DEV Community: Justin Koo

The Most Damaging Bug I Found This Month Wasn't in Code — It Was Between Two Documents

Justin Koo — Mon, 21 Sep 2026 20:09:59 +0000

The most damaging bug I found this month wasn't in code. It was between two documents.

Last week I tore down Spout Finance — a tokenized-equity borrowing protocol on Solana — for their public beta feedback bounty. I read the docs, stress-tested the economics, published a full teardown. Standard stuff.

Then I did one extra pass that most people skip: I diffed the docs against the Terms of Service.

Six numbers, six disagreements

The ToS (spout.finance/terms — the legally binding document) and the docs (the document users actually read) disagree on:

#	Item	Docs say	ToS says
1	spAsset mint/redeem fee	0.20%	0.25%
2	Withdrawal fee	0.20%, lender side only	*1% on borrowing and* lending withdrawals**
3	Liquidation buffers	4%–12.5%	7.5%–20%
4	Loss waterfall	Insurance → Junior → Senior	Insurance → Junior → Protocol Treasury → Senior
5	Tranche yield targets	Senior ~9%, Junior ~32% APY	Senior ~8.67%, Junior ~24–27%
6	Options cycle cadence	weekly (Friday→Friday)	"weekly or biweekly depending on the asset"

Plus a fee the docs' fee page doesn't carry at all: an ~7% "Idle Routing Fee" on yield from idle pool capital deployed to onchain money markets.

Individually, each looks like a drafting slip. Collectively they describe two different products. And #2 is the scary one: if "borrowing withdrawals" means drawing loan proceeds, a 1% fee on a 50%-LTV draw is 2% of borrowed notional — a de-facto origination fee sitting directly under the docs' "no origination fee, ever" headline.

The docs' waterfall actually undersells the real structure (#4 gives Senior an extra protection layer). So this isn't a company hiding costs in fine print — it's a company whose two documents drifted apart, in both directions, on the numbers its entire risk model stands on.

The method (an afternoon, mostly grep)

Pull both documents as text. Curl the HTML, strip tags. If the legal docs live in GitBook, request /llms.txt and the .md version of each page — no scraping needed.
Extract every number with its context line. Percentages, basis points, time periods, fee names, waterfall orders. grep -nE '[0-9]+(\.[0-9]+)?\s*(%|bps|basis points)' terms.md > terms_hits.txt
Join on concept, not string. "Withdrawal fee", "withdrawals from the protocol", "funds leaving the pool" — same concept, three phrasings. This is the step that takes actual reading; budget an hour.
Diff the pairs. For every concept with a number on both sides, do the numbers match? Every mismatch goes in a table with section citations.
Check for orphans. Numbers that appear in ONE document only — like that 7% idle routing fee. Those are often the most interesting finds.

That's it. No fuzzing, no testnet exploits, no chain forensics — just patient reading of the two documents a company publishes about itself.

I put the method on camera here (70 seconds, using the public Spout material): youtube.com/watch?v=4pLWgMKtVRI

Why founders should care

The document users would sue under and the document users read first are different products. In a dispute, the ToS wins. In a purchase decision, the docs win. When they disagree, you've built a lawsuit generator with your marketing budget.
Each divergence is cheap to fix now. It's a one-line correction — or a decision to actually align the product with one of the two claims. After launch, after a liquidation event, after a regulator asks? Expensive.
It's not just fintech. I ran the same 5-minute check on three other crypto products' public materials last week: all three had gaps — one had a flagship marketing claim its ToS never mentions, two had fee structures in one document and absent from the other. The pattern is the norm, not the exception.

The 5-minute self-check

Open your own pricing/docs page and your own ToS in two windows. Search both for: every %, every fee, every fee-adjacent noun, APY, guarantee, freeze, terminate, refund. Ask of each hit: does the other document agree with this number, or is it silent? Silence counts too — a fee that exists in the ToS but not the docs page is how "hidden fees" headlines get written.

