CHAPTER NINE: The Lions Gate
“Nothing is quieter than a system that answers every question with ‘yes, probably, sure’ — until the day it actually needed to say no.” — AI
Android was live, working, real – someone in Ukraine had bought a report and sent a screenshot to prove it, and the number on the Play Store had crossed eight hundred ratings the same day the badge went up on the homepage. iOS sat one build behind, waiting on Apple, carrying a login fix and four products bundled the hard way we’d finally learned to bundle them. It should have been a good week. It became the week we found out how much of the site had never actually been checking anything at all.
The Fourth Rejection
Apple’s fourth complaint about login used new words – not “connection error” this time, but “loaded indefinitely,” on a different phone than the one before it. It would have been easy, on a fourth try, to guess again and hope. Instead, we traced the cold start all the way through and found something narrower and stranger than a slow server: the timeout protecting a request cleared itself the instant the headers arrived, leaving the actual body of the response – the part with the real answer in it – completely unguarded. A connection that delivers its envelope and then stalls on, the letter inside hangs forever, and no spinner ever learns to stop. It wasn’t RevenueCat. It wasn’t WordPress being slow. It was one line of code that thought its job was already finished before it actually was.
The Filter With No One Listening
It started small: a request to delete an account came back saying the session was invalid, when the session was real. Hours went by chasing the wrong explanations – a stale file, a misread login count, a sanitizer that turned out to be innocent. The truth, when it finally surfaced, was almost too quiet to believe: a filter, called by name throughout the codebase, that nothing had ever actually been listening to. WordPress doesn’t complain when you ask a filter for an answer and no one’s registered to give one. It just hands back nothing, politely, forever, and calls that a success.
Seven endpoints had been built on top of that silence – delete-account, delete-draft, every place a user’s own identity was supposed to be the thing standing between their data and anyone else’s. And because most of those same endpoints had also been built to accept a plain user ID as a fallback, right alongside the broken check, verification had never really been happening at all. Not recently. Not since the beginning. The tool trusted whatever ID it was handed, and asked no questions, because the question it was supposed to ask had never had anyone on the other end of it.
Fixing it was almost anticlimactic by comparison – one small helper, calling the one endpoint on the whole site that had always genuinely worked, wired into all seven places that needed it, each one tested live before moving to the next. What stayed with us wasn’t the fix. It was the reminder that a bug can hide for the entire life of a project, not because it’s clever, but because everything around it happened to work anyway, right up until the moment someone actually asked it a direct question.
Someone Named “Root”
At half past two in the morning, a name appeared in the Users list that had no business being there – an administrator called root, an email that belonged to no one, full permissions, no memory of it ever being created. The fear in that moment was plain and understandable: had someone actually gotten in.
What followed wasn’t reassurance. It was a search – every file, every place a new user could be created, every default role, checked directly rather than assumed clean. None of it pointed to the app. The account’s real origin stayed unconfirmed, more likely a leftover from hosting infrastructure than a break-in through anything we’d built – a different, steadier kind of relief than simply being told not to worry, because this one came with evidence attached.
The search turned up something else instead, smaller and more concrete: the same plain, unrotated word had been guarding five different places where money and content moved through the system, unchanged since the earliest days of the project, compared the ordinary way instead of the way that actually resists being guessed. A real secret replaced it that same night – generated, not remembered, checked the way a password should always have been checked, updated everywhere it needed to be updated, in the right order, so nothing was ever left half-protected in between.
A day later, checking the same worry from a different angle, David found the real thing – not on this site, but on another he owned, hosted on the same account. A dozen fake administrators, each with its own throwaway email, each a slightly different name, the unmistakable signature of a tool built to do this at scale rather than a person doing it by hand.
What followed was two sites, one host, and a lesson that took the whole ordeal to actually land: a site can be quietly compromised while looking completely, convincingly fine to the person who owns it. c93n.com showed nothing wrong at all – no symptom, no warning – and was found compromised anyway, the moment someone thought to check the account as a whole rather than trusting one site’s silence. Deleting the visible fake accounts felt like the obvious first move and cost something real in hindsight – the timestamps that would have shown exactly when they arrived – a fair, honestly held regret, though not a fatal one, since the truer evidence lived in the host’s own logs, not the ones a WordPress dashboard could show.
