Repository navigation
Docs: how we check our own paid endpoints, including what the check missed - #84
Merged
Merged
Conversation
…issed Four defects on our own paid routes in one day, none of which a heartbeat check would have caught, and the scheduled job that came out of it. Includes the part that is usually left out: three adversarial reviews of the checker itself found four defects in it, the sharpest being that we validated the price and payee on a different request than the one that pays. A limit checked on an earlier request is not a limit. Also states the coverage honestly. The job checks two of eleven paid routes, and probing the other nine by hand for this document surfaced a tenth issue we have not fixed yet: one route answers 400 with no payment requirements when the request body is missing, so a buyer cannot discover the price.
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
tokenizen | 86508bb | Commit Preview URL Branch Preview URL |
Oct 18 2026, 04:34 PM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
tokenizen-website | 86508bb | Commit Preview URL Branch Preview URL |
Oct 18 2026, 04:35 PM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A paid endpoint does not usually fall over. It keeps answering 200 and returns something quietly wrong, and uptime monitoring catches none of that.
On 18 October we found four of those on our own routes in a single day. This document explains the failure mode, the three axes the scheduled job keeps apart, and the security shape of running an automated buyer that holds a signing key.
Two sections are there because leaving them out would make the document dishonest:
What three adversarial reviews found in the checker itself. Four real defects, including an exit code that could not fire, a check with no recipient, and the one that mattered most: the price and payee were validated on the checker's own unpaid request while payment happens in a separate process that selects from a filtered list. Those are different entries as soon as the first is filtered out, and one of our routes already returns two offers.
What the job does not cover. It checks two of our eleven paid routes. Probing the other nine by hand while writing this surfaced one more issue, which is not fixed: a POST with no body to the site check route returns 400 with no payment requirements, so an automated buyer cannot discover the price.
No code changes. Documentation only.