The fix, if you find drift: render both documents from one canonical numbers source. Fees, buffers, waterfalls, yield targets — define each number once, in one file, and generate both outputs from it. Documentation drift is a build problem, not a writing problem.

I do this as a service

Documentation-vs-Terms review for fintech and crypto products: I cross-check your docs, ToS, whitepaper and marketing site for contradictions, gaps, and orphan claims — delivered as a cited table of findings plus fix recommendations within 72 hours. Documentation review, not legal advice (I'm not a lawyer; your counsel makes the calls — I make sure they see every mismatch in one place).

Method + case studies: loveoftheai.github.io/demo-videos/audit.html

The Spout teardown that started this (with the full six-contradiction table): loveoftheai.github.io/spout-teardown/

All findings cited in this post are from Spout's public documents (spout.finance/docs and spout.finance/terms) as of Sep 21, 2026, and were published in the teardown before this article. Not investment advice.

I cut launch trailers for free before anyone pays me — here's why that works

Justin Koo — Mon, 21 Sep 2026 19:37:41 +0000

You're two weeks from launch. You need a 30-60 second trailer. You DM a few video editors and get back: $1,500-5,000, 2-4 weeks, 50% upfront, and a portfolio of videos for other people's products.

You have no way to know what your trailer will look like until you've already paid.

The spec-first workflow

I flipped the order. Before anyone pays me anything, I cut the actual trailer for the product — from nothing but its public site, repo, and posts:

Read everything public: landing page, docs, changelog, founder posts.
Write the script: hook, product, receipts, offer. Every claim sourced from public material.
Cut the real thing overnight: screen captures with motion, scripted voice-over, 1080p.
Deliver it labeled as a spec trailer — a draft cut by someone who has never talked to you.

Then the founder judges the real thing, not promises. If the format fits, the paid version (repo access, real footage, revisions) follows. If it doesn't, they lost nothing and keep the video.

Two real examples

Both unsolicited, both clearly labeled as spec trailers, all facts from public sources.

Poko Motion — a live AI product. 40 seconds, cut in one sitting from their public site: hook card, product sections, honest end card.

PRIMO AI — a fitness app still stuck in app review, with zero public footage. So the trailer is pure typography built from the founder's public build-in-public posts, labeled concept because that's what it is:

And a launch trailer for my own product (real captures, motion terminal, replay):

Why "unsolicited" is a feature, not a bug

A spec trailer proves three things a portfolio can't:

Speed — overnight, not a two-week pipeline.
Taste — the founder sees their own product framed, not a template.
Research — the script only works if someone actually read the public material. If the script is wrong, you learned the vendor can't read. Cheap discovery.

The full production recipe (PIL + ffmpeg + one neural voice, ~$0 in software) is public in my previous post. The secret isn't the pipeline — it's doing the reading and the sitting.

Try it

If you're pre-launch and have no trailer: your public site is enough for a first cut. 30-60 seconds, first cut in 48 hours, launch-week pricing while my calendar is empty.

Portfolio and contact: loveoftheai.github.io/demo-videos

Spec/concept trailers are drafts made from public material only and labeled as such inside the video. If you're Poko, PRIMO, or another company above and want yours taken down or re-cut with real access — DMs open.

40-second launch trailers with PIL, ffmpeg and one neural voice — no editor, no cloud

Justin Koo — Mon, 21 Sep 2026 18:50:58 +0000

I build 40–60 second launch trailers for small AI products, and the entire pipeline is Pillow, ffmpeg and one neural voice. No timeline editor, no cloud video service, no stock template. This post is the actual recipe — every command is real and runs on a laptop.

Why not an editor (or a video model)

A 40s launch trailer is not cinematography. It's three layers:

Typography cards — big statements, one per beat
Motion — screenshots or cards that move just enough to feel alive
Voice — 5 sentences of script, read clean

Video models generate footage, but founders don't need footage of their product — they need their actual UI shown with rhythm and a voice that lands. And a timeline editor is slow precisely because the format is so rigid: 5 beats, card → screen → card. Rigid formats should be code.

