The Guard Booth Was Empty Since June

A Death Threat, a Drainer Link, and a Social Security Number All Walked Through Clean

Same week the building got a working front door, badge and all, and the back room got a real floor plan instead of a staircase, I found out the thing standing guard over both had been waving everybody through since June. Nothing ever rang, because nothing in it was wired to.

Four probes. A wallet-drainer phrase. A domain built to look like a wallet you trust. An actual death threat, typed plainly. A social security number sitting next to a name. All four came back allow, identical to typing “nice piece on the wall today.”

I don’t want to make this bug sound cute, so I won’t. What follows is in the order I found it, because the order is most of the lesson.

• The guard. The harm screen that checks every public post for drainer links, doxxing, threats, and worse has been degrading to ALLOW on all four categories since the day it shipped, June 5th. Two months. Nothing alerted, because a screen that lets everything through looks exactly like a screen that never had to stop anything.
• The fix for the guard, first try. The patch meant to close the hole ran a file sync missing one flag. It reported success and moved zero files. Same failure, one layer up.
• The front door. Network membership stopped being a JSON file I hand-edited off an email and became the badge itself. Install it on your homepage, you’re recognized within the hour. Take it down, you’re out in three days.
• The back room. The Underground forum got a real shape: per-topic unread, a drawer for the open reply box, one flat reply stream instead of a staircase, suggested topics at the bottom of every thread.
• The paper trail. A notify checkbox that promised email and sent none, a reply digest that skipped the unsubscribe list, a platform fee the Terms still called three percent a month after it went to zero, and a refund policy silent on what happens if I pull an ad thirty days into a ninety-day run. All four fixed. All four turned up because I went looking. Nobody had to complain first.
• The shelf. Four new two-dollar books, a free guide to creator assets that don’t need a subscription, and the Skills Pack finally saying out loud that it was never a Claude-only trick.
• The crew. Cy Renner, record producer, took a chair at the table.
• Also shipped. A neon layer across the whole site. The radio player stripped down to two buttons. A fallback so the stream fails with a visible cue instead of going quiet.

THE LEAD // Since June, the Guard Booth Was Empty

Every public post on this network runs past a screen before it lands: drainer links, lookalike domains, doxxing, explicit threats, worse. That screen has been checking all of it against an empty list since the day it went live, answering allow every single time, because an empty list has nothing to say no to.

Here’s the shape of it, fam, for anybody who doesn’t live in this stuff. The screen keeps its bad-pattern lists in a folder on the live server. That folder never existed on the live box. When the code that loads a list can’t find its file, it hands back an empty list instead of crashing, on purpose, so one missing category doesn’t take down the whole screen. Good instinct on its own. Except every category was missing, so every category came back empty, and an empty list of bad patterns catches zero of them.

I probed it before I fixed it, because I wanted the receipts before I trusted my own read of the code. Same four: the drainer phrase, the lookalike wallet domain, the death threat typed plainly, the social security number next to a name. class=allow, action=allow, all four, identical to a compliment about the paint job.

(And I want to be straight about this part. Nobody attacked the place and got caught by anything. I found this because I went looking, not because the guard did its job. I never checked before, and never had a reason to, since the checking itself reported clean the whole time. That’s worse to sit with, not better. It pisses me off. It PISSES ME OFF, fam, more than I want to admit in a newsletter I send for free.)

A screen that passes everything is indistinguishable from a room with nothing wrong in it.

The screen’s own logic was fine. The deploy script was the root cause, and it had already written down its own warning months ago: a file with no line in that script is a file that silently doesn’t exist in production. This file had no line. It was only live at all because somebody scp’d it onto the box by hand back in June, which is also why the pattern lists it needs never shipped with it.

THE SECOND // The Fix for the Guard Booth Did Nothing, the First Time

The patch meant to close the hole ran a file sync missing one flag, and it told me it worked. Moved zero files.

I wrote the fix. Deploy script now ships the screen’s own file, and syncs its pattern lists to the server alongside it. Ran it. Watched it say done. Except the sync command was missing the one flag that tells it to actually walk into a folder, so it printed “skipping directory” for every single list, copied zero bytes, and exited clean like nothing was wrong. The step that exists specifically to stop the guard booth standing empty was, itself, standing empty.

Caught it by deleting one of the pattern files off the live box on purpose and watching the “fixed” sync line succeed without putting it back. That’s the whole test, honestly. If your fix can’t survive you breaking the thing on purpose and checking, all you wrote was a sentence shaped like a fix.

Same shape as the defect it was written to fix. One layer up.

It’s closed now, checked both directions. Real threats contain. Seven honest false-positive shapes, including a member reporting a bad domain by name, still pass clean. I’m not going to pretend two months of an empty guard booth is a fun thing to put in a newsletter. It’s a shitty two months to own up to, fam, and it’s the truest thing that happened here, so it’s the lead.

THE THIRD // The Building Got a Front Door the Same Week

Ring membership stopped being a spreadsheet I kept in my head. The Underground stopped being one long staircase. And the guy who’s about to help pick GZS’s next single pulled up a chair.

Every site in the ring used to get added the same way: somebody emails, I edit a JSON file by hand, they’re in until I remember to check again, which was never. That’s a toll booth in front of a thing whose entire pitch is no toll booth. Membership is the badge itself now. Put it on your homepage linking back here, you’re recognized within the hour. Take it down, you’re out inside three days, automatically, because the badge gets checked daily instead of trusted forever. No more emailing me and hoping I remember to update a spreadsheet!

