← All comics

I handled that

#078

June shipped a test that gave every shopper a random price, on Pip's word each price would stick. Ines tapped until the sofa cost four pounds and bought two.

The mistake

The price randomization is applied per request instead of being pinned to a session or customer identity. Each page load or tap generates a brand-new random value with no persisted assignment (no cookie, session token, or user-keyed seed), so nothing actually locks a customer's price after the first roll. That turns the endpoint into a slot machine anyone can hammer client-side until it returns a value low enough to be worth abusing.

Share