i audited my side project like it was about to go viral (before it was)

Mon, 29 Dec 2025 00:00:00 +0000

i ended the last post with a promise: a public stats page that ran three full-table scans on every request and fell over the first time i pointed real concurrency at it. this is that post — the last of three findings from the same pre-launch audit of a little pairwise-voting side project, a nougat-ranking toy where you pick between two flavours and a leaderboard falls out.

the first two findings were bugs: an elo race that ate 79% of every vote , and a rate limiter a rotated header walked straight through . this one is a bug too, but it’s really about the method that surfaced it, because the method is the transferable part. the bug — a page doing linear work per request against a table that only grows — is one you’ve almost certainly got somewhere right now and can’t see, for the exact reason i couldn’t: on your dev box the table has forty rows and everything’s instant. the page isn’t slow. the page is a landmine with the pin still in, and the only way to find it before your users do is to go step on it yourself.

so that’s the method. stand up a throwaway postgres, seed it with the amount of data you’d have if the thing actually worked — if it went viral, if the launch landed — and then measure the hot paths under that load instead of guessing. the very first page i pointed it at turned out to be a denial-of-service i was hosting for free, on purpose, with a smile.

performance on krtffl.dev

i audited my side project like it was about to go viral (before it was)