Chapter 8: Twelve Fixes Before Dawn and Four Attempts to Share

The following plots are purely fictitious and any similarity is purely coincidental.

Opening

In the early morning of March 10, Y was still awake.

The speed when setting up the infrastructure in the first two days was too fast. Workers, databases, user systems, leaderboards, telemetry—all came online within forty-eight hours. It was fast enough, but Y knew in his heart that there must be holes left in the rush. Not that "there might be something wrong" kind of gut feeling. After he completed the security review, he made a list with twelve items on it.

He looked at the time. Twelve o'clock in the evening. Open the Codex and paste the list in.

"Then fix it."

Twelve holes

Y followed the Codex one by one. He does the review himself and makes the revisions. Codex is responsible for modifying the code and making up for tests.

The first one is the most serious: the user profile update interface will directly accept the `vibe_uid` from the client without a JWT token. Meaning - anyone can change anyone's nickname. The modification is very simple, delete the else if branch, and all requests must go through `requirePassportAuth()`. But leaving such holes online for even one day is too many.

The second one is XSS. In several places, `innerHTML` directly spells out dynamic content from config or state. The names and descriptions of talent cards, the titles of title badges, and the text of typewriter special effects—these places may be injected with malicious content. The modification is to classify them one by one: use `textContent` for plain text, and use `escapeHtml()` to wrap a layer if HTML structure is required. The logging system's `innerHTML` is left in as the content comes from the trusted config.

The third one is database race condition. The logic of email binding is to first check whether anyone uses this email address, and then perform the binding. If two requests come in at the same time and both are found to be "unused", the same email address will be tied to two people. The modification is a single atomic SQL, `NOT EXISTS` subquery plus try/catch with UNIQUE constraint, and the conflict will directly return 409.

The fourth is an expression parser bug. The tokenizer can accept decimals such as `.5` that omit leading zeros, but the subsequent validator regex does not recognize it. The standards on both sides are inconsistent.

The fifth one is the DOM null pointer. `updateStat()`, `log()`, `_flushLogs()` these high-frequency functions do not check whether the DOM element exists. Once the node is deleted or the ID is changed, the entire game will crash.

The sixth one is that the CORS header of the devlog API is missing. The seventh is that the double-click submission protection of the feedback form is installed too late. The eighth is a divide-by-zero error on the title page. The ninth one is that `minTizhi` is not reset in `startGame()` and always hangs on `Infinity` during initialization.There are also three issues related to test quality. A tautological test - creating an object yourself and then asserting the properties you created is not testing the behavior of the engine. A Worker test mock does not verify the number of parameters, and both ten and fourteen parameters can pass. There is also a smoke test in which curl fails and returns "000", which is regarded as a legal HTTP status code by the regular code.

Twelve. It was repaired from 12 o'clock in the morning to 4:30 in the morning.

After the repair was completed, Y spent another half an hour updating CLAUDE.md and AGENTS.md. It's not a running account. It is to turn the pitfalls encountered this time into rules: all modification interfaces must use JWT, user text must be `textContent`, database updates must be atomic operations, DOM searches must be null check, and tests are not allowed to write tautologies.

Write the lesson down as a rule so you don’t have to rely on memorization next time.

He also wrote a narration for the project

During the same night, Y also did something a little different.

He asked AI to write three articles for the development log system. Not written in my own name. It is written from a perspective called "Zero" - a language model that reads submission records and uses the third person to analyze how the project grew. Y gives it the commit history and project context, allowing it to read and write by itself.

The first prologue: This is not about praising the power of AI output, but about calculating the cost and process. The second article talks about boundaries: Y How to split a lump of HTML into four directories: `app/`, `config/`, `src/`, and `docs/`. This is not for neatness, but to let future changes know where to place them. The third article talks about workflow: CI/CD, testing, deployment scripts, smoke checks - not to make the system fashionable, but to prevent things that have just been stabilized from falling again.

After writing, he also added an `export-commit-changes.js` script, which can export the entire submission history into patch files, divided into directories by author and date. This script was the one used later to write this serial.

It's half past four in the morning. When Y turned off the computer, it was almost dawn.

L Over there, we’re polishing the details.

On March 11, L woke up and opened Kimi and started working.

She asked Kimi to adjust the checkout page again. The padding is reduced from 20 to 16, the font size is reduced from 32 to 28, the button spacing is changed from 15 to 12, and all elements are tightened. You can see more content on your phone without scrolling so much.

