UmaKuma Updates

The 89 themes existed as data an admin could browse and a member could not reach. The profile page now has a picker: the theme on now drawn as its own ladder, every choice as a four-rung preview, and search across names and rungs. Switching is instant and retroactive because nothing stored moves - the SRS values stay apprentice/guru/master/enlightened/burned and only the words change. Beside it an age band rather than a birthdate: the only thing the site wants from age is whether to offer the handful of themes about organised crime and nightlife, and an account that has never said is treated as the youngest.

Area

account

Name

「ねざしのめいめい」 · 根ざしの命名 Nezashi no Meimei · naming what you are rooted in

The profile drew the form to change a JLPT certificate the moment it loaded - an editor, always open, for something that changes twice a decade - and it held one certificate, so reporting a new pass quietly erased the last one. A member holds as many as they have sat: the ladder is meant to be climbed. Certificates are rows now, listed hardest first with the year each was earned, and the card leads with the hardest and counts the rest - "N3 + 2 more". Adding one asks for the year first, because the year decides which test applies: a 2007 sitting offers Levels 1 to 4 and a 2022 one offers N1 to N5, and level 3 in 2007 is old Level 3 rather than N3, which did not exist until the 2010 restructure. The panel stays shut until it is asked for, taking one out is a control on the certificate itself, and the status - planning to sit, none, rather not say - is only asked of a member holding none, since holding one is the answer. The three answers already given were carried into rows. Who can see you was three bordered blocks for a question asked once; it is three lines. Reported 2026-09-02 by John.

Area

account

Name

「さかのぼるごうかく」 · 遡る合格 Sakanoboru Goukaku · every pass, going back

A member with no WaniKani had nothing on their profile to connect one with, and a member who had just connected was told they were Level 0. The connection page arrived with its own release and the profile now leads to it - Connect WaniKani when there is none, Replace token when there is - and the card no longer states a level nobody holds: a token whose first sync has not landed reads as Connected, with a line saying the level arrives with the sync. Zero is the number the leaderboard deliberately refuses to rank an account at, so printing it as a standing was the one number the page should never have shown. Reported 2026-09-02 by John.

Area

account

Name

「けっていまえのれべる」 · 決定前のレベル Kettei Mae no Reberu · the level before it is settled

The reading challenge is one family's arrangement about pocket money, and it was on the public leaderboard with a button inviting anybody to log today's check-in. A member is one of three kinds now - admin, internal, everyone else - and the Read page, its nav tab, its banner on the leaderboard and the check-in route behind it are offered to the first two only. The Read group keeps its news reader for everybody, under the name News, so nobody loses a page. Admins grant the kind from the row menu in the users table; the members already here a month with WaniKani were marked internal in one pass. Requested 2026-09-02 by John.

Area

account

Name

「かぞくのかこい」 · 家族の囲い Kazoku no Kakoi · the family's own circle

The welcome wizard asks for a WaniKani token once, in a step built to be skipped, and tells anyone who skips it that they can connect later from their profile. That sentence was a promise with nowhere to land: the profile said WaniKani, Not connected, and stopped there, so a member who said Later had no way back short of making a new account. There is a page now, at /users/<member>/wanikani, listed under Settings beside Profile and Libraries and linked from the fact on the profile that used to be a dead end. It leads with what connecting adds and with what a member keeps either way, because the question someone without WaniKani actually has is whether it is worth getting one, and the honest answer is that most of UmaKuma never asks. Then the walkthrough: where WaniKani keeps its tokens, which two permissions the token needs - assignments:start and reviews:create, without which lessons and reviews done here never reach WaniKani - and the field itself, checked against the API before it is stored so the member sees the account it resolved to. A connected member gets the same page as a statement of their connection, with the field closed behind Replace token, since nothing here can read the stored one back. The request the wizard and the page share now lives in one place rather than two.

Area

account

Name

「うまくつながる」 · うまく繋がる Umaku Tsunagaru · your own reviews, brought across

Pressing Sign out in the account menu led to a page with Logout and Join as tabs above it and Cancel beside the button, so a member who had asked to leave was still signed in and had no way to tell from looking. The menu signs you out there and then and lands on the home page. It is a button rather than a link, because a link to a page that ends a session would be prefetched on hover and hovering a menu must not sign anybody out. The page itself is still there for anybody who arrives at it directly, without the two tabs, and it says plainly that you are still signed in until you press the button. Reported 2026-09-02 by John.

Area

account

Name

「もうでた」 · もう出た Mou Deta · already out, not asked twice

Signing in with Google for the first time, with the site open to anyone, landed on Join with invite code - with no code, no way in and no way out but Sign out, and a refresh brought it straight back. The home page, the sign-in screen and the invite form itself each sent a signed-in viewer with no account to the invite form, while the page that actually creates an account was reachable only by typing its address. One rule now decides where such a viewer goes: the account page while signup is open, the invite form only when it is invite only. The invite form applies the rule too, so a newcomer cannot be shown it while the door is open, on arrival or on a refresh. Reported 2026-09-01 by John, signed in as a second Google account.

