Our admin dashboard reported ₹1,45,000 in monthly recurring revenue and 1,284 users. Both numbers were written into the source code as fallbacks, to be displayed whenever the real query failed. The real figures at the time were a small fraction of that.
How it happened
None of it was malicious. Each fallback was added to make a screen look finished during development, and then never removed. The revenue chart drew a rising curve when the backend returned nothing. A stats grid substituted plausible counts. Individually each was a placeholder; together they made an administrative view that could not be distinguished from a working one.
// The shape of the problem, simplified
const stats = await fetchStats();
return stats ?? { users: 1284, mrr: 145000 }; // <- removedZero is a real number
The subtler bug was the opposite one. A payment gateway returning an authentication error was caught, logged as a warning, and treated as an empty list — so a broken Razorpay key rendered as ₹0 of revenue, which reads exactly like a month with no sales. Reporting a failure as zero is the same lie as reporting it as 1,45,000, just quieter.
Buttons that did nothing
We also found controls that reported success for work that never ran — a cache flush across edge locations that do not exist, a build queue clear, and an admin password form that showed a confirmation while the old password kept working. Those were deleted rather than fixed. A control that is not wired to anything is worse than a missing feature, because the operator believes the thing happened.