Developer Finds Silent Multi-Tenant Bug That Unsubscribed Wrong Customers on Bounce

·1 views

A software developer discovered a critical bug in a self-built multi-tenant email service where a bounce webhook handler incorrectly unsubscribed contacts across all tenants sharing the same email address. The flaw existed in the bounce-handling logic, which matched contacts by email address alone without filtering by customer ID, violating multi-tenant data isolation. Because the Contact table intentionally allows the same email to exist under different customers, a single bounce event could silently remove subscribers belonging to unrelated businesses. The bug evaded all automated tests and multiple code review passes, including a dedicated security review, making it particularly difficult to detect. The developer documented the issue as Part 3 of an ongoing series on building a multi-tenant email service using FastAPI and Resend.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Go 1.25 Adds testing/synctest to Eliminate Flaky Concurrent Tests

Go 1.25, released in August 2025, introduces the testing/synctest package to the standard library, offering a reliable way to test time-dependent concurrent code. The package runs tests inside an isolated bubble where a fake clock replaces the real one, advancing only when all goroutines are durably blocked rather than ticking in real time. Previously, developers relied on arbitrary time.Sleep calls to wait for goroutines to finish, a fragile approach that caused tests to pass locally but fail unpredictably on busy CI servers. The new API provides two functions — synctest.Test and synctest.Wait — giving developers explicit control over synchronization without build flags or special configuration. The package was previewed experimentally in Go 1.24 before being finalized and stabilized in Go 1.25.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Developers Can Build a Full Crypto Payment Stack for Cross-Border Digital Sales

Developers serving digital sellers internationally face challenges beyond simple payment buttons, including order activation, payment tracking, reconciliation, and payout management. A complete cross-border crypto payment stack addresses the full operational workflow from checkout to automated digital delivery. The article uses OxaPay as a reference infrastructure, citing its support for invoices, webhooks, static addresses, payout APIs, and automation integrations. Digital sellers such as indie SaaS founders, course creators, and template designers often reach global audiences before building mature payment systems. The developer's role is to abstract blockchain complexity away from merchants, handling edge cases like expired invoices, underpayments, and webhook failures behind a productized layer.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Node.js Event Loop Enables Non-Blocking Async Code on a Single Thread

Node.js handles thousands of simultaneous requests on a single JavaScript thread by delegating long-running operations to libuv, a library that works with the operating system to manage asynchronous tasks. The Event Loop continuously checks whether the Call Stack is empty and, when it is, moves completed callbacks from the queue into the stack for execution. The loop operates in distinct phases — Timers, Pending Callbacks, Poll, Check, and Close Callbacks — each responsible for processing specific types of async work. Execution priority also follows a strict order: current synchronous code runs first, followed by process.nextTick(), then Promise microtasks, and finally timer and setImmediate callbacks. Understanding this sequence helps developers predict async behavior, debug unexpected outputs, and write more efficient Node.js applications.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DEV Community User Asks About Minimum Age Policy for the Platform

An 11-year-old user posted a question on DEV Community asking whether the platform has a minimum age requirement for creating and posting content. The user stated they could not find any relevant information in the platform's Terms of Service. The query highlights a potential gap in DEV.to's publicly communicated age policy. Many online platforms require users to be at least 13 years old, in line with regulations such as the U.S. Children's Online Privacy Protection Act (COPPA). The post has drawn attention to the need for clearer age-related guidelines on the platform.

0 comments Read more at DEV Community