Abdulbasit Alabi @strange_dev_

A Nigerian startup launched their app. Built a clean OTP flow. No rate limiting on the SMS endpoint. Shipped it. Within 48 hours, their Termii balance went from ₦150,000 to zero. They woke up to failed OTP delivery complaints from real users. Checked their logs. Someone had been hitting their /send-otp endpoint in a loop with thousands of requests sending SMS to sequential phone numbers that were not even their users. This is called SMS pumping fraud. Here is how it works: • Fraudsters find your open OTP endpoint • They send requests to thousands of phone numbers, sometimes numbers they control on premium routes • Every successful SMS costs you money • They get a cut from the carrier. You get the bill. It is automated. It runs while you sleep. The fixes that would have stopped it entirely: • Rate limit by IP: max 3 OTP requests per IP per hour • Rate limit by phone number: max 3 requests per number per 10 minutes • Add a minimum delay between requests • Implement CAPTCHA or device fingerprinting on the frontend • Alert yourself when SMS spend spikes above a threshold None of this is complicated. All of it takes less than a day to implement. That startup lost ₦150,000 in two days and had to shut down OTP entirely while they fixed it. Their users thought the app was broken. Some never came back. The breach was not dramatic. No hacker. No sophisticated attack. Just an open endpoint and a bot. Secure your OTP flow before you launch. Not after you've learned the hard way.

49 189 1K 191K 1K

View Details

Abdulbasit Alabi @strange_dev_

3 months ago

@hackSultan Omo... E get as e be

0 0 0 2 0

View Details

Abdulbasit Alabi @strange_dev_

3 months ago

@codeShips I'm a backend wizard, what are we building? Let's ....

0 0 1 10 0

View Details

Smart👨‍💻 | Software Engineer @smartnakamoura

3 months ago

When you build a product that collects Nigerian user data and you have never heard of NDPR, I genuinely hope you don't find out about it through a lawsuit. The Nigeria Data Protection Regulation requires: • A real privacy policy users can actually read • Explicit consent before collecting personal data • Data minimization — only collect what you need • Breach notification within 72 hours if user data is exposed • A Data Protection Officer if you process data at scale NITDA can fine you up to 2% of annual gross revenue or ₦10 million whichever is higher. Most Nigerian devs have never heard of this. They ship, collect BVNs, phone numbers, emails with zero compliance structure. NDPR is not just a big company problem. If you have users, you are responsible for their data.

19 94 402 20K 311

View Details

Abdulbasit Alabi @strange_dev_

6 months ago

@KR3Wmatic youtube.com/shorts/vJcLw_3… @KR3

0 0 0 2 0

View Details

SeeBuy Storez @SeeBuy_Storez

7 months ago

If you're tired of blackouts, noise, and fuel cost, you need to see this. itel just released a 500W Solar Generator … and it has already proven to be the most affordable and efficient backup power solution in Nigerian right now. Here’s why 👇