340 accounts, one uppercase letter
Here is what happened. On a Tuesday we shipped a small patch to the account system. Nothing cosmetic. We changed how emails were stored so password resets would be faster. We tested on three desktop browsers. Everything passed. Then the messages started.
A player sent a screenshot at 11:40. She typed her email the way she always did on her phone. The keyboard auto-capitalized the first letter. Our login said the account did not exist. She had been playing since March. She was locked out of a save with 40 hours in it.
By the time we pulled the logs, 340 accounts had failed a login in under three hours. That number is small next to popular free shooter games, and it does not matter. Those were 340 people who could not get into a match. The window between their screenshot and a live patch was 90 minutes.
The cause was one line. Our check compared the email exactly as typed. If the account was stored as player@mail.com and someone signed in as Player@mail.com, our code said no. Desktop users type lowercase. Mobile keyboards capitalize. We only tested desktop.
We want to be clear about how this shipped. We do not have a QA team. We are students. Our test list was three laptops and whichever phone happened to be on the desk. That is the whole story of the bug. The fix took longer to write this paragraph than to code.
The exact change, and the test list we now run
We normalized the email on both sides. On signup we lowercase and trim the address. On login we do the same before comparing. If you type spaces at the end or capitals in the middle, the server never sees the difference. The account you made on a laptop opens on a phone.
That is the entire patch. Same account, same password, every device. If you were locked out, your progress was never touched. Everything you earned is still there. The two in-game currencies still come from playing, not paying, so nothing was lost in the gap either.
Then we wrote down the devices we test on, because guessing is how we got here. Android Chrome on a mid-range phone. iOS Safari on an older iPhone. Firefox and Chrome on desktop. One school laptop with integrated graphics and a tight firewall. Edge, because a few of you use it.
The bigger fix is process. Any change to login, accounts, or saving now gets tested on a real phone first, before desktop. The phone is the harder case. If it works there, it tends to work everywhere. We also added a check on signup: if your email looks unusual, we no longer reject it silently. We tell you what we saw.
That last part took ten minutes and would have prevented this whole thing. Silent failures are the worst kind. You see a blank error and assume you typed the wrong password. We saw nothing on our end at all.
What this says about how you play without downloading
The reason this stung is that we are a browser game. You click a link and you are in. No install, no launcher, no credit card, no waiting for a 40 GB download. That is the answer to how to play games online without downloading in pc: you find a game that runs in the tab, and you play. Our whole promise is that the first step is instant. A broken login breaks that promise on the very first click.
Being browser-first means we live in other people's software. Your phone keyboard, your browser version, your school's content filter. We do not control any of it. So the login screen has to be the most boring, most predictable page we make. It is the door. If the door is fiddly, nobody sees the room.
It also means we test on the worst device, not the best. A player on a hand-me-down Android at 3G speed is the real test. If The Agency loads for her, it loads for someone on a gaming rig with fiber. We would rather under-promise on hardware and over-deliver on access.
The upside of no-install is that a fix is instant too. We did not push an update to an app store and wait three days for review. We changed the server check, and the next time you opened the tab, you were in. Nobody had to redownload anything. For a small studio, that speed is the whole advantage.
So this is not just a bug story. It is the reason we now treat the phone as the default device instead of the exception. Most of our players are on phones. We had been testing for a minority and shipping to a majority. That was backwards.
What 90 minutes of indie development actually looks like
People ask how long does indie game development take. Honest answer: the big things take months, and the small things that decide whether anyone stays take an afternoon. This fix fits in a lecture break. Finding it took weeks of the right people showing up.
We found it because a player sent a screenshot instead of a review that said the game is broken. Both are fair. One is actionable in an hour. That is the difference. The 340 number came from our logs, not a survey, and we would rather count the real affected accounts than guess.
A student on the team read the screenshot in a hallway, spotted the capital letter, and had a patch ready before the next lecture started. No standup, no ticket, no approval chain. When you are small, the person closest to the problem is often the person who can fix it. We protect that.
The lesson is not that we are fast. It is that small teams fail in small ways and can fix them just as small. We also fail in ways a bigger studio would catch with a checklist. Both are true. We choose to say both out loud.
We track a lot of this stuff where players can see it. Threads like this show up on the indie game development forum and in our own idea board. You pitch a feature, everyone gets one vote, and the top ideas become the roadmap. Bug reports feed the same list. Your screenshot went from a DM to a patch in 90 minutes.
Why we are done testing on desktop first
We are rebuilding the launch checklist around one rule: if it touches accounts, it gets tested on a phone before anything else. That single change would have caught this, and it will catch the next one. Rules beat good intentions.
We also added a small banner in the account settings: the exact devices we support and the last date we tested them. If you are on something we have not tried, you will know before you file a report. No guessing on either side.
Then there is the report button itself. It now attaches your device, browser, and a short error code automatically. You type what went wrong. We get the rest. The screenshot that saved us was great, but most players will not send one, and we should not depend on heroics from a stranger.
None of this is a feature you can see. It is plumbing. But every mode you do see depends on it: the 24-mission campaign, RUSH wave survival, DOMINION, the Loadout Lab, and the original 2020 Unity build we keep online as Classic. If the login breaks, all of it goes dark at once.
We also kept a rule from this week. When we cut or break something, we say so, with a number if we have one. 340 players, 90 minutes, one uppercase letter. That is the whole post. No spin.
Your account works everywhere now. Here is what we want next
Sign in on whatever you have. Phone, laptop, school machine. If it fails, the report button now tells us why before you finish typing. That is the takeaway, and it is also the promise.
Our roadmap still runs on the idea board. Anyone can pitch, everyone gets one vote, and the top ideas become what we build. This fix came from one of you, not from a planning meeting, and we would like more of that. A short message with a screenshot carries more weight here than a long one with opinions.
If you are new, the fastest way to help is to just play. Play on your phone, your laptop, your weird old tablet. The devices we do not own are the ones that find the bugs we cannot. That is not a slogan. That is literally how this one got found.
We are a small student studio in Tunisia. We cannot outspend anyone. We can answer a screenshot in 90 minutes and ship a fix before the next class. That is the trade we make, and it is working.
Next week we are watching the login and signup numbers on mobile closely. If they dip again, you will hear about it here with the real count. Same as this time.