A tester flagged that an invite link wasn't connecting them to the friend who'd sent it. My first thought was the usual one this close to launch: something's not live yet. I checked anyway before saying so out loud.
Turned out the link was doing exactly what I'd built it to do. It just wasn't doing what the tester assumed it did. I'd designed it around bringing in someone who'd never used the app before: tap the link, sign up, connect with whoever invited you. I hadn't finished what should happen if the person tapping it already had an account.
So I finished it. I added the missing case to the API and both mobile apps, checked the builds compiled, committed the changes, and pushed the server side live. What had looked like a small omission was finally crossed off.
Then I ran a security review on that commit. It caught a case where an invitation could connect the wrong people. I'd concentrated on making the tester's path work and hadn't checked every other way someone might arrive at the same invitation.
I patched that, shipped it, and ran the review again. Second finding, in the patch I'd just written for the first one. I'd closed the case I knew about, but the fix still wasn't safe when requests arrived together.
That was the irritating part. I wasn't looking at an old problem I'd forgotten to fix. I was looking at a new problem in work I'd just finished and felt reasonably pleased with. I changed the way I handled the connection, then checked it again.
Somewhere in the middle of all this, the site stopped responding for about ten minutes, which felt about right for the day. Three rounds of deployment for what I'd expected to be an afternoon fix.
I'm glad I caught both findings before opening it up to more people. I'm also glad I reviewed the patch instead of treating the first review as a box I'd already ticked. Otherwise I'd have ended the day with a very tidy board and a fix that still wasn't finished.
