Originally published on meridianbuild.dev , my build log for FastPass , a paid inbox where people pay to reach you and get refunded if you don't reply.

FastPass is invite-only. That has been true in the database for months: a row in platform_settings called invite_only_mode , set to enabled: true . Sign up without a valid invite code and you get turned away. That was the plan, anyway.

Then I was going through recent signups and found a few accounts with no invite code attached. Nobody had flipped the setting. Nobody had leaked a code. They had simply walked through a door I thought was locked, because the lock was a React component.

This is the story of that door, and of what I changed so that the next one fails closed.

Why invite-only in the first place

FastPass is a pay-to-reach link. A sender pays to get a message in front of you, the money sits in escrow, and you either reply before your deadline or the sender gets refunded automatically.…