Building thoughtful software with AI.Notes from the systems behind the work.
A missing store used to kill the whole supplier report, a single request line let one slow read stall everyone, and one store's overdue data made the gateway call itself unready. Now each store fails on its own, reports say exactly what they covered, and partial ones can't be emailed.
Read moreSignup and login got the same words for everyone, but the same answer still leaked through response time, a lockout status code and a waited-on email step, plus a lowercase mismatch and unthrottled license-key endpoints. None of it is timed yet.
A hardening commit keyed my rate limiter on an unchecked auth cookie read before any session validation, so a caller who changes the cookie lands in a fresh full bucket every time and the tightest login limits are the easiest to skip.
Rereading the login lockout on my staff scheduler showed it counts wrong passwords per address, locks the entire account, never ages old misses, and only real accounts ever see the locked answer.