Skip to content

2026 Shopee connector audit and staging incidents

Historical record only (May–June 2026). CT 105 was destroyed after the August staging migration; this is not a deployment runbook or a statement about today's connector behavior. See tcg-platform for the current architecture and host.

  • 18 May — audit closeout. The post-Phase-7 audit filed 45 issues (#135–#179); eight remediation PRs (#180–#187) merged that day. Webhook signature/base-URL handling, OAuth state, order processing, token handling and environment routing were among the repaired areas. The contemporaneous write-up records sequential deploy/smoke checks on CT 105, but those checks are not a present-day validation.[1]
  • 18 May — staging storage incident. The contemporaneous CT 105 deployment notes report that successive image builds exhausted the host pve/data LVM thin-pool twice despite apparent free space inside the guest; writes failed and a healthy old container did not prove the new image deployed. They record snapshot/cache cleanup and a reboot to recover. Lesson: check the backing storage pool and the deployed revision, not only guest df or /health. CT 105-specific snapshot/prune commands from the old runbook are intentionally not carried forward.[1]
  • 18 May — integration build failure. A webhook-handler conflict resolution left eventIdHeader referenced before declaration; the staging build failed and hotfix #189 hoisted the declaration. Lesson: test the integrated tree after resolving overlapping PRs. The old wiki text and the hotfix PR disagree about whether CI already ran a Medusa build, so neither CI-coverage claim is retained here.[1][2]
  • 1 June — scheduled-job contract. Four Shopee jobs used a destructured { container } argument although Medusa's loader invoked handler(container) positionally; PR #225 changed their signatures and updated tests. The old incident note reports failed historical ticks and one completed post-deploy tick; that single-tick observation does not prove every job or current stock synchronization is healthy. Lesson: invoke job handlers with the runtime's argument shape in regression tests.[1][3]

Sources

[1] https://github.com/ExzenHQ/wiki/pull/57 [2] https://github.com/ExzenHQ/tcg-platform/pull/189 [3] https://github.com/ExzenHQ/tcg-platform/pull/225