Devlog 4 - StudyBuddy

no new features today. just went hunting for stuff that was quietly broken, and
there was way more of it than i expected

the sign-in page could send u to a different website

• if someone handed u a link like /signin?next=someothersite.com, u would log
  in and then land on their page
• immediately after typing ur password, which is about the worst possible moment
  for that to happen
• this one went first

there was no limit on login attempts

• i had limits on signing up and on uploading. somehow not on the actual
  password box
• so u could sit there and guess forever
• getting blocked now looks identical to just getting the password wrong.
  telling someone “too many attempts” quietly confirms the account exists

file storage was writing into the void

• if one setting went missing it silently saved ur page images somewhere that
  doesnt survive on the server
• uploads said they worked. returned a success. images just gone
• nothing errored anywhere, which is why it sat there so long
• now it refuses to start up at all instead of pretending everything is fine

i almost broke my whole test suite fixing something unrelated

• locked down two internal-only routes with what seemed like the obvious check
• except my tests run against a production build, so that check wouldve locked
  the tests out too
• caught it before it shipped, then wrote a test explaining it so future me
  doesnt helpfully undo it

added security headers and instantly caught myself

• put them in report-only mode first so nothing could actually break
• about 40 seconds later it flagged a script that my own analytics loads
• the strict version wouldve blocked it in prod. i absolutely wouldve shipped
  that

one fix i deleted instead of shipping

• had a note to add another check to the duplicate-question detector
• actually tested it against real papers first, and it turns out it can never
  trigger. the answers on a maths paper are just “4” and “9” and stuff, way too
  short for it to match on
• wouldve quietly made things worse

all tests green at the end of it. onto the next pile