Double Bug Left Paid AI Feature Free and Broken
APEX Versus developer reveals a critical payment flaw where unpaid users bypassed paywalls while paying Pro users couldn't access the feature.
Stock photo for illustration only, not from the actual event
- APEX Versus AI comparison site suffered from two simultaneous bugs in its Deep Analysis feature.
- Server-side validation was missing, allowing anyone to call the advanced API for free without limits.
- Pro paying users could not see the feature button due to a hidden UI bug in the frontend code.
- The developer fixed the issue by enforcing server-side credit deduction and proper authorization.
Param Jaisinghani, the developer behind the AI comparison platform "APEX Versus," shared a sobering post-mortem after running a comprehensive debug pass on his codebase. He discovered that a newly shipped feature had two distinct bugs running simultaneously, and their failure modes ironically masked each other.
The first issue was a completely absent server-side paywall. While the frontend checked user credits before triggering any API calls, the actual API endpoint POST /api/compare performed zero validation. Anyone sending a request with mode set to "advanced" and omitting authentication headers could successfully invoke a Gemini model call and receive full content without logging in, spending credits, or hitting daily limits.
The second bug was the exact opposite: the feature was entirely invisible to customers who actually paid for it. Due to a conditional rendering error in the frontend code, the card containing Deep Analysis was hidden whenever a user was on a paid plan, rendering the "Advanced Analysis" button completely dead code since day one.
This incident highlights a classic architectural pitfall in web development regarding authorization and paywalls. Relying solely on client-side checks—such as hiding buttons or checking local states—provides zero real security because users can easily bypass the UI and hit backend APIs directly. Robust enforcement must always happen at the server level, treating the client interface merely as a convenience rather than a security boundary.
The root cause stemmed from a past update to Firestore security rules meant to prevent client-side credit exploits by restricting writes to the admin SDK. The legacy browser-side credit-writing code was left intact, resulting in silent failures every time a user attempted an action, leaving errors entirely concealed behind empty catches.
Stock photo for illustration only, not from the actual event
Once the bug was diagnosed, the fix involved rebuilding proper backend authorization and credit checks. Testing on a live paid account finally confirmed atomic credit deductions, dropping the balance by exactly two credits for the first time in the feature's operational history.
"A client-side check and a server-side check are not the same feature just because they look at the same variable. One is a suggestion. The other is the only one that counts."
Param Jaisinghani
The developer concluded with advice for anyone managing credit or paywall systems: audit the codebase to see if balance checks would survive someone bypassing the user interface entirely. If the answer relies on the word "should," the rule is not actually enforced.
Source: Dev.to
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment