Nice project! There's a number of government and quasi-government agencies that I wish had end user accessible APIS.
AES encrypted responses from Amtrak's API all encrypted with the same constant hard coded IV:
https://github.com/pieromqwerty/amtrak/blob/master/src/amtra...
https://github.com/pieromqwerty/amtrak/blob/e0bc815f7ff73484...
What a waste of time and tax payer money. Might as well just make the API public and add some CORS headers. Or require an API key and have the website dynamically generate them internally with a short expiration.
The encryption dance being performed here is all theater and the acting sucks.
