Vulnerabilities on Darflen

Darflen has had many bugs and vulnerabilities in its history. Users who find a major vulnerability or many smaller bugs without abusing them receive the Bug Hunter Badge. Most of these bugs and vulnerabilities have been fixed, but many of them have left traces or can still be seen.
==Terminology==
A "bug" is a design defect in computer software,https://en.wikipedia.org/wiki/Software_bug and in the case of Darflen, bugs are used to refer to mostly harmless issues (such as custom duration polls). Usually, the difference with a "vulnerability" is that a vulnerability can harm the safety or integrity of Darflen or its users (such as the XSS vulnerabilities). An "exploit" is not a category like a bug or vulnerability. It is used to refer to a bug or a vulnerability (but usually a vulnerability) which could give a user an advantage/benefit (such as C2PE).
It is not always simple simple determine which category issues fall into and if they should be considered an exploit; for that reason, these are not strict definitions and many users use the terms interchangeably.
==Bugs and vulnerabilities==
===Self-follow===
This bug allowed users to follow themselves. It was discovered by ,https://darflen.com/posts/44c8f58b1c1702795e2a61d7 although it was also discovered independently by many more users after. This bug worked by opening your main profile while on an alt, opening a new tab, logging out and back into your main, going back to the first tab, and clicking the follow button. Some users call this "dual tab" self-follow as it uses two tabs, and it used similar logic to the first anarchy community exploit. The last user to do it was qxva.
===Conjoining===
Conjoined accounts are a vulnerability where two accounts share the same username, which was discovered by MrMeems. Conjoined accounts could be made by setting the username of two users to be the same thing, simultaneously, on different devices. Only one of the accounts have a profile; the other cannot be accessed without unconjoining. This is known as "masking" and "bodying": masking is the profile, and bodying is the hidden account. The bodied account cannot be blocked or followed, making them a hidden account that can be potentially abused. This got MrMeems banned.
====Conjoined self-following====
JamieD132 managed to follow himself using conjoining, making his account the only one to follow itself twice (once with the dual tab method, once with conjoining). However, technically, he only followed himself once (using method 1), but the second time was on an alternate account that had the same username, as part of conjoining. He was the only user to do this.
====Deletion bypassing====
During a livestream on YouTube,https://www.youtube.com/watch?v=s9CUQqnXAgU MrMeems showed that he was logged in to a deleted account (formerly ;https://www.youtube.com/watch?v=s9CUQqnXAgU at 10:50 a triple conjoined account). The account was deleted by Paradock but it didn't log him out, most likely because it was still conjoined to a non-deleted account. Notifications received from this user looked like the notifications from any deleted user - they appeared in the notifications but without the username of who had sent them. The account had no profile picture, username, banner or email, and its profile was located at /users, which made it a 404 error.https://www.youtube.com/watch?v=s9CUQqnXAgU at 12:00 It couldn't create posts,https://www.youtube.com/watch?v=s9CUQqnXAgU at 8:33 or view posts and users;https://www.youtube.com/watch?v=s9CUQqnXAgU at 8:15 attempting to view them returned a 500 error. When the account tried to use the #xx hashtag, it broke the entire hashtag page.https://www.youtube.com/watch?v=s9CUQqnXAgU at 8:52 After the account had posted, attempting to view recent posts on Explore gave a "Can not generate" error.https://www.youtube.com/watch?v=s9CUQqnXAgU at 11:15 After MrMeems tried logging into on his phone, he was logged out of the deleted account on his computer, showing the accounts were still conjoined.https://www.youtube.com/watch?v=s9CUQqnXAgU from 12:22 to 13:11 
===2 character usernames===
Although not technically a bug, in the past, anyone could make accounts with 2 character username. However, this was changed after too many users namesniped 2 character username accounts. Now, 2 characters can only be obtained by asking Paradock, although there must be a valid reason (namesniping is not one).
1 characters were never possible to create and Paradock has refused to give anyone any.
===Community glitches===
====Anarchy communities====
Anarchy communities, or ownerless communities, are communities that have no owner or moderators, usually (but not always) made intentionally by users. Zero-member communities are a rarer variant of anarchy communities, which have no members. There are more than 84 anarchy communities left, however only some zero-member anarchy communities still exist, mostly with visibility set to invite only. This is due to movements to stop anarchy communities. Many bugs/vulnerabilities were used to create anarchy communities, all of which have been fixed apart from dual state and incorrect account deletion.
====Custom visibility====
In the past, communities could have their visibility edited with inspect element to make them have a custom visibility.https://api.darflen.com/communities/nil Some example include %nil,"visibility":"AAAAA[...AAAAAA"] %ii"visibility":"editing the visibility of this community to make it actually broken -jinx" and %minecraft."visibility":"Minecraft is a 2011 sandbox game developed by Mojang Studios and originally released in 2009. The game was created by Notch" Custom visibility communities act like unlisted ones; the name does not show in posts in custom visibility communities. It was also possible to edit the visibility of someone else's community, though Jinx was the only user to ever do this. The total amount of custom visibility communities has decreased as some previously custom visibility communities had their visibilities changed by the owners.
