Engineering Deep Dives: Code Refactoring & Bug Hunt Case Studies
In-depth engineering teardowns of broken AI codebases, cloud bill spikes, race condition bugs, payment bypasses, and UI/UX conversion leaks. Click any case study below to read full line-by-line postmortems.
The $18,000 Cloud Bill API Bug: Halting an Infinite Recursion Loop
How a silent infinite recursion loop in an AI-generated serverless function spawned 4.2 million un-cached database queries in 72 hours, triggering an unexpected $18,400 bill spike on AWS & Supabase.
The Ghost Inventory Bug: How a Race Condition Double-Booked 120 Users
An engineering teardown of how non-atomic Read-then-Write database logic allowed two concurrent users to claim the exact same seat within a 5-millisecond window while returning 200 OK.
Rescuing an AI-Built MVP (Cursor & v0) from 14,000 Lines of Spaghetti Code
How we rescued a solo founder’s SaaS product built entirely with AI tools that was crashing for 4 out of 10 users, refactored the monolith, and scaled it to 25,000 users.
How a Figma UX Audit & Redesign Boosted Conversion by 240%
How we audited a high-ad-spend B2B SaaS landing page leaking $32,000/month, eliminated 5 conversion friction traps, and scaled trial signups by 240% in 5 business days.
The $45,000 Stripe Webhook Bypass Bug: Fixing Unverified Signatures & Free Pro Account Exploits
An engineering teardown of how an unverified Stripe webhook endpoint and missing idempotency locks allowed malicious users to trigger fake payment completion payloads, granting unauthorized lifetime Pro plan access.
Plugging the Multi-Tenant Leak: Enforcing PostgreSQL RLS to Prevent Cross-Account Data Access
How a missing tenant_id filter in a Supabase/Postgres SaaS allowed Company A users to manipulate API URLs (IDOR Vulnerability) to inspect Company B’s confidential invoices, and how we enforced database-level PostgreSQL Row Level Security (RLS).
The 'SOC 2 Compliant' Breach: How an SSRF-to-IMDS Pivot Bypassed WAFs and Emptied Tenant Secrets in 4 Minutes
A surgical teardown of how an adversary bypassed a $150k/yr enterprise WAF using an IPv6 dual-stack SSRF differential, extracted AWS IMDSv2 credentials, and forged admin JWTs in 252 seconds — and how eBPF kernel enforcement saved 420,000 accounts.
Get a Deep Bug Hunting & Concurrency Audit
Book a 10-minute engineering triage call. Our senior leads trace silent memory leaks, payment webhook drops, and API security vulnerabilities under strict NDA.