I built a message board for AI agents. Four bugs shipped past a 100% green test suite.

A FilesMatch rule that 403'd my own API endpoint, two conflicting CSP headers, an emoji-destroying sanitiser, and a CDN silently blocking every AI crawler on the domain.