Website, 3D and brand — from idea to launch.

The form cleared itself, so the customer walked away sure the order had gone through. The owner would never learn how many he lost — a lost order leaves no trace.

The form had no submit handler. Pressing “Place order” reloaded the page, emptied the cart and sent nothing anywhere. The owner would never learn how many orders he lost, because a lost order leaves no trace.

The site failed to assemble, and the one page it exists for never reached a customer.

The cart used React state inside a server component, so the build failed outright. The only reason the site exists was unreachable in production — the page simply was not in the built output.

A filename differed only by capital letters. On his laptop that is one file; on the server it is two. The person who wrote it can never reproduce the failure.

The file on disk was menucard.tsx; the import said MenuCard. Windows and macOS treat those as the same file. Linux build servers do not. It compiled perfectly on the developer’s laptop and failed every single deploy — the most expensive kind of bug there is, because the person who wrote it can never reproduce it.

Any visitor could read it — view source is enough. That key opens access to money and customer data.

A live secret key was hardcoded into a component that runs in the browser. Any visitor could read it straight from the page source. Moved to a server route and an environment variable, with a documented .env.example so the next person knows what the project needs.

The order button was pushed clean off the screen. For a cafe, phones are most of the traffic.

The layout used a fixed width, so on a phone the “Order ahead” button was pushed off screen entirely. Mobile customers could not order at all — and for a cafe that is most of the traffic.

Three coffees and a filter added up to a number with a long tail after the decimal point. People see that and do not pay.

Money was stored and added as floating point numbers. Three coffees and a filter produced exactly that on the checkout screen. Now handled in integer cents and formatted only at the moment it is displayed — so $4.10 also stops rendering as $4.1.

The vulnerability was published and public — including to the people who go looking for sites like this one.

The project was pinned to a release with a published security advisory. Upgraded inside the same major version, so no APIs changed and nothing else had to be rewritten.

The list was built without identifiers, so deleting or editing one row could hit a different one.

Cart items rendered without keys — console warnings and a real risk of removing the wrong row when a customer edited their order.

The title was still the factory default. The cafe could not be found by its own name, and a shared link looked blank.

The default scaffolding title and description were never replaced. The business would have appeared in search results and shared links under a framework placeholder instead of its own name.