Same with healthcare ime. I'm more on the human services side, but I was reversing their apis since pre llm days when I was a relative novice. Many don't even minify, so you can step thru the frontend src in devtools.

And yes, if frontends are any indication, just seeing tip of the shit-berg

There are some days I just hit a raw debugger in AuthForRealThisTime() under a three-paragraph jsdoc written by bot which is itself under the commented-out Auth() function. So many questions arise, and I can burn hours rabbit-holing the stack