Error Autopsy
The OAuth Login That Broke on the Trailing Slash
The redirect URI was registered without the slash and the app sent it with one, so the provider rejected the match, and every login failed with a generic…
Rohit Bhadani
I write about why software breaks and how people figure it out. Founder of Krova Cloud, building isolated microVMs on our own hypervisor. Years of Shopify theme work and shared hosting before that. If I have not reproduced it, I do not publish it.
Ecommerce
The Shipping Quote That Was Still Yesterday's Price
The carrier rate was cached without a window, so the checkout charged the old price, and the difference was the store's, and the reconciliation found it at…
Security
The Password Reset Token That Landed in the Access Log
The token travelled as a query parameter, so the web server logged it, and the log was shipped to a third party, and the token was valid for an hour, and…
Performance
The Table That Rendered Ten Thousand Rows to Show Twenty
The API returned everything and the client paginated in memory, so the DOM held ten thousand nodes, and the scroll was the layout, and the layout was the…
Tooling
The jq Filter That Found the One Different Field
Two payloads looked identical to the eye and differed in one nested field, and the filter diffed them in one line where the visual comparison had taken an…
Code Review
The Boolean Parameter Nobody Could Read at the Call Site
The call passed true and the reader had no idea what true meant, so the behaviour was guessed, and the guess was wrong in the one branch that mattered, and…
Opinion
The Runbook Nobody Reads at Three in the Morning
The document is thorough and long and correct, and the person on call at three in the morning needs three commands and one decision, and the gap between the…
Deep Dive
What an Index Actually Does, and the Query It Cannot Help
The index was built and the query still scanned the table, because the predicate wrapped the column in a function, and the wrapped column is not the value…
Bug Hunt
The Zip Code That Lost Its Leading Zero
The field was parsed as a number on import, so the codes starting with zero lost a digit, and the shipping lookup failed for a whole region, and the failure…
Error Autopsy
The Webhook Signature Nobody Verified
The endpoint was public and trusted the body, so a crafted request marked an order as paid, and the fulfilment ran, and the signature header had been…
Ecommerce
The Abandoned Cart Email That Fired Too Soon
The trigger was a timer from the add-to-cart event, so the reminder arrived mid-checkout with a discount, and the discount became the expected price, and…
Security
The Dangling CNAME That Let a Stranger Serve Your Subdomain
The staging bucket was deleted and the DNS record stayed, so anyone could claim the same name and serve content from a hostname on your domain, and the…