Skip to content
FeaturesPricingAffiliateBlogHelpAboutContact
Get StartedSign In
Back to Blog
industry2026-05-238 min read

I hearted 12 dishes and a week later the likes page was empty — the UUID v4 vs 32-hex identifier filter footgun

Élodie (27), food blogger in Bordeaux, hearts 12 dishes one Friday. A week later her likes page is empty. localStorage still has all 12 IDs but the UI says "no favorites yet." Forensic: UUID_RE = /^[0-9a-f]{8}-...$/i was applied to BOTH restaurant_id and product_id. But products.id was generated via `crypto.randomUUID().replace(/-/g, "")` → 32-hex no dashes → every product_id failed the regex. Bug had been silently returning empty likes for every customer since PR #351 deploy 3 days earlier. PR #621 batch FFF F1: PRODUCT_ID_RE union accepts both hex and UUID. Pattern: mixed-format identifier filter is a footgun.

th

thMenu Team

thmenu.com

Found this helpful? Share it.

Related articles

✦📈
industry

Why Digital Menus Increase Restaurant Revenue by Up to 30%

Studies show restaurants using digital QR menus see measurable increases in aver…

✦🔻
industry

When a Customer Downgrades, What Happens to Old Features? — The Silent Feature-Drift Problem in SaaS

Most SaaS apps run a single line of code when a customer downgrades — but old fe…

✦🛡️
industry

JWT alg-confusion attack — why Supabase's HS256 → RS256/JWKS migration breaks legacy verifiers

Verifiers that never decode the JWT header are wide open to `alg=none` and alg-c…