Silent JS Bugs Skewed Months of Analytics on a Live Product Search Site

·89 views

A developer running OneFindMe, a multilingual AliExpress product search engine, discovered a cluster of long-standing JavaScript bugs only after installing a session-recording tool — despite all automated checks showing green. A flawed HTML-entity escaping method in inline click handlers caused syntax errors for product titles containing apostrophes, silently breaking favourite, share, and analytics tracking on roughly a third of every results page. Because the underlying product links remained intact, no sales were directly lost, but click-through rate data collected over months was systematically undercounted, corrupting product decisions made on that data. A second bug referenced a renamed CSS class that no longer existed, rendering two buttons completely inert, a fact only made visible when session recordings showed a user clicking the same dead button five times in 26 seconds before abandoning the session. The incident highlights that passing automated checks does not confirm a working user experience, and that client-side errors which leave no server-side trace can only be reliably caught through direct page observation.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

L3Harris Issues Statement on November 13 Ground Stop

L3Harris has published a press release addressing the ground stop that occurred on November 13. The company's newsroom posting provides its official response to the incident. The article text available is limited to the link and metadata, so specific details about the cause and impact of the stop are not included. Readers are directed to the original L3Harris statement for the company's full account.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Method for diffing large 834 enrollment files without crashing Excel

Working with enrollment files that run to hundreds of megabytes can freeze Notepad++ or cause Excel to truncate data, which makes routine month-over-month comparisons hard. The article proposes a member-level approach: split each file into member records at INS segments, build a stable key per member, and store a hash and file offset for each. Streaming the new file against that index classifies members as added, unchanged, changed, or possibly termed while keeping memory tied to member count rather than file size. It also warns that full and change 834 files must be treated differently, since an absent member means termination in one but not the other. A small free command-line tool, x12diff, is presented as an implementation that detects the file type from BGN08.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Cursor AI can receive your workspace folder path before any tool runs

A new Cursor chat can be given the absolute path of the opened workspace folder, even before the agent opens any file. Parent directory names may reveal details such as a local account name, a client relationship, or business activity. Cursor staff confirmed this in a November 12, 2026 forum reply, noting that project-specific directories under the user's home folder can also enter context. Knowing a location does not grant permission to read it, and .cursorignore only controls indexing rather than acting as a data-loss-prevention control. The article advises checking what a fresh chat reveals, reviewing the chat context, and renaming or relocating folders whose names leak sensitive details.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

OpenID4VCI 1.0 Final Errata, 1.1 Draft and Server-to-Server Specs Diverge in Late 2026

An analysis of the OpenID4VCI credential issuance standard finds that the approved 1.0 Final text leaves gaps: a Wallet receives the same invalid_grant error for a wrong PIN and an expired Pre-Authorized Code, and the text sets no limit on PIN guesses. Fixes have since appeared in separate documents, including a 1.0 errata set, a 1.1 editor's draft, and a server-to-server draft merged in August 2026, so implementers may follow different texts. The author checked the specification against its repository at a commit dated 27 October 2026 and reviewed the cited pull requests on 15 November 2026. The article also walks through the protocol's roles, endpoints and pre-authorized code flow, including the credential offer format and the token request.

0 comments Read more at DEV Community