“Revoke device” didn’t revoke anything
Yesterday I found a bug in PONNE’s cloud locker that I want to write down publicly, because the whole product stands on a promise about trust, and trust doesn’t survive quiet fixes.
What the button claimed
If you sign in to PONNE on two PCs and lose one — sold it, lent it, left it at a friend’s place — there’s a button: revoke that device. The desktop app holds a sign-in token that’s valid for 30 days, so a revoke button is not cosmetic. It’s the thing standing between a machine you no longer control and your lap data.
What the button did
It deleted the device from the database. That’s all. The token the device was carrying kept working — every API call, for the rest of its 30 days. The code touched the device record on each request but never checked whether it still existed, and touching a missing record silently did nothing. The live telemetry socket was worse: it checked only that the token’s signature was valid. A fully deleted account could have kept streaming until its token expired.
How it was found
Not by a user, and not by the test suite — by a review pass I run over recent work asking one specific question: we test that features work; do we ever test that removal works? Creating a device had test coverage. Revoking one didn’t. That asymmetry turns out to be exactly where this class of bug lives, because a broken “off” switch looks identical to a working one in every demo.
The fix, same day
A device-bound token now dies with its device — over HTTP and on the live socket. A deleted account’s tokens die everywhere. Five new checks pin this in the test suite (70 checks total now run against every deploy), including one that verifies your other devices keep working when you revoke one. It’s live in production.
Was anyone affected?
The beta currently has a handful of testers and the data shows no revocations before the fix — so no real-world exposure. But that’s luck of timing, not design, and it would be dishonest to claim otherwise.
What changes
Every delete, revoke and leave-team path in PONNE now gets the same test treatment as every create path. If PONNE says something is gone, it’s gone — and now there’s a test that fails if that ever stops being true.