Shopify
The Product With Eleven Options and Only One Hundred Variants
Three options with six values each is two hundred and sixteen combinations, and the platform's limit is one hundred variants.
Latest
Security
The Request Body That Set is_admin to True
The update endpoint copied the whole request body onto the model, and the body is written by the client. One extra field in the JSON, and the client had set…
Performance
Event Loop Lag Is the Metric Nobody Alerts On
CPU at forty percent, memory fine, and requests timing out. The Node process is not busy, it is blocked, and the only metric that shows the difference is…
DevOps
A Backup You Have Never Restored Is a Rumour
The backup completed every night and the restore failed in the first hour of the drill. A backup is a claim about the future restore, and claims that are…
Tooling
You Are Recording the DevTools Performance Profile Wrong
A profile recorded with a warm cache, no throttling and a mid session state measures none of the conditions your users meet, and the optimisation built on…
Code Review
Reviewing Pagination Before Someone Requests a Million Rows
Offset pagination that scans, an unbounded page size, and a cursor that drifts when rows insert. The pagination diff looks like plumbing and contains the…
Opinion
Blameless Postmortems Went Too Far in the Other Direction
Removing blame from incident reviews also removed accountability, and now the same decision recurs quarterly with a new author.
Deep Dive
0.1 Plus 0.2 Is Not 0.3, and Your Checkout Noticed
Currency stored as a float accumulates fractions of a cent that are invisible per transaction and visible in the reconciliation.
Bug Hunt
Everything Broke the Day We Doubled the Instance Count
Scaling out doubled the instances and, invisibly, doubled the connection pool, past the database's limit. The database was the bottleneck the day the team…
Error Autopsy
ERR_TOO_MANY_REDIRECTS Only on the Login Page
The login page redirected forever, and only over plaintext HTTP. The session cookie was created with the Secure flag, so the browser never stored it, the…
Shopify
Storefront API 429s on a Store With Almost No Traffic
The headless store made a handful of requests per minute and still hit throttling, because the Storefront API throttles by computed cost, not by request…
Security
Validating Uploads by File Extension Is Not Validation
The allowlist checked the extension, and the extension is the one field the attacker writes. A renamed payload sails through, and if the upload is served…