====Cross-community reposts====
This bug was discovered by PkmnQ. It let users repost a post in a community by using the API. This was called “cross-community reposts” by most users, even though there was no requirement for it to be cross community; it was a bug to even be able to repost a post not in a community inside of one. There are few examples of this bug, but one is this post by PkmnQ.Note the post is reposted in , a custom visibility community. This makes it act like an unlisted one. This can be seen in the api page: "group":{"id":"ad00cf6a5ad7f3098c27d010","profile":{"name":"ii",[…]}}
====2 characters====
Although not technically a glitch, older communities had a 2 character restrictions for names & display names, as opposed to the current 3 character limit. This means 2 character communities such as and other XX formats were created (mostly by cheesewhisk3rs and Marimo, and many are now private). is the only known community with a 2 character display name, being "((".
====C2PE====
C2PE, the “community pinned post exploit”, was an exploit that allowed the modification or deletion of any post.https://darflen.com/posts/ced6c9abe3f7e32c63d772c9 It worked by pinning a post outside of a community inside the community, which meant the owner of the community could edit or delete it. The bug was discovered by DaGreenBoi (as ) and cheesewhisk3rs in the evening of (UTC).https://api.darflen.com/posts/c47bdf1f63f03ae0ef1c92e6 The community where this exploit was discovered was an anti-S4IL community, which was deleted after the exploit was patched because cheesewhisk3rs reported it. However, the original post in the community remains. The first post ever edited by C2PE was deleted by the poster, cheesewhisk3rs, after realising there was a major exploit happening. cheesewhisk3rs then discovered full deletions were possible, and DaGreenBoi went on to abuse this.
Posts affected include:
*The official account's posts, one of which was edited to say that Darflen had committed 63 felonies, but all of which were eventually deleted.
* A post by Jcole, which was was edited to contain #meow.https://darflen.com/posts/ced6c9abe3f7e32c63d772c9 This post was edited back after a few months.
*S4IL's pinned post which was edited by both DaGreenBoi and cheesewhisk3rs.300% homophobia increase
*Posts by stat boosting alts of Blaze were deleted.
The exploit was working for approximately 2 hours until Paradock removed the ability to deletehttps://darflen.com/posts/7612fcb49329cbcbdf0c8d9b while working on a patch, but an alternate version was discovered and then Paradock took down the website and replaced it with the iconic maintance [sic] screen. cheesewhisk3rs got the Bug Hunter Badge for their role in discovering this vulnerability, but DaGreenBoi didn't because he abused the vulnerability; in fact he actually got temporarily banned. C2PE was the first major vulnerability in a series that were discovered in 2024.
===Link parsing bugs===
If Markdown was placed directly after a link, the starting HTML tag used to be interpreted as part of the link, which could cause odd extra text to appear. This also worked with pings and hashtags. It was also found much later that this applied to ending tags as well, allowing formatting to break out of posts and affect the entire page.
===Ban bypassing===
This exploit was discovered by qxva shortly after the Bug Hunter Badge was announced, around .https://api.darflen.com/posts/63da51be5dcbf4a0543ed2fd {"creation_time":1728692869} He used his banned alt, , to test if it still worked. It was finally fixed 2 days before ayd was banned.
===XSS bugs===
===Biglyderv website wipe===
===Poll bugs===
====1-option polls====
Using inspect element, one could delete an option in a poll to only have one option left. An example is this poll by focy.
=====0-option polls=====
These were discovered by PkmnQ.https://darflen.com/posts/9aa525460537b1f6f4fb4d9b A variation of 1-option polls, 0-option polls would usually crash Darflen.
====Poll option conjuring====
This bug was discovered by PkmnQ, who got the right to name it for having discovered it. However, it was later revealed Biglyderv discovered it before PkmnQ, in a post before the Great Post Wipe, although the name did not change.https://darflen.com/posts/3e2f73d2efc204013010586c It worked by running code in the console to vote an extra option in a poll, however the option was always blank and there was no way to add text. This bug allowed some polls to have more than the limit of 8 options, such as the record holder poll made by Jinx, which has 12 options (and additionally lasts 27396 years). These poll bugs resulted in PkmnQ receiving the Bug Hunter Badge. 
====Custom duration polls====
This bug was discovered by ayd on . It worked by using inspect element to change the duration value of a poll. The first custom duration poll, which is now private, had a duration of -1 and, as it stated, "ended instantly" - any negative value caused an instant end poll. An example of this bug is this poll by , which lasts 2739726026 years. This bug was one of those which lasted a long time, several months, and was used by many users, just like the first self-follow method. JamieD132 owns the last custom duration poll.
==References and notes==