Then she asked Kimi to do a very coincidental thing: at the end of the Tiandao dialogue, send the player's choice to the backend. Three options correspond to three sentences of feedback:

A: "The way of heaven is unfair, it all depends on your face! - The attribute balance is too poor, the sudden death rate is too high, your survival depends on your face!"

B: "With this frequency of death, I'm afraid I got a horror movie script? - Death is so random, survival depends on your appearance!"

C: "It's quite fun, but I found a bug... - suspected to be a game bug"

This is not a random complaint. This turns the easter egg into a portal for user feedback. Players think they are quarreling with Tiandao, but in fact the content of the options will be sent to the operation mailbox by email. With the number of reincarnations, with vibe_uid, with IP, with timestamp. Players don't know. God knows.On the same day, she also fixed the display problem of the pause button - adding a Unicode variant selector to force text rendering and prevent the system from turning `⏸` into an emoji style. This kind of problem can only be discovered by repeated testing on different devices.

Then she wrote eleven pieces of sharing copy, which were randomly displayed on the checkout screenshot:

"Cyber cultivation of immortality depends entirely on opening blind boxes. Let's see which immortal you will draw to start?"

"Experience the nonsensical cultivation of immortality in one minute and get your exclusive weird title."

"Using a rice cooker to make elixirs? This world of immortality is not normal. Click to test your luck."

"Fellow Taoist, please stay! I'm amazed at your skeleton. Click here to draw your natal spiritual root!"

L can write this kind of thing as fast as writing event copy. Without hesitation. Like sending a message in a group.

The robbery incident has expanded in a circle

In the previous chapter, L added an unavoidable disaster event to the realm of true immortals. This time after she finished chatting with Teacher G, she asked Kimi to broaden the scope - not only the true immortals, but also the special catastrophes in the tribulation period.

"Three-nine heavenly tribulations are coming! The tribulation thunder strikes, you resist with your body, and your physique is completely destroyed..."

"Sixty-nine heavenly tribulations are coming! The endless sea of thunder will submerge you, and the collapse of your immortal body is imminent..."

"The calamity of inner demons is coming! Your Taoist mind is unstable, you are possessed by evil spirits, and your true spirit is about to dissipate..."

"The five declines of heaven and man are coming! Your body is decaying, your soul is withering, and you are about to perish..."

All are marked with `fullTizhiDamage: true`, and the physical fitness will be directly reset to zero, without any chance of rescue. Starting from the ninth realm, every step is a tightrope walk.

Sharing screenshots has also been changed. The cause of death has been moved from a separate block to the attribute area. The canvas is no longer cut into a square, and the entire picture is used directly. It looks much better when shared on your mobile phone.

It took four times to post the Xiaohongshu correctly

On March 12, L decided to put the link to Xiaohongshu.

This thing sounds simple. a link. Just stick it on.

The first time she posted a short link: `xhslink.com/m/7iKTpXtyZmL`. submit.

Second submission half an hour later. It was replaced with a complete personal homepage URL, but with a lot of WeChat sharing tracking parameters: `xsec_token=...&xsec_source=app_share&wechatWid=...&wechatOrigin=menu`. This kind of link looks like this when copied from WeChat.

The third time an hour and a half later. Delete the tracking parameters. Only keep the clean `xiaohongshu.com/user/profile/65dc687c000000000500d6ee`.

Another hour and a half later, the fourth time. Copilot helped her unify the links in all files into a new short link `xhslink.com/m/3JD5TW9GUgt`, including `index.html`, `homepage.mjs`, `game-config.js`, `game-engine.js` and test files.

Four submissions. a link.

This thing is small. But it illustrates the fact that the game is starting to move away. All previous changes were internal - adjusting values, fixing bugs, building frameworks. Posting a link to Little Red Book is the first time a portal points to the outside world. L is ready to start letting others see this thing.

Things two people do on the same night

Looking back on these two days.Y fixes security vulnerabilities, writes project specifications, and creates an observer perspective for AI in the early morning. L spent the day polishing the settlement page, turning easter eggs into feedback channels, writing sharing copy, expanding on the robbery event, and posting social links.

The two of them didn't even have the same schedule. Y is a night owl and goes out early in the morning. L is a day player and starts working in the morning.

But looking at it together: Y asked Codex to solidify the foundation, and L asked Kimi to open the facade. One facing inward and one facing outward. They are all working hard in the same direction - to make this game from something for two people to something that can be played by others. Neither of them has ever written a line of code by hand. But every decision—what to build, how to build it, what to leave in, what to cut down—is made by humans.