Summary
In June 2026, Marvelist experienced two separate incidents in which new user registration was silently broken for up to 24 hours. Users who attempted to create an account during these windows authenticated successfully but were not created in the Marvelist database – meaning they could not access the app. Both incidents have been fully resolved. All affected users were contacted personally.
---
Impact
- New user registration was non-functional during two separate windows in June 2026, each lasting approximately 24 hours.
- Existing users were not affected – accounts, data, lists, and tasks remained fully intact throughout both incidents.
- Affected new users were unable to complete sign-up and access the app.
- All affected users have been identified and contacted directly with an apology and instruction to re-register, should they want to continue with trying Marvelist.
---
Incident 1
Approximate date: 20th June 2026
A routine database change inadvertently removed a user account that was configured as the DEFINER for a database trigger responsible for creating new user records on registration. When the DEFINER account no longer exists, the associated trigger silently fails – no error is surfaced to the application or the user. Authentication via Microsoft Entra ID continued to succeed, creating the misleading experience of a completed sign-up.
The issue was identified approximately 1-2 days after the change was made, when a discrepancy was noticed between installs and active user accounts. The trigger was redefined against a valid service account and user creation was restored.
---
Incident 2
Approximate date: 22nd June 2026
Following the resolution of Incident 1, the database triggers were being migrated across into backend server code updates. During the migration, the INSERT statement responsible for creating new users was missing the UUID column – a required field in the users table. As a result, the INSERT failed as UUID is a required column and no longer being inserted by the database trigger. This left new users authenticated successfully but absent from the Marvelist database.
The issue was identified and resolved within 24 hours. The migration was corrected to include the UUID column in the INSERT statement, and the registration flow was verified end-to-end before re-opening to new users. Affected users were contacted personally.
---
Root Cause
The two incidents have related but distinct root causes:
Incident 1 – A database trigger was configured with a named DEFINER account rather than a durable service identity. Routine maintenance that removed that account caused the trigger to fail silently, with no application-level error surfaced to the user.
Incident 2 – A backend migration that redefined the user creation trigger omitted the UUID column from the INSERT statement for the users table. This generated server-side errors stating UUID is a required column, leaving new users without a Marvelist account despite successful Entra ID authentication.
Both incidents share a common thread: silent failures in the registration path with no immediate alerting mechanism to detect them.
---
Resolution
- For incident 1, the trigger was redefined to re-instate the registration flow end-to-end.
- For incident 2, after trigger migration to backend code, the
UUIDcolumn was added to the INSERT statement. - Affected users were identified via Entra ID and contacted personally.
- All affected users have been offered assistance re-registering.
---
Prevention
The following are in the works to prevent recurrence:
- Automated post-deployment health check – a smoke test will run after every deployment and database change, perfoming an end-to-end registration test and verifying that new accounts are correctly created in both Entra ID and the Marvelist database. Failure will trigger an immediate alert.
- Scheduled registration monitoring – periodic automated checks will verify that the registration flow is functioning correctly between deployments.
---
A note from Chris (the developer)
Two registration outages in one month is not acceptable, and not the level of service and experience I aim for, I apologise to anyone who tried to sign up during these windows and hit a wall.
Both times the fix was straightforward once identified – the failure was not catching it sooner.
Marvelist is a solo-built app, and the safety nets have to be deliberately built in. That's what I'm doing now. If you were affected and haven't heard from me yet, please reach out at help@marvelist.co.uk and I'll get you sorted.
---
Contact
For any questions or if you believe you were affected: help@marvelist.co.uk.
No comments yet