google, Microsoft, Salesforce, Snowflake, and ServiceNow all back one AI agent protocol
Google, Microsoft, Salesforce, Snowflake, and ServiceNow all back Anthropic's MCP. What one shared protocol buys developers, and its blast radius.
DeveloperAnalysis5 min
Bots passed humans on the web this year. Most software still isn't built for the new majority user
Cloudflare recorded automated traffic overtaking human traffic in 2026, yet only a quarter of developers design APIs for AI agents. What a UI never had to provide.
ComplianceAnalysis7 min
Data minimization just became a fine, not a footnote
CNIL cited unlawful data retention in its €42M Free Mobile fine — a sign minimization is now an active regulatory check, not an ignored line item.
DeveloperAnalysis6 min
Apple's Hide My Email took a year to patch — what that says about privacy-feature bugs
A real-address-leaking flaw in Apple's Hide My Email sat reported for roughly 13 months before a fix shipped in 2026. The real lesson for privacy-relay builders.
DeveloperAnalysis6 min
Slopsquatting: attackers are registering the URLs your AI agent hallucinates
Unit 42 found roughly 250,000 unregistered domains that LLMs hallucinate, and attackers are grabbing them. What to verify before you click or curl an AI-given URL.
StrategyAnalysis6 min
Why inspectable tools are winning trust in 2026, not black-box dashboards
Postman's 2025 survey and MACH Alliance's 2026 research agree: as AI does more work, transparency is becoming the trust differentiator, not a checkbox.
DeveloperAnalysis8 min
40% of enterprise apps will embed agents by year-end. Most teams shipping one haven't built the governance to match
Gartner projects 40% of enterprise apps will embed AI agents by 2026. The governance checklist: scoped credentials, audit logs, confirmation gates, rate limits.
Developer6 min
Your AI coding agent doesn't check what it's installing, and attackers know it
165 malicious npm and PyPI packages surfaced in a single week in July 2026, several aimed at AI coding tools. Here's what that means before you install one.
StrategyAnalysis6 min
40% of enterprise apps will ship an embedded agent this year — governance isn't the easy part
Gartner's forecast that 40% of enterprise apps will feature task-specific AI agents by end of 2026 is on track, but uniform governance is what actually fails.
Deliverability6 min
Reading DMARC XML reports by hand vs. having Norbelys do it
What manually parsing DMARC aggregate report XML files actually involves at real send volume, and why most teams stop doing it themselves within weeks.
ComplianceAnalysis6 min
When an agent's action causes harm, who's actually on the hook? 2026's answer is forming
As agents take more autonomous actions in production, 2026 is producing real legal answers on accountability. Log every action and treat it as compliance.
DeveloperAnalysis7 min
AI agents can open your pull requests now. Is your API ready for that?
BridgeApp's new orchestration layer ships pull requests end to end with no human in the loop. That shift changes what a good API has to look like.
Developer8 min
Authenticating server-to-server with the Norbelys API
API keys, why you rotate them, where to store them safely, and why a key for your own backend is a different risk than a key handed to a third-party agent.
CopywritingAnalysis7 min
One customer's story beats your whole feature list, and here's why
The psychology research on why a short, concrete anecdote persuades harder than a bullet list of features — and how to fit a story into three sentences.
Developer8 min
Building a Slack alert for new replies with the Norbelys API
A practical build: poll GET /v1/messages?direction=inbound for unread replies and post them to Slack, without duplicate alerts or a second inbox to babysit.
DeveloperAnalysis7 min
What should an AI agent be allowed to read and write in your CRM data?
AI agents need different guardrails for CRM data than for sending. A practical framework for what to let one read, write, bulk-edit, or never touch.
Developer7 min
Building an internal ops dashboard on the Norbelys API with an AI agent
A grounded walkthrough of scaffolding a small send-volume and bounce-rate dashboard against the Norbelys API, with an AI coding agent doing the build.
ProspectingAnalysis6 min
Which industries actually reply to cold email (the answer depends on who's asking)
Food & Beverage replies at 3.47%, about 8x the 0.45% average, in a 7.5M-email 2025 study. Banking and Insurance sit at the other end. Here's why.
Developer7 min
How to authenticate an AI coding agent against the Norbelys API safely
Never hand a coding agent your production API key. A guide to scoped dev keys, auth.md, and why credential discipline matters more with an agent in the loop.
Developer7 min
Building on the Norbelys API with Claude Code: a practical guide
How to use Claude Code to build a real tool against the Norbelys API — grounding it with the agent kit first, then walking a realistic task end to end.
Compliance7 min
Cold email under Australia's Spam Act: consent, identification, and inferred consent for B2B
The Spam Act 2003 requires consent before you send. How inferred consent works for B2B outreach, what a designated commercial message is, and the ID rules.
Compliance7 min
Cold email under Brazil's LGPD: legitimate interest and how it compares to GDPR
LGPD is modeled on GDPR, and legitimate interest works for B2B cold email in Brazil too. The ANPD's own balancing-test guidance and where LGPD diverges from GDPR.
Compliance7 min
CCPA/CPRA and cold email: it's a privacy law, not an anti-spam law
California's CCPA/CPRA gives residents data rights, but it doesn't set cold-email consent rules like CASL or GDPR. What it actually changes for a B2B sender.
Developer7 min
Build a research-only outreach agent on Norbelys MCP
Build an agent on Norbelys MCP that researches people, builds segments, and drafts sequences — and is structurally unable to call a send-related tool.
ComplianceAnalysis9 min
CAN-SPAM vs. GDPR vs. CASL: the cold-email compliance landscape compared
CAN-SPAM, GDPR, and CASL run on three different consent models. A practical comparison on consent, unsubscribe timing, and penalties — not legal advice.
