I work for a company with a similar sort of online ordering API, and a while back some enterprising person discovered that:

1. Our API had a hidden "tip" feature; we hadn't exposed it in the storefront yet, mostly because the developer in charge of it had left with it halfway finished, and nobody had picked it back up yet

2. But the API itself was perfectly functional. If you manually submitted an order to the API with a tip set, it would be reflected in the total, would bill your credit card, etc.

3. Except (I'm sure you saw where this is going...) the now-departed dev hadn't added any validation yet. So if you ordered $40 worth of pizza and added a negative $39 tip...boom, nearly free pizza.

We learned a few valuable lessons for the cost of buying a college student a couple of pizzas. :)

At least you didn't sue them for that. There are enough companies that would've done so..

We actually debated offering them a job interview when they graduated. If they'd contacted us first, we might have. :) Instead we just fixed the bug, called it a day, and spent a few days reviewing the rest of the API for weak validation.

I wonder what would happen if you order $40 worth of pizza and stated a -$41 tip! paid to eat pizza, hurray!

Good advice; I'm not sure I tried that. The goal wasn't to steal toppings or get free pizza though; it was an impromptu response to my desire for lots of bacon and encountering the duplicate limit, and then a busy signal on the phone. Once I figured out it didn't charge me for more, I just wanted to see what would happen. I figured they'd think it was a system glitch and call when they received the order.

I'm struggling to grok exactly how that would work.

1 pizza with bacon, -1 pizza (without bacon?)

Then what, hope the employee reads -1 as 1 and doesn't cancel the order and call you to find out what you wanted?

I must be missing something...

Being a negative, the delivery driver arrives and demands you give him a pizza.

The employee will ignore the negative sign in front of the number and make you that pizza anyway. The calculation of the total is where it might give you free pizza.

Yeah that's what I figured. The wording of the post made it sound like it had something to do with the bacon though. You could just do this for any arbitrary pizza.

The bacon is there so you pay something, a free pizza would be weird even to a minimal wage employee (not that they're dumb, but they probably don't care).

Though that's assuming the people making online orders even bother looking at the amount paid. I don't necessarily see why they would (or why they wouldn't assume you had merely cashed in some sort of promo or balance).

I've seen instances this works on gift cards.

No pizza, half -1 bacon?

Instructions unclear. Employee entered home and stole existing pizza from freezer.