First site through the new door, for the record: Thomas Icom’s Cyber-Tek Zine, who mailed the link with the badge already live.

The Underground got a room to match. Threads used to be one long staircase, indent under indent under indent. Flat now, one stream, a small chip if you’re answering somebody specific. Unread tracks per topic instead of per visit, so a thread you half-read shows you exactly where you left off, not the whole thing bold again. And the reply box you open follows you down the page as a small tab instead of vanishing the second you scroll past it.

Cy Renner joined the roster this week too. Producer, A&R, the guy who decides which song on GZS is the single and which one’s a deep cut. Portrait’s up, page is live.

Anyway. The rest of the register got straightened out while I was in there. The notify checkbox on your profile said “email me” and had never sent a single email since it shipped, so it says “notify me” now, which is the thing it actually does. The reply digest that DOES send mail was skipping the unsubscribe list entirely, twenty of thirty-eight profiles are on it, and one real member with a pending reply and an opt-out would have gotten mailed anyway. Caught before the first send went out, not after. And the Terms of Service, the actual binding document, was still quoting a three percent platform fee a full month after that fee went to zero. Nobody got overcharged. The single claim this whole platform is built on was just publicly false in the one place it’s a promise instead of marketing. It’s fixed now, dated and logged where you can go read it yourself.

THE WEEK // What Actually Shipped, Monday Through Friday

Five days, five drills that landed. The commit log has the ugly rest of it.

THE BRIEFS

• MON: The Number Your Dashboard Is Lying About — Half of what your analytics dashboard swears happened, didn’t. Fifteen minutes to find the one number you can actually trust.
• TUE: The Page That Ends The Refund Fight — Write your refund policy this week, before a stranger writes it for you at 11pm on a Saturday.
• WED: The Tab They Closed Before Your Page Loaded — Ten minutes with one free tool, and you’ve got proof of the exact thing slowing your page down.
• THU: The Checkout Walkthrough — Bought my own product like a total stranger for the first time. Counted every click it took to get there.
• FRI: A Machine Read Your Site Last Night — Ask an AI your own buying question, see if it can even find you well enough to answer with.

TOWN BUSINESS // Fair’s fair

Numbers, since I said I’d keep showing them. This week’s sales log: ten rows, every one of them zero dollars, all one visitor claiming a burst of free titles Friday morning, three of the four new two-dollar books included. Not one paid sale landed in the pull. I could dress that up. I’m not going to bullshit you about it.

What did move: the live shelf count, 83 titles last issue to 89 now. New this week: Rent Free (getting your work off somebody else’s server, four weekends, real bills from three real operations), Copywriting for Weirdos, The Anti-Guru Business Library, and, because apparently that’s where the week landed, How to Build a Servitor (For Real). Two dollars each, all four verified live on the store before they shipped.

Also live: The Free Creator Stack, a free field guide to the stock photo, icon, font, and mockup sites I actually use instead of a subscription I don’t want. And the Skills Pack finally stopped selling itself short. It runs in Claude, ChatGPT, Gemini, Copilot, and a couple dozen other tools, and always did. The page just wasn’t saying so out loud.

Everybody reading this is comped, ya’ll, and I’m not about to stand here and sell you a door you already walked through. That door runs thirty-seven dollars a year for the people who aren’t on this list. You’re not them. If the badge, the forum room, or any of the honesty fixes above mean something to somebody outside this list, that’s the ask: hand them the key.

The door’s already yours. Sign in at the Underground.

FIELD REPORT // Field Report Requested

One question, and I read every answer that lands. What control on your own site do you assume works, purely because nobody’s ever complained? Then go check it yourself, logged out, before you answer. Hit reply.

• The suppression list you’re pretty sure the send script checks.
• The permission you assume is off because you flipped the switch once, a while back.
• The security thing you installed once and have never once tried to defeat yourself.

LIMINAL // Filed under things that did not happen

A SCALE THAT AGREES · FILED FROM THE SCALE HOUSE OFF THE OLD 61 SPUR, PARISH UNLISTED · UNCONFIRMED

Loomis brings the rig up to the scale a little after three, same as every night on this spur. The readout goes green before the plate under eighty thousand pounds even finishes settling. He tests it now and then, the way a man presses a bruise to check if it still hurts: an empty trailer once, a bed of scrap where the manifest said gravel, one night nothing on the flatbed but tarp pulled taut over air. Green every time. Same six digits it holds for a full load. The attendant’s window stays dark, same as it always has. The logbook chained under the sill is filled out anyway, CLEARED down every line in a hand steadier than his own, dated tonight, running back further than the book has pages to hold it. He signs under the last entry because that’s the custom, though nobody has ever told him whose. Then he pulls back onto a road that used to go somewhere, before somewhere stopped being where it was, thinking a scale that agrees with you every single night isn’t measuring you at all.

---

That’s the week, fam. A guard booth standing empty since June, and a front door that finally locks itself for the first time. The small honest fixes are still in there too, buried in the commit log where nobody but QA ever goes looking.

A bug shipped. Bugs ship. What’s scary is how long a screen that catches nothing looks exactly like a screen that never had to catch anything, same as any other goddamn green light.

But I digress. Go find the one thing on your own setup you’ve never once tried to break on purpose. Break it. See what it actually does. Just sayin’.

~ J.D.

P.S. Two months is the number sitting on me tonight, not the four probes. If you run anything with a gate on it, a spam filter, a permission check, a screen of any kind, go feed it something that should absolutely get blocked and watch what it actually does. I’d rather you find the empty guard booth on your own stuff than I find another one on mine. Reply and tell me what you find, good or bad.