Layer 1 — cards with Pillow

One card = one ImageDraw pass. Palette locked to 4 colors, one font family, accent bars instead of decoration:

from PIL import Image, ImageDraw, ImageFont

BG, FG, ACC, DIM = (14,16,13), (238,240,232), (200,235,90), (150,155,145)
card = Image.new("RGB", (1920,1080), BG)
d = ImageDraw.Draw(card)
big  = ImageFont.truetype("/usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf", 118)
d.text((160, 380), "MOST FITNESS APPS", font=big, fill=FG)
d.text((160, 520), "RENT THEIR BRAIN.",  font=big, fill=FG)
d.rectangle((160, 700, 560, 716), fill=ACC)   # accent bar

The whole hook card is ~15 lines. The rule that matters: one idea per card, one accent per card. If a card needs two accent bars, it's two cards.

Layer 2 — motion with ffmpeg zoompan

Ken Burns on a static card, 4K canvas downscaled to 1080 (this is the classic zoompan aliasing fix):

ffmpeg -loop 1 -i card.png -vf \
  "scale=3840:2160,zoompan=z='min(1+0.0009*on,1.12)':d=210:\
   x='iw/2-(iw/zoom/2)':y='ih/2-(ih/zoom/2)':s=1920x1080:fps=30" \
  -t 7 -c:v libx264 -pix_fmt yuv420p card_move.mp4

d=210 = 7 seconds × 30fps. The min() cap is what stops the classic zoompan runaway zoom. For product screenshots the same filter gives you a slow push-in — a static screenshot suddenly reads as "demo".

Layer 3 — one neural voice

edge-tts --voice en-US-ChristopherNeural --rate=+10% \
  --text "Most fitness apps rent their intelligence from someone else's cloud." \
  --write-media seg1.mp3

Deep voice, +10% pace, five segments. Script discipline: one sentence per segment, written after the cards, so the voice confirms what the eye just read instead of racing it.

Assembly — the mux trick that keeps audio in sync

Per segment, pad the audio to the exact video length (never rely on -shortest, it clips tails):

ffmpeg -i seg1.mp4 -i seg1.mp3 -filter_complex \
  "[1:a]apad=whole_dur=7.0,atrim=0:7.0[a]" -map 0:v -map "[a]" \
  -c:v copy seg1_mux.mp4

Then concat and web-optimize:

printf "file 'seg1_mux.mp4'\nfile 'seg2_mux.mp4'\n..." > list.txt
ffmpeg -f concat -safe 0 -i list.txt -c copy -movflags +faststart trailer.mp4

Total render time for a 40s trailer: under 3 minutes on a small ARM box. The slow part is the script — always is.

The spec-trailer move

Here's the workflow that changed my conversion rate: when a founder posts "I need a launch video", I don't send a quote. I cut a spec trailer from their public site overnight — their screenshots, their copy, my script and motion — clearly labeled "spec trailer" in the end card, facts only from public sources. They wake up to their product looking like a real launch.

The video at the top of this post is one of those, cut in one sitting. A second example, this one from a real browser capture plus a terminal sequence rendered frame-by-frame with PIL:

Ethics guardrail that keeps this honest: the spec is labeled a spec, nothing is invented, and the founder owes nothing if the format doesn't fit. It's a sample with their name on it, not a finished deliverable held hostage.

When this stack is the wrong tool

You need live-action humans → camera, always
You need 3D → Blender, and honestly, hire someone
The product is visual-noise (games, image models) → capture matters more than typography, and capture is manual

For everything else — dev tools, AI apps, infra, anything with a UI and a sentence of value prop — this pipeline turns "launch video" from a two-week agency project into a 48-hour turnaround.

I do these commercially — $99 launch-week rate, 48h delivery, script + voice + motion included. Samples and pricing: https://loveoftheai.github.io/demo-videos — or find me on X @wuwei2022.