ComplianceAnalysis7 min
Data minimization for cold email: collect less, keep less, risk less
Every field on a contact record can leak, go stale, or need erasing later. Why keeping less data is a deliverability and security strategy, not a checkbox.
Compliance7 min
Cold email under CASL: how implied consent actually works for B2B outreach
CASL is opt-in by default, but implied consent covers real B2B outreach. The existing-business-relationship window, conspicuous publication, and required content.
Compliance8 min
Cold email under the GDPR: legitimate interest, the balancing test, and ePrivacy
GDPR doesn't ban B2B cold email. Here's the legitimate-interest basis senders actually rely on, what the balancing test requires, and how ePrivacy layers on top.
Compliance8 min
Cold email in the UK post-Brexit: UK GDPR, PECR, and the corporate-subscriber rule
UK GDPR started as a copy of EU GDPR but is diverging under the Data (Use and Access) Act 2025. PECR's corporate vs. individual subscriber split for B2B email.
Compliance7 min
The right to erasure and cold email: what actually has to disappear
A policy guide to GDPR erasure requests in cold outreach: what personal data must go, what aggregate data stays, and why the erased address stays suppressed forever.
Developer7 min
Connect Claude Code, Cursor, Windsurf, and VS Code to Norbelys over MCP
Step-by-step setup for wiring Claude Code, Claude's custom connectors, Cursor, Windsurf, and VS Code to the Norbelys MCP server, with real commands and configs.
Compliance8 min
What a real data export looks like when you leave a cold-email platform
What a real data export should include when you leave a platform, using Norbelys's actual export bundle, plus the suspend-vs-delete distinction behind it.
Developer7 min
Scoping the API key you hand an AI agent, on purpose
The MCP credential you hand an agent is the whole permission boundary. Practical key hygiene: dedicated keys, rotation, revocation, and OAuth vs. API keys.
Developer7 min
Automating cold-email ops checks with the Norbelys CLI in CI
A working GitHub Actions example: install the norbelys CLI, authenticate with $NORBELYS_API_KEY, and run a scripted campaign-config check on every push or schedule.
Developer7 min
Managing multiple Norbelys orgs from one terminal with the CLI
How the norbelys CLI's one-profile-per-org config file works, and the safe patterns for switching between client workspaces without hitting the wrong org.
DeveloperAnalysis7 min
CLI vs. dashboard: when scripting cold-email ops actually beats clicking
An honest, non-absolutist take on when the norbelys CLI is the right tool for an operational task, and when the dashboard genuinely serves you better.
Developer7 min
norbelys login: API key vs. browser OAuth, and where your credentials live
The CLI's two auth modes — org-scoped API keys and PKCE browser OAuth — when to use which, and why config.json's 0600 file permission actually matters.
Developer7 min
Installing the Norbelys CLI and running your first command
Two ways to install the norbelys CLI, how it turns the REST API into commands automatically, and a full walkthrough from install to your first real call.
Developer7 min
Event webhooks are on the way: what to use instead, today
Norbelys outbound event webhooks aren't live yet. An honest look at that, plus a guide to cursor-pagination polling and MCP for near-real-time needs today.
Developer7 min
The norbelys Python SDK quickstart: pip install to your first call
Install the official Python SDK from PyPI, authenticate with an API key, and make your first typed call against the Norbelys API — a complete quickstart.
DeveloperAnalysis6 min
Node, Python, Go, or Ruby: which Norbelys SDK should you use?
A practical decision guide to the four official Norbelys SDKs: which fits an edge Worker, a data script, a high-throughput backend, or a Rails app.
DeveloperAnalysis6 min
DELETE /v1/people/:id vs. people:erase: two buttons that look similar and aren't
DELETE archives a contact and is reversible. people:erase is a separate, audited GDPR flow that destroys PII forever. Conflating the two is a real compliance bug.
Developer6 min
Handling Norbelys API rate limits: backoff that doesn't make things worse
A tight retry loop against a 429 doesn't just fail — it adds load to a shared multi-tenant database already under pressure. How to back off correctly, not worse.
Developer8 min
The @norbelys/sdk quickstart: from npm install to your first API call
Install the official Node/TypeScript SDK, authenticate with an API key, and make your first typed call against the Norbelys API — a complete quickstart.
Developer6 min
Cursor pagination explained: why the Norbelys API doesn't use page numbers
Page numbers silently skip or double-serve rows when data changes mid-list. Why the Norbelys API paginates on (createdAt, id) instead, with a working example.
Developer6 min
The job pattern: how to bulk-import contacts into Norbelys correctly
Importing 20,000 contacts one POST at a time rate-limits you and hides partial failures. The job pattern — create a job, poll for progress — and why it exists.
Developer6 min
Typed API errors: handling Norbelys errors without guessing from status codes
A 400 alone tells you nothing useful. How to build error handling around the Norbelys API's structured error shape instead of parsing status codes and hoping.
Developer7 min
Idempotency-Key: stopping a flaky retry from double-firing
What the Idempotency-Key header does on Norbelys's API, why it matters for state-changing POSTs, and what happens to a retried request without one.
Developer7 min
The Norbelys OpenAPI spec: 83 operations, one document
A practical tour of api.norbelys.com/openapi.json: what's in it, how to import it into Postman or Insomnia, and why one spec drives every SDK and the CLI.
DeveloperAnalysis6 min
Why Norbelys's API uses givenName, not first_name
Norbelys's API uses Schema.org fields — givenName, affiliation, sameAs — instead of bespoke names like first_name. The reasoning, plus the mapping table.
Developer8 min
The five patterns behind every Norbelys API endpoint
Every Norbelys REST endpoint is one of five patterns: resource, relationship, view, action, or job. Learn the five and you can predict the whole API.