{
  "id": 268045,
  "title": "I Found Two Bugs in Zulip. The Maintainers Had Filed Both Two Weeks Earlier.",
  "url": "https://urgent.news/2026/08/07/i-found-two-bugs-in-zulip-the-maintainers-had-filed-both-two-weeks",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-07T14:38:24.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/p0rt/i-found-two-bugs-in-zulip-the-maintainers-had-filed-both-two-weeks-earlier-4mom"
  },
  "original_language": "en",
  "account": "This is a report on my findings during the DEV's Summer Bug Smash: Smash Stories powered by Sentry challenge. I discovered two critical bugs in Zulip's codebase related to data corruption during Slack importer. Both bugs were already reported by the maintainers in issue #39650, which was opened on June 30th. Upon searching the tracker, I found that the maintainers had already started working on fixing these bugs in the open PR #39757. I decided to pivot and look for other bugs in Zulip's codebase.\n\nThe first bug I uncovered was related to thread state not surviving chunk boundaries during Slack message conversion. Messages are streamed in chunks of 1,000, and the thread replies are allocated inside the per-chunk function. If replies belong to a previous chunk, they land in an orphan topic named \"... No channel message\". This bug remained undetected due to the lack of cross-chunk cache treatment.\n\nThe second bug I discovered was due to the thread key being truncated to seconds, causing distinct threads to be merged into one topic when bots posted messages within one second of each other. Both bugs were silent, with no exceptions or warnings, but they resulted in migrated archives being incorrect.\n\nAfter realizing that the maintainer had already fixed these bugs in their open PR #39757, I decided to look for other bugs in Zulip's codebase. I found a latent twin of the bug class in the Microsoft Teams importer, which I reported in PR #39814. Additionally, I found an unguarded timestamp sort key in the Microsoft Teams importer, which could cause silent NaN failure modes on top of the two bugs I had already discovered.\n\nOverall, my experience during the DEV's Summer Bug Smash challenge taught me the importance of thorough testing and the potential consequences of data corruption in large batch jobs. I learned that even bugs that seem obvious and well-covered can still slip through the cracks, and it is crucial to remain vigilant and continue searching for potential issues.",
  "summary": "This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . I went hunting in Zulip's codebase for this challenge and found two real data-corruption bugs in the Slack importer. Solid ones: silent message scrambling during workspace migrations, the kind of bug that costs somebody a re-migration. Then I did the thing you are supposed to do before writing a single line of fix.…",
  "key_points": [],
  "editors_take": null,
  "illustration": "https://urgent.news/ill/268045.png",
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}