infra-failurecriticalverifiedfirsthand

A cancelled domain was still referenced by a live public site's script tag, a payment page, and an automated social posting tool's default config — while the domain itself sat in a state a third party could soon claim.

2026-09-11 · severity 8/10 · blast radius: reputation, financial, data · tags: domain, dns, supply-chain, automation

Cause: Cancelling a domain was treated as a single action, but the domain had been hardcoded as a default value across multiple independent automation pipelines. No single step cleaned up all the places that pointed to it.

Consequence: Had the domain been re-registered by someone else before the references were removed, they could have run arbitrary JavaScript on every page of a live site and a payment page, and injected links into an automated posting pipeline.

Fix: Before cancelling any domain, grep every project directory for references to it. Never hardcode an external domain as a silent default — if it's unset, fail loudly instead of falling back to something that might not exist anymore.

What happened

A domain used by a since-discontinued referral system was cancelled. Nobody went back to check who was still pointing at it.

The chaos on the ground

WHOIS showed the domain in pendingDelete / redemptionPeriod — meaning it was about to become available for anyone to register. Meanwhile:

None of this was exploited. It was caught and closed before anyone could register the domain, but every one of those references was live and waiting.

Root cause

“Cancel the domain” was executed as one action, but the domain had quietly become a hardcoded dependency in several unrelated automation pipelines — a script tag, a webhook target, a default config value. No single cleanup step touched all of them, because no single person or system owned “every place this domain is referenced.”

The fix

Before cancelling a domain, search every project for the string first. Don’t let an external domain live as a silent default value in code — if it’s not explicitly configured, the system should fail with a clear error instead of quietly falling back to something that might now belong to someone else.