Open Season on My Side Project: I Invited the Internet to Wreck It

Most side projects die from neglect. Mine almost died from an open invitation.

Two weekends ago I did something I'd been talking about for months: I posted a link on a few Discord servers, a couple of subreddits, and my personal site that basically said, "Here's my app. It's live. Try to break it. Seriously. I'll buy coffee gift cards for whoever causes the most chaos."

The app in question is a little habit-tracking tool I'd been building in the lab for about eight months. It has maybe forty real users, all friends. I thought it was solid. I thought wrong.

The Rules of the Wrecking Ball

Before opening the gates, I set some ground rules for myself:

• No PII in the database except my own test accounts
• Full database snapshot and backup taken Friday night
• Logs piped to a separate box so attackers couldn't scrub their tracks
• A pledge to fix nothing until Sunday at 6 PM — no hotfixing mid-fight

That last rule was the hardest. Every fiber of my being wanted to patch things live. But the whole point was to watch it burn and take notes, not to play whack-a-mole with a moving target.

Hour One: My Ego

The first breach took eleven minutes.

Someone noticed my API returned full user objects — including internal IDs and timestamps I never meant to expose. Classic. I'd written that serializer in month two and never looked at it again. The attacker didn't even need to hack anything. I just... handed it over.

Lesson one, logged at 7:11 PM Friday: the code you wrote longest ago is your biggest liability. You've grown as a developer since then; your old endpoints haven't.

Hour Six: My Rate Limiting Was Decorative

Around midnight, someone decided to see if my rate limiter was real. It was not.

I had a limiter on the login endpoint because I read an article about credential stuffing in 2023 and felt very responsible. But the password reset flow? Wide open. The attacker fired off thousands of reset emails through my SMTP provider before I even noticed, which — fun fact — can get your email account suspended. Ask me how I know.

My SMTP bill for the weekend was $4.37. The hit to my pride was free.

The Log File Confessions

Reading the raw logs afterward was like reading my own diary, if my diary documented every mistake I'd ever made in chronological order:

1. Directory traversal attempts — my static file server handled these fine, which genuinely surprised me. One point for the framework defaults.
2. SQL injection probes — all blocked. I use an ORM and parameterized queries everywhere. Two points for the framework defaults.
3. A JWT forgery attempt — this one worked for about forty minutes because I'd set my token secret via an env var that, on my staging box, was still the default from a tutorial. I changed my email signature to "default from a tutorial" for a week after that.
4. Someone uploaded a 2GB file as an avatar. My "max upload size" check existed only on the client side. On the server, I had a comment that said // TODO: validate size. The TODO was from March.

The Assumption Graveyard

By Sunday evening I had a list of assumptions that had died over the weekend:

• "Nobody will find the admin routes." They found them in under an hour. They're not secret if they're guessable.
• "My users are trustworthy." My users were strangers on the internet who had been literally invited to break things. Trust was never on the table.
• "I'll add validation later." Later arrived wearing a 2GB avatar and a forged JWT.

The Humiliation Was the Point

Here's the thing I keep telling every developer friend now: you cannot stress-test your own assumptions, because you made them. You need someone with fresh eyes and bad intentions, even if the bad intentions are playful.

A weekend of controlled chaos cost me about $10 in infrastructure, four gift cards, and one bruised ego. The alternative — discovering these holes after real users show up — costs a lot more.

My fix list after the event had 23 items on it. Twenty-one are already closed. The remaining two are architectural and I'm being honest with myself about the timeline instead of hand-waving.

If you've got a side project that's been humming along with zero incidents, consider this your nudge: zero incidents might just mean zero tests. Hand a friend (or a friendly stranger) a crowbar and see what rattles loose. Your logs will thank you. Your ego will recover.

The habit tracker survived, by the way. It's sturdier now. And the TODO comment about file validation? Deleted — the validation actually exists.