Area

account

Name

「すなおないりぐち」 · 素直な入口 Sunao na Iriguchi · an entrance that does what it says

The route that creates an account had nothing bounding how often it could be called. It was never as bad as it sounds - a Google session is required before it does anything, and an address that already has an account gets that account back rather than a second one, so the ceiling was always one account per address rather than one per request. What was unbounded was the work behind it. Every call reads the signup settings, looks up the account, and scans every slug on the site to pick a free address, and a signed-in caller could repeat all of that as fast as they liked. Six attempts in ten minutes now, which leaves room for a form submitted twice, a retried request and a reload, and stops a loop. It is counted against the signed-in address rather than the caller's network address, because a household shares one of those - this one does - and a per-network budget would have the second person in a family turned away by the first. The check sits above all three reads rather than beside them, since a limit applied after the work bounds the answer and not the cost. None of this matters while the door is shut; all of it matters the moment it opens.

Area

account

Name

「にっかのにもつ」 · 日課の荷物 Nikka no Nimotsu · the load one day is allowed to carry

A handful of words now cannot become a member's address. Signing up as Admin or Support would have produced /users/admin and /users/support, which read as the site speaking rather than as a member - and the first person to get one would have taken it by accident rather than by malice, since the address is built from whatever display name they arrived with. Reserved words are treated exactly like a name somebody already has: they take the numbered suffix, so nobody is refused an account and only the address moves. Their display name is untouched. Worth saying what this is not: it was written down as a route-shadowing risk and it never was one. Every member page lives under /users/ and there is no dynamic segment at the root, so /admin is the admin page whatever anyone calls themselves. The backlog note has been corrected rather than quietly deleted.

Area

account

Name

「しるしのしかく」 · 印の資格 Shirushi no Shikaku · the right to wear the badge

An API route here was public unless somebody remembered to guard it, and two never did - which is how a stranger came to be able to read a member WaniKani progress by holding an account id. That is the wrong way round for a site whose whole content is members data, so being open is now a decision that has to be written down. A test walks every route file and requires each one to either check who is asking or appear in a list of public routes with the reason it is safe to leave open. A new route that forgets fails the build rather than production, and adding one to that list is a deliberate act a reviewer sees in the diff. The same test checks two other things the list can drift on: that a route listed as public still exists, and that any public route which touches the database or calls an external API is rate limited. It caught one straight away - the book cover proxy, which does two database reads and up to two lookups against openBD and Google Books per call, with nothing throttling it. Its responses cache hard, but a cache only helps a repeated ISBN and varying one walks straight past it, so it is now limited to 120 requests a minute per address. The cache posture everywhere else was already correct: the static catalogue routes cache publicly at the edge for a day or more, and no route behind a session declares a public cache, so nothing personal can be served from a shared one.

Area

account

Name

「いつものいりくち」 · いつもの入口 Itsumo no Irikuchi · the usual way in

Two per-account endpoints had no authentication of any kind. Both take an account id straight from the path, and both read that member encrypted WaniKani token: the JLPT route decrypts it and calls WaniKani with it, and the levels route reads a progress snapshot and writes a fresh one back. Verified against a running server with no cookies at all, a stranger holding an id received that member own kanji progress - subject ids, characters, meanings - and their level snapshot showing what they had learned. Both now answer 401 before touching the database. This was also an uncapped cost vector, which is how it was found: four database queries and an outbound WaniKani call per request, repeatable as fast as anyone cared to ask, on endpoints nothing was rate limiting. The explorers that call them only ever ask about the member whose page they are on, so requiring a session costs nothing that was working. Checked before the row is read rather than after, so a refused request costs one query rather than five.

Area

account

Name

「わけるわな」 · 分ける罠 Wakeru Wana · the trap that tells them apart

Turning an account down used to do almost nothing. A rejected member kept their session, opened their own pages, and answered every study, tag and game route as before - the only thing rejection changed was that they stopped appearing on the leaderboard, which is to say the admin's one sanction was to make somebody invisible to everyone except themselves. It now closes four doors at once: the owner check every /api/study and /api/custom-study route runs through, the viewer resolution that the user pages and the header are built on, the invite cookie (cleared on the next request rather than at some later sign-in), and signup, which will not hand back an account it has turned away or let the same email make a second one. A rejected member lands on a plain notice instead, with no reason given and no appeal form - a reason tells somebody acting in bad faith what to change, and a form hands them a channel. Being turned away stays separate from being merely pending: somebody still waiting keeps the run of the site, which is what the signup copy promises them, so the lock is written as "rejected" rather than "not approved". Accounts predating the column read as approved, because a lock that defaulted the other way would shut out the whole family on deploy.

