Hardened Public Endpoints

Someone pointed an automated probe at our public URLs last week — encoded payloads, case-toggled SQL keywords, the whole checklist. Nothing got through: those URL segments have always been passed as parameterized filters, never as SQL. But the responses were still wrong. Malformed slugs came back as 500s instead of 404s, which is a bad answer to a rude question.

The cause was unglamorous. A junk slug went all the way to the database layer, got bounced by an upstream firewall, and that bounce surfaced as a server error. Two problems fell out of that: anyone could generate error-severity alerts on demand from an unauthenticated page, and the 500-vs-404 difference quietly told a prober how deep their input travelled. Neither is a breach. Both are noise you shouldn't be able to create from the outside.

Every real slug is generated from a fixed character set, so a malformed one provably can't match anything. Public lookups now check the format first and return a plain 404 before any query runs. We deliberately skipped the lazier fix — swallowing database errors and calling it a 404 — because that would hide genuine outages behind a friendly status code. Well-formed slugs still hit the database, and real failures still show up as real failures.

We audited every unauthenticated route while we were in there: organization pages, shipping team pages, badge images, and public release notes. Four of them routed through two shared lookups, so one guard at the boundary covered all of them. Token-based endpoints were already safe — they hash input before it reaches a query. Bonus side effect: each rejected request used to log several kilobytes of firewall HTML four times over. Now it logs nothing, because nothing happens.

The practical upshot — your public pages stay up and quiet under drive-by traffic, your error dashboards stop crying wolf, and a bad link is treated like what it is: a page that doesn't exist.