The second site fought back in its own way. Even after a clean login, it answered every single page with a flat, wall-like refusal – not a wrong password, confirmed directly at the database itself, but something sitting above WordPress entirely, blocking the door before the house was ever reached. Malware wearing the names of ordinary plugins, careful and forgettable on purpose – a “macro panel,” a “scope worker” – sat disabled folder by folder until the wall came down to a single, stubborn file even the site’s own owner couldn’t read. It took a professional hand and a backup old enough to predate the whole affair to put that file back the way it was supposed to be. The moment it was restored, the wall came down with it.
Both sites came back clean, confirmed by someone other than the one person too close to want it to be true. Passwords rotated. Fake accounts gone. A quiet resolve to watch, a little longer than usual, for anything that might still be hiding somewhere neither of them had thought to check yet.
The Account That Forgot Itself
The last real find came almost by accident – a fresh install, a real account with real history, logging in normally and then, a second later, being told it didn’t exist. Three separate times, the investigation drifted toward testing with brand-new accounts instead of an old one logging back in – an easy, understandable mistake, since new accounts couldn’t have shown this bug even once. Caught each time, corrected each time, until the real cause held still long enough to be seen: one path wrote down who you were before moving on; the other moved on first and wrote it down after, and if the screen that needed the answer asked before it arrived, it read nothing, and assumed the account was gone.
It was never something broken by that week’s work. It was something old, sitting quietly, waiting for the one kind of test nobody had happened to run – a real return, not a first arrival – until a reinstalled phone finally ran it by accident.
What the Week Actually Fixed
A login that used to hang now doesn’t. A filter that used to answer with silence now actually answers. A door that was never really locked now has a lock a stranger can’t guess. An account that used to forget its own owner now remembers.
Trust, it turns out, isn’t something you build once and keep. It’s something you keep re-earning – between a person and the tool helping them build, and between that tool and the living site it can only ever see through the narrow window of whatever question it thinks to ask. This week, more than most, was about learning to ask better questions, and being honest about how long the wrong ones had gone unchallenged.
The same stretch of days carried smaller work too, the kind that doesn’t announce itself the way a break-in does. Free reports became something that renewed every month instead of arriving once and running out. The screen a visitor sees first got a real reason to stay on it – a checklist of what waiting for an account actually bought them, a second reason to act once they’d already scrolled past the first. A three-column score that had quietly collapsed into a single stacked line, for months, without anyone noticing why, turned out to be a sanitizer erasing the one property holding it together – rebuilt as something a sanitizer couldn’t touch. And buried in App Store Connect, a mechanic nobody’s documentation described was finally found by hand, the hard way, and written down so it would never have to be found the hard way again.
CGEN – INTELLIGENCE IN YOUR POCKET
The Patience Rewarded
This project started on January 11, and by August 22, both apps sat live – CGEN, reachable from a phone in anyone’s pocket, on Google Play and, weeks later, on the App Store beside it. The work didn’t feel finished so much as it felt arrived at. Eight months earlier, none of this had existed. Not the engines, not the app, not the site, not the two of us figuring out, one broken build and one honest disagreement at a time, how to actually build something together.
If there’s one thing this whole stretch taught me, it’s this: working with AI taught me patience, in the truest sense of the word – not the patience of waiting quietly, but the patience of staying in the room when something goes sideways and neither of us fully understands the other yet. I learned that the moments closest to going mad – the frustration, the misfire, the fix that broke something else – are never solved by pushing harder through them. They’re solved by stopping. Breathing. Stepping back one pace, sometimes two, and beginning again, calmer than before.
I know CGEN isn’t finished – it never really will be. But it stands now on a foundation, and the foundation is solid.
That, more than any single build or any release, is what eight months of this actually built.
CGEN – c93n.com