Area

account

Name

「にらむにおう」 · 睨む仁王 Niramu Niou · the glaring temple guardian

/api/join created accounts and never asked whether signing up was allowed. It took a Google session and a WaniKani token and upserted an account straight into the database - no invite code, no signup mode, no approval - so the whole invite-only model could be walked around by anyone who could sign in with Google and hold any working WaniKani token. It had no caller anywhere in the app, having been replaced by the invite panel, and it is deleted rather than gated: a gate would have reopened it the moment open signup was switched on, and it would then have created accounts that skipped the onboarding wizard and the approval queue as well.

Area

account

Name

「せきもんせいり」 · 関門整理 Sekimon Seiri · tidying the gateways

/api/leaderboard took no session and applied no filter: it selected from Account directly and handed every member's nickname and real WaniKani username to anyone who asked, children included, while the home page had long since moved to the filtered loader. The route was serving nobody in the app and leaking to everybody. It now requires a session and reuses loadLeaderboardAccounts, so one place decides who may be seen - each member's own visibility choice plus the admin's approval - and a signed-in stranger with no account here sees what a stranger sees. The background sync trigger moved behind the same check; it was reachable anonymously, which let anyone on the internet make the server start refreshing accounts against the WaniKani API.

Area

account

Name

「しまるしきり」 · 締まる仕切り Shimaru Shikiri · the partition that shuts

An invited member may have no Google account at all, and the welcome page assumed one - sending them to the sign-in screen from a page they were entitled to open. It now accepts either kind of session and routes them to their own page.

Area

account

Name

「てがみてばこ」 · 手紙手箱 Tegami Tebako · letters in a keepsake box

Accounts that predate the visibility setting now read as public, which is what they already were. Reading them as members-only had emptied the leaderboard for anyone who was not signed in. New accounts still start private, where no audience is being taken away.

Area

account

Name

「つゆつばめ」 · 梅雨燕 Tsuyu Tsubame · swallows in the rainy season

A newcomer now gets a welcome instead of a locked door: what UmaKuma is, that WaniKani is not required, a name, and a choice of who can see them, which they can change on their profile whenever they like. Leaderboards respect that choice. Who may join, what they start on and which questions are asked are all set from a new admin page, and it ships closed.

Area

account

Name

「そうしゅんそうげん」 · 早春草原 Soshun Sogen · grassland in early spring

Asking for the login page while already signed in answered with a sign-out screen. It now takes you where you were headed, or to your own page. The sign-out tab links straight to the one screen that signs you out instead of bouncing through a redirect with no page of its own, and calls it Sign out, the wording used everywhere else.

Area

account

Name

「せせらぎせみ」 · せせらぎ蝉 Seseragi Semi · cicadas over a babbling brook

Back to leaderboard is hidden for viewers the home page would send straight back, so the button no longer returns you to the page you are already reading. The screen also sends a member who has an account but no WaniKani connection to their own page instead of bouncing them through the invite form.

Area

account

Name

「すいさいすみれ」 · 水彩菫 Suisai Sumire · a violet in watercolour

Page access matched on a WaniKani username, so an account that signed in with Google and never connected WaniKani was turned away from every page it owns - its own profile included - while its API calls kept working. Access now matches the permanent slug first and falls back to the username, so links shared earlier still resolve.

Area

account

Name

「しずけさしぐれ」 · 静けさ時雨 Shizukesa Shigure · the quiet of a passing shower

Settings now opens on a profile: change the name other members see, record a JLPT certificate, and read a table of every game you have finished. WaniKani level stays read-only because WaniKani sets it, and an account with no WaniKani connection reads Not connected instead of showing a blank.

Area

account

Name

「さとやまさんぽ」 · 里山散歩 Satoyama Sanpo · a walk through the foothills

Every account gets a permanent slug and a display name it can change. Pages resolve by either the slug or the old WaniKani username, so links already shared keep working, and an account with no WaniKani connection is now reachable at all.

Area

account

Name

「くものくらし」 · 雲の暮らし Kumo no Kurashi · life among clouds

An account no longer requires WaniKani. The six connection fields are nullable, and every surface that used them now asks whether a connection exists instead of assuming one - WaniKani-derived boards leave unconnected accounts out rather than ranking them at level zero.

Area

account

Name

「きんぎょきせつ」 · 金魚季節 Kingyo Kisetsu · goldfish season

The join page sends resolved members to their own page, and the header only offers links the viewer can actually open.

Area

account

Name

「ちからちゃわんむし」 · 力茶碗蒸し Chikara Chawanmushi · power egg custard

Sign-in now matches you to your account by your linked email address.

Area

account

Name

「せいけつなせんとう」 · 清潔な銭湯 Seiketsu na Sentou · spotless bathhouse

Invite codes for members who do not sign in with Google.

Area

account

Name

「しぶいしば」 · 渋い柴 Shibui Shiba · effortlessly cool shiba dog

Direct Google OAuth flow for admin and linked members.

Area

account

Name

「こがねのこい」 · 黄金の鯉 Kogane no Koi · golden koi