Developer explains how a deliberately delayed public data page nearly leaked paid content
A developer selling a live data stream built a public page showing the same day's figures with a deliberate time delay, positioned between a free historical archive and a paid real-time feed. The design rule adopted was that the free page introduces no new category of data — every field shown is already available for free the next morning, with timing being the only thing that is metered. Two security bugs emerged only in production, including a path-normalisation flaw where alternate URL spellings like double slashes or different letter cases bypassed access controls and resolved directly to the protected file. To prevent the delay from shrinking to zero during pipeline stalls, the developer measured lag against the data itself rather than the system clock, ensuring failures make the page older rather than fresher. The trim logic was written as a pure function with its own test suite before being wired into any route, keeping the paid file accessible through exactly one controlled code path.
