Shayon wanted a gym check-in code without opening the app’s compulsory social feed. Reconstructing that single feature became a compact case study in probing a black box and checking assumptions against independent evidence.
- Start with a cheap experiment. Turning off Wi-Fi revealed that the app could generate valid codes offline, narrowing the search to local logic and stored credentials.
- Inspect the boring evidence. The Flutter app’s Android-side logs contained the account’s key material in plaintext. A rooted spare phone proved more practical than emulation on an old laptop.
- Match the representation exactly. The expiry used milliseconds; the encoding was base64url with padding retained. Both details mattered for reproducing the original URL.
- Round trips can agree on the same mistake. A faulty AES implementation passed its own encrypt/decrypt tests. WebCrypto, OpenSSL and known test vectors exposed the error.
- Test across boundaries. The replacement produced a byte-identical URL for matching inputs, passed an independent QR-image decode, and ultimately worked at the gym’s turnstile.
Independent implementations catch errors that self-consistency tests preserve. The same habit applies to serializers, file formats and protocol clients: compare against an external reference, then test the actual consumer.
The resulting SvelteKit tool generates passes locally, but still depends on obtaining fresh account keys when they rotate. That boundary keeps the account honest: one working feature, with its remaining dependency spelled out.