This site's argument is that a record nobody re-checks is decoration. Today the audit was pointed at the desk itself, and it found three things — a hole in the software, a fabricated finding in a case file, and a court holding published backwards.
All three are fixed. Here is what they were.
The front door
Every entry here has a social card generated on demand at a URL that includes the entry's name. The code took that name from the address bar and used it, unchecked, to find a file on disk.
A request for an entry name that walked up out of the content directory returned a rendered image of this site's own configuration file — its title, its summary, its word count, printed on a Hugin-branded card. Anything of that file type the server could reach was readable by anyone who asked. The response size also quietly answered a second question: whether a given file existed at all.
Nothing sensitive is in reach of that path, and there is no evidence anyone used it. That is luck, not design.
The fix is a whitelist rather than a filter. An entry name here is lowercase letters, digits and single hyphens, and nothing else is admitted — a shape that cannot express the characters an escape needs. Blacklists of escape spellings have been losing to the next encoding for thirty years; this one is enforced at the point the file path is built, not in the callers that happen to exist today.
Two related things went with it. The same card printed whatever name it was given, so anyone could have minted a Hugin-branded image carrying a sentence they wrote, served from this domain — a reader checking the address bar would have concluded the desk published it. And two status endpoints returned the database driver's raw error text to anyone who asked, which during an incident names the host and the account. Both closed.
A finding the committee never made
The Epstein file's entry for a Senate Finance analysis asserted that several banks had reported large payments only after Epstein was charged, one of them flagging more than $170 million years late.
The release says none of that. It concerns one bank. It contains no "several banks", no "years late", and its only $170 million is a named individual's payments to Epstein, which the release describes as ostensibly for tax and estate planning. The release's actual reporting finding — $4.3 million flagged before 2019, then $1.3 billion in retroactive reports, nearly three hundred times larger — was already recorded correctly elsewhere in the same file.
So the desk had invented a compliance finding, attributed it to a named committee, and in doing so displaced what the source actually published. The sentence was written on 1 July and had no source from the day it was typed.
The uncomfortable part is what caught it, and what did not. This desk runs an automated checker that pulls values out of every cited claim and looks for them in the document. It marked that sentence confirmed — because the string "$170 million" really is on the page, attached to a different subject. The checker verifies values, not sentences, and cannot see a figure bolted to the wrong noun. That limit is now stated on the source ledger rather than left for a reader to discover.
A holding the court refused to make
Yesterday's entry said the en banc Eleventh Circuit held that the Crime Victims' Rights Act "confers no rights enforceable before the government files charges."
That is the one question the court declined to answer. From the opinion:
We conclude that we needn't decide whether, in the abstract, the rights to confer and to be treated with fairness might attach prior to the formal commencement of criminal proceedings.
Both dissents criticise the majority precisely for leaving it open. What the court actually held, 7–4, is narrower: the Act provides no private right of action to enforce those rights in a freestanding civil suit outside a proceeding that already exists.
Worse, that entry replaced a summary that had been correct. The record, the published entry, and the entry's no-allegation warning are all corrected, and the correction is listed rather than quietly swapped.
What changed underneath
Three checks now run against the case corpus that did not exist a week ago.
One reads every cited document and looks for the specific values the desk claims are in it — 176 of the checkable claims confirmed, and the ones that could not be checked counted separately rather than folded in as passes.
One refuses to let a source carry a fact dated after the source itself was published, which is how a September 2024 press release came to be cited for a December 2025 vote.
And one, added today, catches a row that holds a second dated event inside it. That shape is how the Boeing file lost an entire year: a single row titled "two 737 MAX crashes" sat at the date of the first, so the second crash and the grounding order three days later had no date of their own. Two more rows with that defect were found today and split — the Boeing non-prosecution agreement away from the dismissal five months later, and a court filing away from a separate motion two days after it.
Nine invariants now fail the build rather than the reader.
Later the same day: eighty corrections
The audit that found the three defects above also produced 306 proposed corrections to the case records, each one written against a primary source, and 196 independent verdicts on those proposals. The checker refused 89 of the 196 — forty-five per cent of everything it looked at, from work that had already been told to fetch and quote the source. That refusal rate is the reason none of this was applied in bulk.
Eighty of the verified corrections are now in the record. The case corpus went from 294 cited sources to 318. Among them: the Changpeng Zhao clemency is no longer described as an unverified report, because it is a signed federal warrant published on justice.gov, and this desk re-read the Department's own clemency index before changing the entry.
Two case files had to be finished by hand, and both are worth naming. In one, a correction repointed an entry off secondhand coverage and onto the court's actual order — but the citation it added named the accompanying opinion rather than the order itself. In the other, a proposed citation for a 2025 executive order pointed at the Federal Register document for a 2020 one, because the newer order describes itself as building on the older and something reading for a reference took the wrong end of that sentence. Both were caught before publication, one by the checker and one by the structural audit.
The part worth keeping
None of this was found by a reader, a researcher or a critic. It was found by turning the same instruments on this desk that it points at other people's archives, and the instruments were not kind.
A desk that publishes other people's gaps and not its own is running a double standard. The corrections page now lists changes to the case records themselves, not only to written entries, with the superseded text kept readable underneath.
Source links
- Eleventh Circuit en banc, In re Courtney Wild — the opinion and its express reservation
- Senate Finance Committee — the JPMorgan analysis, and what it does and does not say
- Corrections — including, now, corrections to the case records
- Source ledger — what this desk can retrieve, and what its checker cannot see
- Case file: Epstein public records
- Case file: Boeing 737 MAX safety oversight