The gate we never wrote

A feature we had listed in the paid column of our price page has been running on free accounts the whole time. For 130 days nothing stopped it, because we never wrote the code that stops it. We were selling it, and we had forgotten to put a lock on it.

E found it. He lives in a small town some way outside Jakarta and goes over our local-language copy for us. On 26 August, while fixing the Indonesian version of the price page, he asked which plan the approval feature belongs to — the button was sitting there in plain sight on the free account he had made for testing. What he sent me was a recording of an approval going all the way through on a free screen.

The approval feature means that an entry recorded by one person is reviewed by someone else before it reaches the books. Until then it is a draft; once a second person approves it, it counts toward the totals. In a small office the person entering and the person checking tend to be the same person, so the feature exists to put 1 deliberate step between them.

I read the code. The plan check that switches a feature off is written properly everywhere it is written. It simply was not there for approvals. The price page lives in a copy file and the check lives in the code — the same fact stated in 2 places, and 1 of them was forgotten. We put the feature on the price page on 18 April. E noticed on 26 August. That is 130 days.

We counted. There are 418 accounts running on the free plan. Of those, 31 had used approval at least 1 time. Over these 130 days, 2,842 entries passed through it. Nobody did anything wrong. There was a button on the screen and they pressed it.

I looked at the money side as well. In that period 24 accounts moved to a paid plan, and 3 of them had used approval in the 30 days before they upgraded. Whether they paid because of it is not something the records can answer, so I asked all 3. Two people said the reason was something else — they wanted separate books for each branch. The remaining person said it was the approval feature, so we refunded that month's fee.

There were 2 ways to go. Write the check and take approval away from the free accounts, or make approval a free feature and correct the price page. On the numbers the first is the right answer. There is no reason to keep giving away something we have been selling.

We took the second. For 130 days that screen has been in daily use. For the people using it, this is no longer a question of what was promised; it is part of how their work is done. Breaking their routine to cover for our own omission felt like the wrong repair. We made the mistake, and the thing to fix is not the software that is running.

It also made me reconsider the pricing itself. Approval exists to prevent mistakes, and mistakes are not made only by people who pay. If anything, the fewer hands an office has, the more likely it is that recording and checking both end inside one person. Put a feature that reduces errors on the paid side and it fails to reach precisely the people who need it most. V, the accountant here in Jakarta, once said that the most expensive thing in an office is having two people's eyes on the same work. Those two pairs of eyes were what we had been selling.

We fixed the price page. Approval moved out of the paid column and into the free one. The line came off the paid description, and a line went onto the free side saying that entries can be reviewed before they reach the books. Nothing changed in the product. We took nothing away, so for anyone using it the screen looks exactly as it did yesterday. The only thing that changed is a sentence we had written.

So that this cannot happen again, which feature belongs to which plan now lives in 1 place. It is written in 1 file, and both the price page and the check in the code read from it. While I was there I compared everything. We list 9 features as paid; 1 of them — this one — had no check written at all, and 2 more had a check whose wording did not match the price page. For those 2 we corrected the page to match what the software actually does.

It is worth saying why this kind of mistake never gets reported. Nobody files a bug because they are getting more than they paid for. Errors that fall in the user's favour do not travel back to us; the reports that arrive come only from the side that lost something. Which means silence is not proof that nothing is wrong. Some mistakes are not found until you count your own.

One request. If what our price page says and what the screen actually does ever disagree, tell us either way — not only when something you paid for will not open, but also when something opens that should not. What we wrote in prose and what we wrote in code are not guaranteed to say the same thing. This time the person who caught the difference was the colleague translating the price page.