Field notes
Thinking, made visible.
Practical notes on scoping, designing, building, and running software from the team doing the work.
Archive
Notes from the work.
Fixing our rate limiter's memory leak almost created a way to bypass it
The original limiter was a denial-of-service vector against itself. The obvious fix handed attackers a fresh quota on demand. The difference between the two correct-looking versions is which end of a Map you delete from.
The redirect we did not add, and the loop it would have caused
Next.js matches redirect sources case-insensitively. A rule for the old site's /Insights would have caught the real /insights route and sent it to itself. Technical SEO is mostly engineering decisions like this one.
Mail scanners were confirming newsletter subscriptions nobody clicked
Our double opt-in confirmation mutated state on GET. Every corporate link-scanner and inbox prefetcher that followed the link subscribed the recipient automatically, which is precisely the consent the second step exists to collect.
Our bot honeypot told every bot exactly where the trap was
A one-character validation rule made the silent-success branch unreachable and returned a field error naming the hidden field. The trap worked perfectly, in reverse.