Shopify
The Shopify Webhook Retry That Double Booked the Order
The delivery timed out after the handler had already run, so the platform retried, and the handler, which assumed delivery meant not processed, booked the…
Rohit Bhadani
I write about why software breaks and how people figure it out. Founder of Krova Cloud, building isolated microVMs on our own hypervisor. Years of Shopify theme work and shared hosting before that. If I have not reproduced it, I do not publish it.
Engineering Culture
One Hundred Posts About Things Breaking
What I learned writing a hundred debugging writeups, including which ones people actually read and what that says about technical content.
Security
The Session Cookie Without SameSite That Rode Along Cross Site
A forged form on an attacker's page submitted a request to the real site, and the browser attached the victim's session cookie, because a cookie with no…
DevOps
The Autoscaler That Scaled on a Metric That Lagged the Traffic
The HPA added pods after the spike had passed and removed them after the next one began, because its metric was smoothed, delayed and averaged.
Code Review
Reviewing a useEffect for the Cleanup It Forgot
The listener, the timer and the subscription all outlive the component that created them, and the leak is invisible on the first mount and obvious on the tenth.
Opinion
Meetings Are a Tax on the Maker Schedule
A calendar with a meeting every afternoon does not look expensive, because the cost is invisible: it is the morning deep work that never starts, fragmented…
Bug Hunt
The Debounce That Dropped the Last Keystroke
Fast typists submitted search queries missing their final character, and only fast typists, because the trailing edge timer was cancelled on unmount before…
Error Autopsy
The Cert Rotated at Midnight and the Pool Kept the Old Handshake
The rotation succeeded, the new certificate was valid and live, and half the fleet still failed at the exact minute of rotation.
WooCommerce
The WooCommerce Cache That Served One Customer's Cart to the Next
Two strangers bought different things and received each other's cart fragments, because a page cache keyed on the URL returned a cached, personalised block…
Security
The JSON.parse That Became a Prototype Pollution
The payload was ordinary JSON and the merge was ordinary code, but a __proto__ key in the body wrote to Object.prototype, and every object in the process…
Performance
The Next.js Page That Shipped the Database Client to the Browser
The page weighed two megabytes and the network tab showed a database driver going to the browser. A server only import crossed the boundary through one…
Tooling
Reading a Container Image With docker history
Every layer is a transaction and the ledger never lies. docker history shows the secret you deleted, the cache you paid for and the compiler you shipped…